5aa043daea
Woodpecker CI is gone from the runtime; this purges the stale mentions in env/dev scripts, dashboards, homepages, CSS comments, and READMEs. Renames the SSO admin env var WOODPECKER_ADMIN to GITEA_ADMIN to match where the admin actually lives. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
62 lines
1.7 KiB
YAML
62 lines
1.7 KiB
YAML
# CI-agnostic pipeline definition for package supply chain management.
|
|
# This is the abstract spec — use gen_config.py to emit concrete workflow
|
|
# files for Gitea Actions and GitHub Actions.
|
|
#
|
|
# Pipeline: inventory → mirror-sync → drift-check → vuln-scan → issue-create
|
|
|
|
name: Package Supply Chain
|
|
|
|
triggers:
|
|
push:
|
|
paths:
|
|
- "**/Dockerfile*"
|
|
- "pyproject.toml"
|
|
- "uv.lock"
|
|
- "docs/package.json"
|
|
- "docs/pnpm-lock.yaml"
|
|
- ".gitea/workflows/*.yml"
|
|
schedule:
|
|
cron: "0 6 * * *" # daily at 06:00 UTC
|
|
|
|
env:
|
|
GITEA_URL: "http://gitea:3000"
|
|
DEVPI_URL: "http://devpi:3141/root/pypi/+simple/"
|
|
APT_MIRROR_URL: "http://apt-cache:3142"
|
|
|
|
steps:
|
|
- name: inventory
|
|
description: Scan repo and regenerate package manifest
|
|
run: uv run python dev/scripts/pkg_inventory.py
|
|
outputs:
|
|
- data/pkg-manifest.json
|
|
|
|
- name: mirror-sync
|
|
description: Update local mirrors to match manifest
|
|
needs: [inventory]
|
|
run: uv run python dev/scripts/pkg_mirror_sync.py
|
|
services:
|
|
- apt-cache
|
|
- devpi
|
|
|
|
- name: drift-check
|
|
description: Compare mirror contents against manifest
|
|
needs: [mirror-sync]
|
|
run: uv run python dev/scripts/pkg_drift.py
|
|
fail_on: drift
|
|
|
|
- name: vuln-scan
|
|
description: Scan mirrored packages for known CVEs
|
|
needs: [mirror-sync]
|
|
run: |
|
|
trivy fs --scanners vuln --format json --output data/pkg-vulns.json data/pkg-manifest.json
|
|
uv run python dev/scripts/pkg_vuln_report.py
|
|
tools:
|
|
- trivy
|
|
|
|
- name: auto-issues
|
|
description: Create Gitea issues for missing packages and CVEs
|
|
needs: [drift-check, vuln-scan]
|
|
run: uv run python dev/scripts/pkg_issues.py
|
|
env:
|
|
GITEA_TOKEN: "${GITEA_TOKEN}"
|