Claude
f9809550c8
zegit's arc-runner-pin.sh pins a runner image only when cosign verifies its digest against the runner-image public key (zegit#143), but nothing signed the images, so the pin refused every day. Sign the digest with the RUNNER_IMAGE_COSIGN_KEY repository secret after the publish and verify the signature in the same run. sign_only re-signs an image published before signing existed. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_0147GvtJgsTjDGcrfvJsx5jS
231 lines
12 KiB
YAML
231 lines
12 KiB
YAML
name: build image (gitea)
|
|
|
|
# Publishes the runner toolchain image from the SELF-HOSTED Gitea runners, via
|
|
# the in-cluster rootless buildkitd — the same path zegit's own images already
|
|
# use (zegit .github/workflows/image-gitea.yml).
|
|
#
|
|
# Why this exists alongside build-image.yml: that workflow is GitHub-only, so
|
|
# the image the Gitea runners are BUILT FROM could only be produced by GitHub.
|
|
# When GitHub Actions became unavailable on 2026-08-29 that circularity bit —
|
|
# the fix for a missing tool in this very image (openssl/jq, whose absence
|
|
# blocked v0.0.134 and v0.0.135) could not be published on the forge the project
|
|
# is moving to. This removes the dependency.
|
|
#
|
|
# build-image.yml's header says the runners cannot build images because rootless
|
|
# buildah needs user namespaces the pod does not have. That is true of buildah
|
|
# IN THE JOB, and irrelevant here: buildkitd is its own hardened workload in
|
|
# buildkit-system, and this job only speaks to it over the network with
|
|
# buildctl. Nothing is built inside the runner container.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: 'Image tag, e.g. 12.11.1-ci6 (upstream runner version + ci revision)'
|
|
required: true
|
|
type: string
|
|
sign_only:
|
|
description: 'Sign the already-published tag instead of building it (zegit#262: signs an image published before signing existed)'
|
|
required: false
|
|
default: false
|
|
type: boolean
|
|
push:
|
|
branches: [master]
|
|
paths:
|
|
- 'Dockerfile'
|
|
- '.github/workflows/build-image-gitea.yml'
|
|
|
|
env:
|
|
BUILDKIT_HOST: tcp://buildkitd.buildkit-system.svc.cluster.local:1234
|
|
BUILDKIT_VERSION: v0.32.2
|
|
REGISTRY: gitea.langenoja.se
|
|
IMAGE_PATH: zegit-zoo/zegit-forgejo-runner
|
|
COSIGN_VERSION: v3.1.3
|
|
|
|
jobs:
|
|
build:
|
|
# Gitea-only: buildkitd is an in-cluster service that GitHub runners cannot
|
|
# reach. build-image.yml still covers the GitHub/ghcr.io side.
|
|
if: ${{ github.server_url != 'https://github.com' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
with:
|
|
persist-credentials: false
|
|
|
|
# Workspace-local because the runner is non-root and cannot write to
|
|
# /usr/local/bin. The smoke test uses the FULL PATH deliberately:
|
|
# $GITHUB_PATH only takes effect for SUBSEQUENT steps, so a bare
|
|
# `buildctl --version` here would be command-not-found.
|
|
- name: Install buildctl
|
|
run: |
|
|
set -euo pipefail
|
|
case "$(uname -m)" in
|
|
x86_64) arch=amd64;;
|
|
aarch64) arch=arm64;;
|
|
*) echo "::error::unsupported arch $(uname -m)"; exit 1;;
|
|
esac
|
|
mkdir -p "$GITHUB_WORKSPACE/.bin"
|
|
curl -fsSL "https://github.com/moby/buildkit/releases/download/${BUILDKIT_VERSION}/buildkit-${BUILDKIT_VERSION}.linux-${arch}.tar.gz" \
|
|
| tar -xz -C "$GITHUB_WORKSPACE/.bin" --strip-components=1 bin/buildctl
|
|
echo "$GITHUB_WORKSPACE/.bin" >> "$GITHUB_PATH"
|
|
"$GITHUB_WORKSPACE/.bin/buildctl" --version
|
|
|
|
- name: buildkitd reachable
|
|
run: buildctl debug workers
|
|
|
|
# A master push VALIDATES that the Dockerfile still builds on both arches
|
|
# but publishes nothing; only an explicit dispatch names a tag and pushes.
|
|
# Guessing a tag from a branch push would silently mint versions.
|
|
- id: meta
|
|
run: |
|
|
set -euo pipefail
|
|
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
|
|
echo "push=true" >> "$GITHUB_OUTPUT"
|
|
echo "tag=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
|
|
echo "sign_only=${{ inputs.sign_only }}" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "push=false" >> "$GITHUB_OUTPUT"
