mikkeli
bb57f319c5
/ build (push) Successful in 1m20s
Fetch uses the job's per-run auto-token (repo-scoped, nothing stored); push moves to the PKGRW_PAT user secret, separating CI credentials from the host's docker login token. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
56 lines
2.1 KiB
YAML
56 lines
2.1 KiB
YAML
on:
|
|
push:
|
|
branches: [master]
|
|
paths:
|
|
- Dockerfile
|
|
- "pipelines/**/requirements.txt"
|
|
- .gitea/workflows/build-image.yml
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
# Daemonless image builder: kaniko :debug plus the /bin/sleep symlink
|
|
# act needs for job-container PID 1 (see ci/Dockerfile.kaniko-act).
|
|
# No docker socket, no privileges.
|
|
image: pi5-16.local:3005/mikkeli/kaniko-act:v1.23.2-r2
|
|
|
|
steps:
|
|
- name: Fetch source, build, push
|
|
# kaniko image has no bash — busybox sh only
|
|
shell: sh
|
|
env:
|
|
# package r/w PAT (user-level secret) — registry push only
|
|
PKG_TOKEN: ${{ secrets.PKGRW_PAT }}
|
|
# per-run auto-token, read access to this repo only — source fetch
|
|
JOB_TOKEN: ${{ github.token }}
|
|
URL_TO_GITEA: ${{ vars.URL_TO_GITEA }}
|
|
run: |
|
|
set -eu
|
|
HOST="${URL_TO_GITEA#http://}"
|
|
SHORT_SHA=$(echo "${GITHUB_SHA}" | cut -c1-7)
|
|
IMAGE="${HOST}/mikkeli/novoyuuparosk-wiki-runner"
|
|
|
|
# Source via Gitea archive API (no git/node in this image; repo is
|
|
# private — authenticate with the job's own per-run token)
|
|
wget -qO /tmp/src.tar.gz \
|
|
"http://mikkeli:${JOB_TOKEN}@${HOST}/api/v1/repos/mikkeli/novoyuuparosk-auto-wiki/archive/${GITHUB_SHA}.tar.gz"
|
|
mkdir -p /tmp/src
|
|
tar -xzf /tmp/src.tar.gz -C /tmp/src --strip-components=1
|
|
|
|
# Registry auth for the push
|
|
AUTH=$(printf '%s' "mikkeli:${PKG_TOKEN}" | base64 | tr -d '\n')
|
|
printf '{"auths":{"%s":{"auth":"%s"}}}' "${HOST}" "${AUTH}" \
|
|
> /kaniko/.docker/config.json
|
|
|
|
# --insecure: push target is the plain-HTTP Gitea registry.
|
|
# Base image pull (docker.io) stays HTTPS — no --insecure-pull.
|
|
/kaniko/executor \
|
|
--context dir:///tmp/src \
|
|
--dockerfile /tmp/src/Dockerfile \
|
|
--destination "${IMAGE}:${SHORT_SHA}" \
|
|
--insecure
|
|
|
|
echo "Pushed ${IMAGE}:${SHORT_SHA}"
|