agent
47d5342dc4
The toolchain check's own comment said the quiet part: "the list only covers what someone remembered to add". So the list was derived instead of remembered — every command invoked from a `run:` block across zegit's Gitea-executed workflows and composite actions was extracted and checked against this image. Result: no missing apk package. Everything resolves to one of three sources — baked in here, provided by busybox/coreutils, or downloaded per-run and immediately version-checked (go via setup-go, buildctl, flux, cosign, syft, goreleaser). The download path needs nothing from this image beyond curl and tar, both already asserted. What the audit did find is that the busybox/coreutils layer was entirely unasserted. Dropping `coreutils` from the apk line would pass this check while base64, mktemp, seq and sort silently vanished — and on this repo's own history, their absence would be narrated as whatever the gate reaching for them happened to be doing, not as a missing tool. That is how openssl became "signature FAILED verification" and jq became "not a signed DSSE envelope". Verified by executing the assertion, not by reading it: extracted the inner script and ran it against a PATH with base64 deliberately absent. It printed base64=MISSING and the outer `grep -q MISSING` failed the build. Against a full PATH it reports zero MISSING.
169 lines
8.2 KiB
YAML
169 lines
8.2 KiB
YAML
name: build image
|
|
|
|
# Publishes the runner toolchain image to ghcr.io.
|
|
#
|
|
# Why GitHub rather than our own Gitea Actions: the runners are host mode
|
|
# (`ubuntu-latest:host`, no job containers) and their container drops ALL
|
|
# capabilities with allowPrivilegeEscalation:false. Rootless buildah needs
|
|
# newuidmap/user namespaces for its RUN steps, so building images there would
|
|
# mean weakening the posture that hardening established. GitHub runners have
|
|
# docker + buildx + QEMU already.
|
|
#
|
|
# Why ghcr.io rather than the Gitea registry: gitea.langenoja.se sits behind
|
|
# Cloudflare, whose request-body cap returns 413 on a registry layer. The
|
|
# cluster already pulls zegit's own images from ghcr.io and the runner
|
|
# deployments already carry a github-registry-credentials pull secret, so this
|
|
# reuses an established, trusted path instead of inventing one.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: 'Image tag, e.g. 12.11.1-ci4 (upstream runner version + ci revision)'
|
|
required: true
|
|
type: string
|
|
push:
|
|
branches: [master]
|
|
paths:
|
|
- 'Dockerfile'
|
|
- '.github/workflows/build-image.yml'
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
env:
|
|
IMAGE: ghcr.io/${{ github.repository }}
|
|
|
|
jobs:
|
|
build:
|
|
# GitHub-only: the Gitea mirror has no ghcr.io and no GITHUB_TOKEN.
|
|
if: ${{ github.server_url == 'https://github.com' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
|
|
# arm64 is not optional: forgejo-runner runs on arm64 nodes and
|
|
# zegit-runner on amd64, neither deployment sets a nodeSelector, and both
|
|
# use this one tag.
|
|
- uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
|
|
- uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
|
|
|
|
- uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
# A master push VALIDATES the Dockerfile still builds on both arches but
|
|
# publishes nothing — only an explicit dispatch names a tag and pushes.
|
|
# Guessing a tag from a branch push would silently mint versions.
|
|
- id: meta
|
|
run: |
|
|
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
|
|
echo "push=true" >> "$GITHUB_OUTPUT"
|
|
echo "tags=${IMAGE}:${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "push=false" >> "$GITHUB_OUTPUT"
|
|
echo "tags=${IMAGE}:ci-validation" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
|
|
with:
|
|
context: .
|
|
platforms: linux/amd64,linux/arm64
|
|
push: ${{ steps.meta.outputs.push }}
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
provenance: false
|
|
sbom: false
|
|
|
|
# Read the published index back rather than trusting the push's exit
|
|
# code, and fail if either architecture is absent — a single-arch image
|
|
# under this tag would CrashLoop on half the nodes.
|
|
- name: Verify both architectures were published
|
|
if: ${{ steps.meta.outputs.push == 'true' }}
|
|
run: |
|
|
set -euo pipefail
|
|
out=$(docker buildx imagetools inspect "${IMAGE}:${{ inputs.tag }}")
|
|
echo "$out"
|
|
for want in amd64 arm64; do
|
|
echo "$out" | grep -q "linux/$want" || { echo "::error::published image is missing linux/$want"; exit 1; }
|
|
done
|
|
echo "✓ ${IMAGE}:${{ inputs.tag }} carries linux/amd64 and linux/arm64"
