Merge branch 'main' into security-fixes

.forgejo/workflows/images.yml

@@ -1,57 +1,72 @@
 name: Build (and tag) Images
 
 on:
-  push:
-  workflow_dispatch:
+  workflow_dispatch: {}
+  push: {}
+
+# Every push builds both images. Only pushes to the main branch publish them, as
+# `latest` and `sha-<commit>`; all other refs build without pushing and do not
+# receive registry credentials.
 
 jobs:
-  build:
-    runs-on: windows-2022
+  build-container:
+    name: Build ${{ matrix.image }} Image
+    runs-on: docker
+    container:
+      image: ghcr.io/osscontainertools/kaniko:alpine
+    strategy:
+      matrix:
+        image:
+          - web
+          - data_handler
     steps:
-      - name: Checkout repository
+      - name: Install required system packages
+        run: apk add --no-cache nodejs git
+
+      - name: Checkout source code
         uses: actions/checkout@v7
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+      - name: Build image
+        env:
+          KANIKO_NO_PUSH: ${{ !(forgejo.event_name == 'push' && forgejo.ref == 'refs/heads/main') }}
+          KANIKO_GIT_HAMBURG_CCC_DE_USER: ${{ (forgejo.event_name == 'push' && forgejo.ref == 'refs/heads/main') && secrets.REGISTRY_USERNAME || '' }}
+          KANIKO_GIT_HAMBURG_CCC_DE_PASSWORD: ${{ (forgejo.event_name == 'push' && forgejo.ref == 'refs/heads/main') && secrets.REGISTRY_TOKEN || '' }}
+        run: /kaniko/executor
+          --dockerfile="${{ forgejo.workspace }}/${{ matrix.image }}/Containerfile"
+          --context="dir://${{ forgejo.workspace }}/${{ matrix.image }}"
+          --destination=git.hamburg.ccc.de/ccchh/sunders/${{ matrix.image }}:latest
+          --destination=git.hamburg.ccc.de/ccchh/sunders/${{ matrix.image }}:sha-${{ forgejo.sha }}
+          --no-push-cache
+          --credential-helpers=env
+          --annotation=org.opencontainers.image.ref.name=sunders/${{ matrix.image }}
+          --annotation=org.opencontainers.image.revision=${{ forgejo.sha }}
+          --annotation=org.opencontainers.image.url=${{ forgejo.server_url }}/${{ forgejo.repository }}
+          --annotation=org.opencontainers.image.source=${{ forgejo.server_url }}/${{ forgejo.repository }}
 
-      - name: Login to Container Registry
-        uses: docker/login-action@v4
-        with:
-          registry: git.hamburg.ccc.de
-          username: ${{ secrets.REGISTRY_USERNAME }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
-      
-      - name: Set image tags
-        id: vars
-        run: |
-          if [ "${{ github.ref_name }}" = "main" ] && [ "${{ github.event_name }}" = "push" ]; then
-            echo "tag=latest" >> $GITHUB_OUTPUT
-          else
-            # renovate creates sub branches with `/`; these break the tagging in the build process
-            echo tag=$(echo "${{ github.ref_name }}" | sed 's/[^a-zA-Z0-9._-]/_/g') >> $GITHUB_OUTPUT
-          fi
-
-      - name: Build web image
-        run: |
-          docker buildx build -f ./Containerfile -t git.hamburg.ccc.de/ccchh/sunders/web:${{ steps.vars.outputs.tag }} --load .
-        working-directory: ./web
-
-      - name: Build data_handler image
-        run: |
-          docker buildx build -f ./Containerfile -t git.hamburg.ccc.de/ccchh/sunders/data_handler:${{ steps.vars.outputs.tag }} --load .
-        working-directory: ./data_handler
-
-      - name: Push images to Container Registry
-        run: |
-          docker push git.hamburg.ccc.de/ccchh/sunders/web:${{ steps.vars.outputs.tag }}
-          docker push git.hamburg.ccc.de/ccchh/sunders/data_handler:${{ steps.vars.outputs.tag }}
-        if: github.event_name == 'push'
-
-      - name: Update docker-compose.yml image tags
-        run: |
-          sed -i "s/:latest/:${{ steps.vars.outputs.tag }}/g" docker-compose.yml
-
-      - name: Start Docker Compose services
-        run: |
-          docker compose up -d --wait
-          docker compose down 
+  # Docker Compose smoke test, disabled: the current runner setup cannot execute it.
+  # The `docker` runner runs jobs in a container without access to a Docker daemon
+  # (which is why images are built with kaniko), so neither `docker build` nor
+  # `docker compose` is available. Re-enable this job once a runner with a Docker
+  # daemon exists, and set `runs-on` to its label.
+  #
+  # test-compose:
+  #   name: Test with Docker Compose
+  #   needs: build-container
+  #   runs-on: docker  # needs a runner with a Docker daemon
+  #   steps:
+  #     - name: Checkout source code
+  #       uses: actions/checkout@v7
+  #
+  #     - name: Build images
+  #       run: |
+  #         docker build -f web/Containerfile -t git.hamburg.ccc.de/ccchh/sunders/web:ci web
+  #         docker build -f data_handler/Containerfile -t git.hamburg.ccc.de/ccchh/sunders/data_handler:ci data_handler
+  #
+  #     - name: Update docker-compose.yml image tags
+  #       run: |
+  #         sed -i "s/:latest/:ci/g" docker-compose.yml
+  #
+  #     - name: Start Docker Compose services
+  #       run: |
+  #         docker compose up -d --wait
+  #         docker compose down