agent
f0922508a8
Publishing this image by hand kept hitting the same four walls — Cloudflare's 413, Docker parsing a bare MagicDNS name as a Docker Hub namespace, a PAT missing write:package, and multi-arch. push-image.sh made that survivable; this removes the manual step entirely. It builds on GitHub rather than our own Gitea Actions because the runners cannot build images: their labels are `ubuntu-latest:host` (host mode, no job containers) and the container drops ALL capabilities with allowPrivilegeEscalation:false, while rootless buildah needs newuidmap/user namespaces for RUN steps. Building there would mean weakening the posture the hardening established. It publishes to ghcr.io rather than the Gitea registry because Cloudflare's body cap is what caused the 413 in the first place, and because the cluster already pulls zegit's own images from ghcr.io through an existing github-registry-credentials pull secret — an established path rather than a new one. A master push validates that both arches still build but publishes nothing; only an explicit dispatch names a tag and pushes, so a branch push cannot silently mint a version. The final step reads the published index back and fails if either architecture is absent, since a single-arch image under this tag would CrashLoop on half the nodes. Action SHAs match the pins zegit already uses, rather than introducing a second set of versions to track.
94 lines
3.6 KiB
YAML
94 lines
3.6 KiB
YAML
name: build image
|
|
|
|
# Publishes the runner toolchain image to ghcr.io.
|
|
#
|
|
# Why GitHub rather than our own Gitea Actions: the runners are host mode
|
|
# (`ubuntu-latest:host`, no job containers) and their container drops ALL
|
|
# capabilities with allowPrivilegeEscalation:false. Rootless buildah needs
|
|
# newuidmap/user namespaces for its RUN steps, so building images there would
|
|
# mean weakening the posture that hardening established. GitHub runners have
|
|
# docker + buildx + QEMU already.
|
|
#
|
|
# Why ghcr.io rather than the Gitea registry: gitea.langenoja.se sits behind
|
|
# Cloudflare, whose request-body cap returns 413 on a registry layer. The
|
|
# cluster already pulls zegit's own images from ghcr.io and the runner
|
|
# deployments already carry a github-registry-credentials pull secret, so this
|
|
# reuses an established, trusted path instead of inventing one.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: 'Image tag, e.g. 12.11.1-ci4 (upstream runner version + ci revision)'
|
|
required: true
|
|
type: string
|
|
push:
|
|
branches: [master]
|
|
paths:
|
|
- 'Dockerfile'
|
|
- '.github/workflows/build-image.yml'
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
env:
|
|
IMAGE: ghcr.io/${{ github.repository }}
|
|
|
|
jobs:
|
|
build:
|
|
# GitHub-only: the Gitea mirror has no ghcr.io and no GITHUB_TOKEN.
|
|
if: ${{ github.server_url == 'https://github.com' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
|
|
# arm64 is not optional: forgejo-runner runs on arm64 nodes and
|
|
# zegit-runner on amd64, neither deployment sets a nodeSelector, and both
|
|
# use this one tag.
|
|
- uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
|
|
- uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
|
|
|
|
- uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
# A master push VALIDATES the Dockerfile still builds on both arches but
|
|
# publishes nothing — only an explicit dispatch names a tag and pushes.
|
|
# Guessing a tag from a branch push would silently mint versions.
|
|
- id: meta
|
|
run: |
|
|
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
|
|
echo "push=true" >> "$GITHUB_OUTPUT"
|
|
echo "tags=${IMAGE}:${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "push=false" >> "$GITHUB_OUTPUT"
|
|
echo "tags=${IMAGE}:ci-validation" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
|
|
with:
|
|
context: .
|
|
platforms: linux/amd64,linux/arm64
|
|
push: ${{ steps.meta.outputs.push }}
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
provenance: false
|
|
sbom: false
|
|
|
|
# Read the published index back rather than trusting the push's exit
|
|
# code, and fail if either architecture is absent — a single-arch image
|
|
# under this tag would CrashLoop on half the nodes.
|
|
- name: Verify both architectures were published
|
|
if: ${{ steps.meta.outputs.push == 'true' }}
|
|
run: |
|
|
set -euo pipefail
|
|
out=$(docker buildx imagetools inspect "${IMAGE}:${{ inputs.tag }}")
|
|
echo "$out"
|
|
for want in amd64 arm64; do
|
|
echo "$out" | grep -q "linux/$want" || { echo "::error::published image is missing linux/$want"; exit 1; }
|
|
done
|
|
echo "✓ ${IMAGE}:${{ inputs.tag }} carries linux/amd64 and linux/arm64"
|