|
|
|
|
# The image is a TOOLCHAIN, so "it built" is not the property that matters
|
|
# — "it still contains what the gates shell out to" is. This exists because
|
|
# a hand-built image had drifted from this Dockerfile: the deployed ci3
|
|
# carried gcc, musl-dev, python3 and py3-yaml, the Dockerfile did not, and
|
|
# rebuilding from the Dockerfile silently dropped them. CI runs then failed
|
|
# at "credentials-coverage: need python3" instead of running the tests.
|
|
#
|
|
# Asserted on BOTH architectures, because a package that resolves on amd64
|
|
# and not on arm64 would otherwise reach half the nodes unnoticed.
|
|
#
|
|
# openssl and jq were added after this check already existed and still
|
|
# missed them: the release tag gate shells out to both to verify the
|
|
# Control Plane's signed quorum verdict, and their absence surfaced as
|
|
# "verdict not signed" / "signature FAILED verification" rather than as a
|
|
# missing tool, blocking v0.0.134 and v0.0.135. The list only covers what
|
|
# someone remembered to add, so add to it whenever a gate grows a new
|
|
# shell dependency.
|
|
#
|
|
# DERIVED once, 2026-08-31, rather than remembered: every command invoked
|
|
# from a `run:` block across zegit's Gitea-executed workflows and its
|
|
# composite actions was extracted and checked against this list. Result:
|
|
# no missing apk package. Everything resolved to one of three sources —
|
|
# baked in here; provided by busybox/coreutils; or downloaded per-run and
|
|
# immediately version-checked (go via setup-go, buildctl, flux, cosign,
|
|
# syft, goreleaser). The download path needs nothing from this image
|
|
# beyond curl and tar, both already asserted.
|
|
#
|
|
# What the audit DID find is that the busybox/coreutils layer was entirely
|
|
# unasserted, so dropping `coreutils` from the apk line above would pass
|
|
# this check while base64, mktemp, seq and sort silently vanished — and by
|
|
# the history above, their absence would be narrated as whatever the gate
|
|
# using them happened to be doing. They are asserted below now. They are
|
|
# cheap to check and the failure they prevent is expensive to read.
|
|
- name: Verify the image still contains the toolchain the gates need
|
|
if: ${{ steps.meta.outputs.push == 'true' }}
|
|
run: |
|
|
set -euo pipefail
|
|
REF="${IMAGE}:${{ inputs.tag }}"
|
|
fail=0
|
|
for plat in linux/amd64 linux/arm64; do
|
|
echo "── $plat"
|
|
out=$(docker run --rm --platform "$plat" --entrypoint sh "$REF" -c '
|
|
set -u
|
|
py=$(python3 -c "import yaml,sys;print(sys.version.split()[0])" 2>/dev/null) \
|
|
&& echo "python3+yaml=$py" || echo "python3+yaml=MISSING"
|
|
command -v gcc >/dev/null && echo "gcc=ok" || echo "gcc=MISSING"
|
|
command -v node >/dev/null && echo "node=ok" || echo "node=MISSING"
|
|
command -v bash >/dev/null && echo "bash=ok" || echo "bash=MISSING"
|
|
command -v make >/dev/null && echo "make=ok" || echo "make=MISSING"
|
|
command -v curl >/dev/null && echo "curl=ok" || echo "curl=MISSING"
|
|
command -v tar >/dev/null && echo "tar=ok" || echo "tar=MISSING"
|
|
command -v openssl >/dev/null && echo "openssl=ok" || echo "openssl=MISSING"
|
|
command -v jq >/dev/null && echo "jq=ok" || echo "jq=MISSING"
|
|
# busybox/coreutils layer: used across zegit's gates for base64
|
|
# decoding of DSSE payloads, temp dirs, poll loops and sorting.
|
|
for t in base64 mktemp seq sort sed grep cut head wc uname date; do
|
|
command -v "$t" >/dev/null && echo "$t=ok" || echo "$t=MISSING"
|
|
done
|
|
[ -x "$(git --exec-path)/git-http-backend" ] \
|
|
&& echo "git-http-backend=ok" || echo "git-http-backend=MISSING"
|
|
' 2>&1) || { echo "::error::could not run $REF on $plat"; fail=1; continue; }
|
|
echo "$out"
|
|
if echo "$out" | grep -q MISSING; then
|
|
echo "$out" | grep MISSING | while read -r l; do
|
|
echo "::error::$plat is missing a required tool: $l"
|
|
done
|
|
fail=1
|
|
fi
|
|
done
|
|
[ "$fail" = 0 ] || {
|
|
echo "::error::The published image lost a tool the repo's gates depend on. Restore it in the Dockerfile — do not weaken this check."
|
|
exit 1
|
|
}
|
|
echo "✓ toolchain intact on both architectures"
|