homelab/stack
1
0
Fork 0
Code Issues 58 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity

ci: fail-fast everywhere — no silent swallowing
Some checks failed
CI / skinny-install (aco) (push) Successful in 1m11s
Details
CI / skinny-install (api) (push) Successful in 31s
Details
CI / skinny-install (bcda) (push) Successful in 35s
Details
CI / skinny-install (bib) (push) Successful in 44s
Details
CI / skinny-install (bls) (push) Successful in 31s
Details
CI / skinny-install (ccw) (push) Successful in 35s
Details
CI / skinny-install (cli) (push) Successful in 39s
Details
CI / skinny-install (cms) (push) Successful in 35s
Details
CI / skinny-install (conf) (push) Successful in 36s
Details
CI / skinny-install (opps) (push) Successful in 35s
Details
CI / skinny-install (perf) (push) Successful in 35s
Details
CI / skinny-install (pfs) (push) Successful in 38s
Details
CI / skinny-install (rex) (push) Successful in 32s
Details
CI / lint-test (push) Failing after 11m32s
Details
Deploy / build-scan-report (push) Has been cancelled
Details
Package Supply Chain / pkg-supply-chain (push) Failing after 43s
Details

Browse Source 
- ci.yml: fail-fast: true on skinny-install matrix; remove || true
  from pytest so test failures actually propagate
- deploy/harden/rebuild-all: trivy --exit-code 1 (was 0) — builds
  now fail on HIGH/CRITICAL vulns instead of silently logging them
- pkg-supply-chain: set -euo pipefail + remove || true from trivy
  scan so vuln scan errors surface immediately
This commit is contained in:
kert
2026-04-16 14:32:28 -04:00
parent 4611e39031
commit 6fee5eb29c
5 changed files with 17 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
.gitea/workflows/ci.yml
View File

@@ -50,6 +50,7 @@ jobs:
skinny-install:
runs-on: ubuntu-latest
strategy:
fail-fast: true
matrix:
extra: [conf, aco, api, bcda, bib, bls, ccw, cli, cms, opps, perf, pfs, rex]
steps:
@@ -70,7 +71,7 @@ jobs:
- name: Run module tests
run: |
if [ -d "tests/${{ matrix.extra }}" ]; then
uv run pytest "tests/${{ matrix.extra }}/" -x -q || true
uv run pytest "tests/${{ matrix.extra }}/" -x -q
fi
- name: File failure issue

8
.gitea/workflows/deploy.yml
View File

@@ -79,16 +79,16 @@ jobs:
crane push /tmp/mc.tar git:3000/homelab/stack/mc:latest --insecure
- name: Scan notebooks
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o notebooks-scan.json local/notebooks:build
run: trivy image --severity HIGH,CRITICAL --exit-code 1 --format json -o notebooks-scan.json local/notebooks:build
- name: Scan zotero
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o zotero-scan.json local/zotero:build
run: trivy image --severity HIGH,CRITICAL --exit-code 1 --format json -o zotero-scan.json local/zotero:build
- name: Scan docs
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o docs-scan.json local/docs:build
run: trivy image --severity HIGH,CRITICAL --exit-code 1 --format json -o docs-scan.json local/docs:build
- name: Scan api
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o api-scan.json local/api:build
run: trivy image --severity HIGH,CRITICAL --exit-code 1 --format json -o api-scan.json local/api:build
- name: Report vulnerabilities
env:

8
.gitea/workflows/harden.yml
View File

@@ -77,16 +77,16 @@ jobs:
crane push /tmp/mc.tar git:3000/homelab/stack/mc:latest --insecure
- name: Scan notebooks
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o notebooks-scan.json local/notebooks:build
run: trivy image --severity HIGH,CRITICAL --exit-code 1 --format json -o notebooks-scan.json local/notebooks:build
- name: Scan zotero
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o zotero-scan.json local/zotero:build
run: trivy image --severity HIGH,CRITICAL --exit-code 1 --format json -o zotero-scan.json local/zotero:build
- name: Scan docs
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o docs-scan.json local/docs:build
run: trivy image --severity HIGH,CRITICAL --exit-code 1 --format json -o docs-scan.json local/docs:build
- name: Scan api
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o api-scan.json local/api:build
run: trivy image --severity HIGH,CRITICAL --exit-code 1 --format json -o api-scan.json local/api:build
- name: Close resolved or file new vuln issues
env:

5
.gitea/workflows/pkg-supply-chain.yml
View File

@@ -49,8 +49,9 @@ jobs:
- name: Vulnerability scan
run: |
trivy fs --scanners vuln --format json -o data/pkg-vulns.json uv.lock || true
trivy fs --scanners vuln --format json -o data/pkg-vulns-pyproject.json pyproject.toml || true
set -euo pipefail
trivy fs --scanners vuln --format json -o data/pkg-vulns.json uv.lock
trivy fs --scanners vuln --format json -o data/pkg-vulns-pyproject.json pyproject.toml
- name: Auto-create issues for drift and vulns
env:

8
.gitea/workflows/rebuild-all.yml
View File

@@ -78,16 +78,16 @@ jobs:
crane push /tmp/mc.tar git:3000/homelab/stack/mc:latest --insecure
- name: Scan notebooks
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o notebooks-scan.json local/notebooks:build
run: trivy image --severity HIGH,CRITICAL --exit-code 1 --format json -o notebooks-scan.json local/notebooks:build
- name: Scan zotero
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o zotero-scan.json local/zotero:build
run: trivy image --severity HIGH,CRITICAL --exit-code 1 --format json -o zotero-scan.json local/zotero:build
- name: Scan docs
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o docs-scan.json local/docs:build
run: trivy image --severity HIGH,CRITICAL --exit-code 1 --format json -o docs-scan.json local/docs:build
- name: Scan api
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o api-scan.json local/api:build
run: trivy image --severity HIGH,CRITICAL --exit-code 1 --format json -o api-scan.json local/api:build
- name: Report vulnerabilities
env: