CCCHH/sunders
CCCHH/sunders
Watch
3
0
Fork
You've already forked sunders
 1
forked from kamba4/sunders
Code Issues 6 Pull requests Packages 1 Activity Actions

fix: Builds images with kaniko
All checks were successful
Build (and tag) Images / build (push) Successful in 1m23s
Details

Browse source 
There are no Windows runners; build the images with kaniko in a container
on the `docker` runner, as on the link-updates branch, while keeping the
publishing restrictions:

- only pushes to refs/heads/main publish, as `latest` and `sha-<commit>`
- other refs build with --no-push under a ci-<commit> tag
- registry credentials are only passed to the build when publishing

The docker compose smoke test is dropped, as there is no Docker daemon
inside the kaniko container.
This commit is contained in:
Stefan Bethke 2026-11-15 11:48:03 +01:00
commit 6ec1b9fc5a
1 changed files with 43 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

85
.forgejo/workflows/images.yml
View file

@ -5,7 +5,7 @@ on:
workflow_dispatch:
# Images are only published for pushes to the main branch. All other refs (branches,
# renovate branches, tags) are built and tested locally, but never pushed.
# renovate branches, tags) are built, but never pushed, and do not get registry credentials.
#
# Note: a workflow run for a pushed ref uses the workflow file from that ref, so this
# condition alone does not stop someone with push access from publishing images. The
@ -16,23 +16,27 @@ env:
jobs:
build:
runs-on: windows-2022
runs-on: docker
container:
image: ghcr.io/osscontainertools/kaniko:alpine
steps:
- name: Checkout repository
uses: actions/checkout@v7
- name: Install required system packages
run: apk add --no-cache nodejs git
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4
- name: Checkout repository
uses: actions/checkout@v4
- name: Set image tags
id: vars
env:
COMMIT_SHA: ${{ github.sha }}
PUBLISH: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
COMMIT_SHA: ${{ forgejo.sha }}
PUBLISH: ${{ forgejo.event_name == 'push' && forgejo.ref == 'refs/heads/main' }}
run: |
if [ "$PUBLISH" = "true" ]; then
echo "publish=true" >> "$GITHUB_OUTPUT"
echo "tag=latest" >> "$GITHUB_OUTPUT"
else
echo "publish=false" >> "$GITHUB_OUTPUT"
# Never derive tags from ref names: they are attacker-controlled and may collide with `latest`.
echo "tag=ci-${COMMIT_SHA}" >> "$GITHUB_OUTPUT"
fi
@ -40,45 +44,42 @@ jobs:
- name: Build web image
env:
IMAGE: web
PUBLISH: ${{ steps.vars.outputs.publish }}
TAG: ${{ steps.vars.outputs.tag }}
SHA_TAG: ${{ steps.vars.outputs.sha_tag }}
KANIKO_GIT_HAMBURG_CCC_DE_USER: ${{ steps.vars.outputs.publish == 'true' && secrets.REGISTRY_USERNAME || '' }}
KANIKO_GIT_HAMBURG_CCC_DE_PASSWORD: ${{ steps.vars.outputs.publish == 'true' && secrets.REGISTRY_TOKEN || '' }}
run: |
docker buildx build -f ./Containerfile -t "$IMAGE_PREFIX/web:$TAG" --load .
working-directory: ./web
if [ "$PUBLISH" = "true" ]; then
set -- --destination="$IMAGE_PREFIX/$IMAGE:$TAG" --destination="$IMAGE_PREFIX/$IMAGE:$SHA_TAG"
else
set -- --destination="$IMAGE_PREFIX/$IMAGE:$TAG" --no-push
fi
/kaniko/executor \
--dockerfile="$GITHUB_WORKSPACE/$IMAGE/Containerfile" \
--context="dir://$GITHUB_WORKSPACE/$IMAGE" \
--no-push-cache \
--credential-helpers=env \
"$@"
- name: Build data_handler image
env:
TAG: ${{ steps.vars.outputs.tag }}
run: |
docker buildx build -f ./Containerfile -t "$IMAGE_PREFIX/data_handler:$TAG" --load .
working-directory: ./data_handler
- name: Update docker-compose.yml image tags
env:
TAG: ${{ steps.vars.outputs.tag }}
run: |
sed -i "s/:latest/:${TAG}/g" docker-compose.yml
- name: Start Docker Compose services
run: |
docker compose up -d --wait
docker compose down
- name: Login to Container Registry
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
uses: docker/login-action@v4
with:
registry: git.hamburg.ccc.de
username: ${{ secrets.REGISTRY_USERNAME }}
password: ${{ secrets.REGISTRY_TOKEN }}
- name: Push images to Container Registry
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
env:
IMAGE: data_handler
PUBLISH: ${{ steps.vars.outputs.publish }}
TAG: ${{ steps.vars.outputs.tag }}
SHA_TAG: ${{ steps.vars.outputs.sha_tag }}
KANIKO_GIT_HAMBURG_CCC_DE_USER: ${{ steps.vars.outputs.publish == 'true' && secrets.REGISTRY_USERNAME || '' }}
KANIKO_GIT_HAMBURG_CCC_DE_PASSWORD: ${{ steps.vars.outputs.publish == 'true' && secrets.REGISTRY_TOKEN || '' }}
run: |
for image in web data_handler; do
docker tag "$IMAGE_PREFIX/$image:$TAG" "$IMAGE_PREFIX/$image:$SHA_TAG"
docker push "$IMAGE_PREFIX/$image:$TAG"
docker push "$IMAGE_PREFIX/$image:$SHA_TAG"
done
if [ "$PUBLISH" = "true" ]; then
set -- --destination="$IMAGE_PREFIX/$IMAGE:$TAG" --destination="$IMAGE_PREFIX/$IMAGE:$SHA_TAG"
else
set -- --destination="$IMAGE_PREFIX/$IMAGE:$TAG" --no-push
fi
/kaniko/executor \
--dockerfile="$GITHUB_WORKSPACE/$IMAGE/Containerfile" \
--context="dir://$GITHUB_WORKSPACE/$IMAGE" \
--no-push-cache \
--credential-helpers=env \
"$@"