b834a88fb2
Buildx DinD pushes images to the registry but doesn't load them into the host Docker daemon. Trivy must pull from the registry directly. Use --image-src remote to skip local Docker lookup and --insecure to accept the self-signed Traefik TLS cert.
166 lines
4.5 KiB
YAML
166 lines
4.5 KiB
YAML
when:
|
|
- event: manual
|
|
|
|
variables:
|
|
- &buildx_image woodpeckerci/plugin-docker-buildx:5-insecure
|
|
- &buildx_base
|
|
buildkit_config: |
|
|
[registry."gitea.homelab.fhirworx.io"]
|
|
http = true
|
|
registry: gitea.homelab.fhirworx.io
|
|
username:
|
|
from_secret: registry_user
|
|
password:
|
|
from_secret: registry_pass
|
|
- &trivy_scan
|
|
image: aquasec/trivy:latest
|
|
- &diag_env
|
|
UV_PYTHON_PREFERENCE: only-system
|
|
UV_LINK_MODE: copy
|
|
UV_PROJECT_ENVIRONMENT: .venv
|
|
GITEA_TOKEN:
|
|
from_secret: gitea_token
|
|
|
|
steps:
|
|
- name: build-push-notebooks
|
|
image: *buildx_image
|
|
settings:
|
|
<<: *buildx_base
|
|
repo: gitea.homelab.fhirworx.io/homelab/notebooks
|
|
dockerfile: notebooks/Dockerfile
|
|
context: notebooks/
|
|
tags:
|
|
- "sha-${CI_COMMIT_SHA:0:8}"
|
|
- latest
|
|
|
|
- name: build-push-zotero
|
|
image: *buildx_image
|
|
settings:
|
|
<<: *buildx_base
|
|
repo: gitea.homelab.fhirworx.io/homelab/zotero
|
|
dockerfile: zotero/Dockerfile
|
|
context: zotero/
|
|
tags:
|
|
- "sha-${CI_COMMIT_SHA:0:8}"
|
|
- latest
|
|
|
|
- name: prep-docs-context
|
|
image: alpine:3
|
|
volumes:
|
|
- /home/kert/stack/data:/host-data:ro
|
|
commands:
|
|
- mkdir -p data
|
|
- cp /host-data/bib.sqlite data/ 2>/dev/null || true
|
|
|
|
- name: build-push-docs
|
|
image: *buildx_image
|
|
settings:
|
|
<<: *buildx_base
|
|
repo: gitea.homelab.fhirworx.io/homelab/docs
|
|
dockerfile: docs/Dockerfile
|
|
context: .
|
|
tags:
|
|
- "sha-${CI_COMMIT_SHA:0:8}"
|
|
- latest
|
|
depends_on:
|
|
- prep-docs-context
|
|
|
|
- name: build-push-api
|
|
image: *buildx_image
|
|
settings:
|
|
<<: *buildx_base
|
|
repo: gitea.homelab.fhirworx.io/homelab/api
|
|
dockerfile: api/Dockerfile
|
|
context: .
|
|
tags:
|
|
- "sha-${CI_COMMIT_SHA:0:8}"
|
|
- latest
|
|
|
|
- name: build-push-mc
|
|
image: *buildx_image
|
|
settings:
|
|
<<: *buildx_base
|
|
repo: gitea.homelab.fhirworx.io/homelab/mc
|
|
dockerfile: rustfs/Dockerfile.mc
|
|
context: rustfs/
|
|
tags:
|
|
- "sha-${CI_COMMIT_SHA:0:8}"
|
|
- latest
|
|
|
|
- name: scan-notebooks
|
|
<<: *trivy_scan
|
|
commands:
|
|
- trivy image --image-src remote --insecure --severity HIGH,CRITICAL --exit-code 0 --format json
|
|
-o notebooks-scan.json
|
|
"gitea.homelab.fhirworx.io/homelab/notebooks:sha-${CI_COMMIT_SHA:0:8}"
|
|
depends_on:
|
|
- build-push-notebooks
|
|
|
|
- name: scan-zotero
|
|
<<: *trivy_scan
|
|
commands:
|
|
- trivy image --image-src remote --insecure --severity HIGH,CRITICAL --exit-code 0 --format json
|
|
-o zotero-scan.json
|
|
"gitea.homelab.fhirworx.io/homelab/zotero:sha-${CI_COMMIT_SHA:0:8}"
|
|
depends_on:
|
|
- build-push-zotero
|
|
|
|
- name: scan-api
|
|
<<: *trivy_scan
|
|
commands:
|
|
- trivy image --image-src remote --insecure --severity HIGH,CRITICAL --exit-code 0 --format json
|
|
-o api-scan.json
|
|
"gitea.homelab.fhirworx.io/homelab/api:sha-${CI_COMMIT_SHA:0:8}"
|
|
depends_on:
|
|
- build-push-api
|
|
|
|
- name: report-vulns
|
|
image: ghcr.io/astral-sh/uv:python3.13-bookworm-slim
|
|
failure: ignore
|
|
environment:
|
|
<<: *diag_env
|
|
commands:
|
|
- uv sync --no-dev
|
|
- |
|
|
for f in notebooks-scan.json zotero-scan.json api-scan.json; do
|
|
[ -f "$f" ] && uv run python -m api.diag.vuln "$f" || true
|
|
done
|
|
depends_on:
|
|
- scan-notebooks
|
|
- scan-zotero
|
|
- scan-api
|
|
|
|
- name: deploy
|
|
image: docker:cli
|
|
volumes:
|
|
- /run/user/1000/docker.sock:/var/run/docker.sock
|
|
- /home/kert/stack:/home/kert/stack
|
|
commands:
|
|
- cd /home/kert/stack
|
|
- TAG=sha-${CI_COMMIT_SHA:0:8}
|
|
- FQDN=gitea.homelab.fhirworx.io
|
|
- for SVC in notebooks zotero docs api mc; do
|
|
docker pull $FQDN/homelab/$SVC:$TAG &&
|
|
docker tag $FQDN/homelab/$SVC:$TAG fhirworx/$SVC:$TAG;
|
|
done
|
|
- sed -i "s/^COMMIT_SHA=.*/COMMIT_SHA=$TAG/" .env 2>/dev/null || echo "COMMIT_SHA=$TAG" >> .env
|
|
- docker compose up -d --remove-orphans
|
|
depends_on:
|
|
- scan-notebooks
|
|
- scan-zotero
|
|
- scan-api
|
|
- build-push-docs
|
|
- build-push-mc
|
|
|
|
# ── Failure reporter ─────────────────────────────────────────
|
|
- name: report-failure
|
|
image: ghcr.io/astral-sh/uv:python3.13-bookworm-slim
|
|
failure: ignore
|
|
environment:
|
|
<<: *diag_env
|
|
commands:
|
|
- uv sync --no-dev
|
|
- uv run python -m api.diag
|
|
when:
|
|
- status: [failure]
|