|
|
echo "tag=ci-validation" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
# Refuse a publish that cannot complete, rather than reporting success
|
|
# having pushed nothing. A validation run needs no credentials.
|
|
# The Gitea Actions token cannot write packages; this needs an explicit
|
|
# package-write PAT (read:package is pull-only).
|
|
- name: Registry login
|
|
if: ${{ steps.meta.outputs.push == 'true' }}
|
|
env:
|
|
TOKEN: ${{ secrets.ZEGIT_CI_PACKAGE_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${TOKEN:-}" ]; then
|
|
echo "::error::ZEGIT_CI_PACKAGE_TOKEN is not visible to this run. It is the org-scoped package-write token every zegit-zoo image workflow uses (docs: flux-config docs/rotation/forge-secrets.yaml); this repository must be able to read the org secret, and the name must match."
|
|
exit 1
|
|
fi
|
|
mkdir -p "$HOME/.docker"
|
|
printf '{"auths":{"%s":{"auth":"%s"}}}\n' \
|
|
"$REGISTRY" "$(printf 'zegit-zoo:%s' "$TOKEN" | base64 -w0)" \
|
|
> "$HOME/.docker/config.json"
|
|
|
|
- name: Build multi-arch
|
|
if: ${{ steps.meta.outputs.sign_only != 'true' }}
|
|
run: |
|
|
set -euo pipefail
|
|
REF="${REGISTRY}/${IMAGE_PATH}:${{ steps.meta.outputs.tag }}"
|
|
# No --output on a validation run: buildctl v0.32 has no "cacheonly"
|
|
# exporter (run 16, 2026-09-08: 'exporter "cacheonly" could not be
|
|
# found'), so every push-triggered validation since this workflow
|
|
# was added had failed — silently, since nothing depended on it. A
|
|
# build without an exporter still builds every stage on both arches.
|
|
if [ "${{ steps.meta.outputs.push }}" = "true" ]; then
|
|
buildctl build --progress=plain \
|
|
--frontend dockerfile.v0 \
|
|
--local context=. \
|
|
--local dockerfile=. \
|
|
--opt platform=linux/amd64,linux/arm64 \
|
|
--output "type=image,name=${REF},push=true"
|
|
else
|
|
buildctl build --progress=plain \
|
|
--frontend dockerfile.v0 \
|
|
--local context=. \
|
|
--local dockerfile=. \
|
|
--opt platform=linux/amd64,linux/arm64
|
|
fi
|
|
|
|
# The image is a TOOLCHAIN, so "it built" is not the property that matters
|
|
# — "it still contains what the gates shell out to" is. build-image.yml
|
|
# asserts that with `docker run`, which does not exist on these runners;
|
|
# buildkit can do it directly by building a stage FROM the published image
|
|
# whose RUN fails when a tool is absent. That is strictly better: buildkit
|
|
# runs it natively per platform, so a package that resolves on amd64 but
|
|
# not on arm64 cannot reach half the nodes unnoticed.
|
|
#
|
|
# openssl and jq are on this list because their absence blocked v0.0.134
|
|
# and v0.0.135: the release tag gate shells out to both to verify the
|
|
# Control Plane's signed quorum verdict, and a missing tool was reported
|
|
# as "verdict not signed" and "signature FAILED verification" — a tooling
|
|
# gap narrated as a security verdict. Extend this list whenever a gate
|
|
# grows a shell dependency; it only covers what someone remembered to add.
|
|
- name: Assert the published image carries the toolchain the gates need
|
|
if: ${{ steps.meta.outputs.push == 'true' }}
|
|
run: |
|
|
set -euo pipefail
|
|
REF="${REGISTRY}/${IMAGE_PATH}:${{ steps.meta.outputs.tag }}"
|
|
work=$(mktemp -d)
|
|
{
|
|
echo "FROM ${REF}"
|
|
echo 'RUN set -eu; \'
|
|
echo ' python3 -c "import yaml, sys; print(\"python3+yaml\", sys.version.split()[0])"; \'
|
|
echo ' for t in gcc node bash make curl tar openssl jq chromium-browser psql; do \'
|
|
echo ' command -v "$t" >/dev/null || { echo "MISSING: $t" >&2; exit 1; }; \'
|
|
echo ' echo "ok: $t"; \'
|
|
echo ' done; \'
|
|
echo ' test -x "$(git --exec-path)/git-http-backend" || { echo "MISSING: git-http-backend" >&2; exit 1; }; \'
|
|
echo ' echo "ok: git-http-backend"'
|
|
} > "$work/Dockerfile"
|
|
cat "$work/Dockerfile"
|
|
buildctl build --progress=plain \
|
|
--frontend dockerfile.v0 \
|
|
--local context="$work" \
|
|
--local dockerfile="$work" \
|
|
--opt platform=linux/amd64,linux/arm64
|
|
echo "✓ toolchain intact on linux/amd64 and linux/arm64"
|
|
|
|
# zegit#143/#262: a -ci<N> tag is only a name, and ZEGIT_CI_PACKAGE_TOKEN
|
|
# (readable by every zegit-zoo branch run) can push one. Consumers pin
|
|
# this image only when `cosign verify` accepts its digest with the
|
|
# runner-image public key, so every published digest is signed here.
|
|
# The private key is a REPOSITORY secret of the runner repos only, never
|
|
# an org secret. Classic .sig tag, no transparency log: the registry is
|
|
# private and verifiers use --insecure-ignore-tlog with a pinned key.
|
|
- name: Sign the published image by digest
|
|
if: ${{ steps.meta.outputs.push == 'true' }}
|
|
env:
|
|
COSIGN_KEY_PEM: ${{ secrets.RUNNER_IMAGE_COSIGN_KEY }}
|
|
COSIGN_PASSWORD: ${{ secrets.RUNNER_IMAGE_COSIGN_PASSWORD }}
|
|
TOKEN: ${{ secrets.ZEGIT_CI_PACKAGE_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${COSIGN_KEY_PEM:-}" ] || [ -z "${COSIGN_PASSWORD:-}" ]; then
|
|
echo "::error::RUNNER_IMAGE_COSIGN_KEY / RUNNER_IMAGE_COSIGN_PASSWORD are not visible to this run (repository secrets, zegit#262). An unsigned runner image is never pinned."
|
|
exit 1
|
|
fi
|
|
case "$(uname -m)" in
|
|
x86_64) arch=amd64; sum=4629c757b7618056f8ddd7e2625ae9fdd94c0372a65049520bc7d9df9efc7f71;;
|
|
aarch64) arch=arm64; sum=c5d324e091826b0d7a78eb16fef316450b4eb9aaec045611c08ba06f5e73220a;;
|
|
*) echo "::error::unsupported arch $(uname -m)"; exit 1;;
|
|
esac
|
|
bin="$GITHUB_WORKSPACE/.bin/cosign"
|
|
curl -fsSL -o "$bin" "https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-${arch}"
|
|
echo "${sum} ${bin}" | sha256sum -c -
|
|
chmod +x "$bin"
|
|
tag="${{ steps.meta.outputs.tag }}"
|
|
tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT
|
|
# Credentials go through 0600 curl configs, never argv (zegit#139).
|
|
( umask 077; printf 'user = "zegit-zoo:%s"\n' "$TOKEN" > "$tmp/basic.cfg" )
|
|
tok=$(curl -fsS -K "$tmp/basic.cfg" "https://${REGISTRY}/v2/token?scope=repository:${IMAGE_PATH}:pull&service=container_registry" |
|
|
python3 -c 'import json,sys; print(json.load(sys.stdin)["token"])')
|
|
( umask 077; printf 'header = "Authorization: Bearer %s"\n' "$tok" > "$tmp/bearer.cfg" )
|
|
digest=$(curl -fsS -I -K "$tmp/bearer.cfg" \
|
|
-H 'Accept: application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json' \
|
|
"https://${REGISTRY}/v2/${IMAGE_PATH}/manifests/${tag}" | tr -d '\r' |
|
|
awk -F': ' 'tolower($1)=="docker-content-digest"{print $2}')
|
|
[[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]] || { echo "::error::no digest for ${IMAGE_PATH}:${tag}"; exit 1; }
|
|
ref="${REGISTRY}/${IMAGE_PATH}@${digest}"
|
|
printf '%s\n' "$COSIGN_KEY_PEM" > "$tmp/cosign.key"; chmod 600 "$tmp/cosign.key"
|
|
"$bin" sign --yes --key "$tmp/cosign.key" --tlog-upload=false \
|
|
--new-bundle-format=false --use-signing-config=false "$ref"
|
|
"$bin" public-key --key "$tmp/cosign.key" > "$tmp/cosign.pub"
|
|
"$bin" verify --key "$tmp/cosign.pub" --insecure-ignore-tlog "${REGISTRY}/${IMAGE_PATH}:${tag}@${digest}" >/dev/null
|
|
echo "✓ signed and verified ${REGISTRY}/${IMAGE_PATH}:${tag}@${digest}"
|
|
|
|
- name: Summary
|
|
run: |
|
|
if [ "${{ steps.meta.outputs.push }}" = "true" ]; then
|
|
echo "published ${REGISTRY}/${IMAGE_PATH}:${{ steps.meta.outputs.tag }} (amd64+arm64), toolchain asserted on both"
|
|
else
|
|
echo "validation only — the Dockerfile builds on both arches; nothing published"
|
|
fi
|