shadowdaoandClaude Opus 5.5
9166c0953e
- Base image pinned by digest resolved directly from Docker Hub (.gitea/scripts/resolve-base-image.sh); registry mirror only when pinned. - Probe the cache over TLS with the pinned CA; without it, builds use the upstream repositories and Docker Hub exactly as before. - Dockerfile: ARG BASE_IMAGE / PKG_CACHE; package RUN rewrites repos via scripts/pkg-cache-repos.sh (canonical copy from cloud-apache-container), installs epel-release with GPG-verified release-install, restores repo files before the RUN ends. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
91 lines
3.9 KiB
YAML
91 lines
3.9 KiB
YAML
name: Cloud MemCached Container
|
|
run-name: ${{ gitea.actor }} pushed a change to trunk
|
|
on:
|
|
push:
|
|
branches:
|
|
- trunk
|
|
|
|
jobs:
|
|
Build-and-Push:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
# Base image pinned by DIGEST, looked up directly at Docker Hub (never via
|
|
# the pkg-cache mirror), so the mirror can only serve content-addressed
|
|
# blobs that BuildKit verifies. If the lookup fails this job does NOT use
|
|
# the mirror and pulls the tag straight from Docker Hub.
|
|
- name: Resolve base image digest (Docker Hub, direct)
|
|
id: base
|
|
env:
|
|
BASE_TAG: almalinux/9-base:latest
|
|
run: |
|
|
set -uo pipefail
|
|
if ref=$(.gitea/scripts/resolve-base-image.sh "$BASE_TAG") && [[ "$ref" =~ ^[a-z0-9][a-z0-9._/-]*@sha256:[0-9a-f]{64}$ ]]; then
|
|
echo "base-image: ${BASE_TAG} -> ${ref} (digest from registry-1.docker.io)"
|
|
echo "image=${ref}" >> "$GITHUB_OUTPUT"
|
|
echo "pinned=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "::warning::base image ${BASE_TAG}: Docker Hub digest lookup failed - pulling the tag directly from Docker Hub, pkg-cache registry mirror NOT used"
|
|
echo "image=${BASE_TAG}" >> "$GITHUB_OUTPUT"
|
|
echo "pinned=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
# Internal package cache (CT130 pkg-cache). Used ONLY if it answers over
|
|
# TLS with our pinned CA; otherwise (down, unreachable, bad/expired cert)
|
|
# this job builds from the upstream repos and Docker Hub exactly as before.
|
|
# The repo cache and the registry mirror are probed separately so either
|
|
# can fail back on its own.
|
|
- name: Probe package cache
|
|
id: pkgcache
|
|
# The registry mirror is only used for a digest-pinned base image.
|
|
env:
|
|
BASE_PINNED: ${{ steps.base.outputs.pinned }}
|
|
run: |
|
|
url=""; mirror=""
|
|
if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40/; then url="https://192.168.1.40"; fi
|
|
if [ "$BASE_PINNED" = true ] && curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40:5000/v2/; then mirror="192.168.1.40:5000"; fi
|
|
echo "pkg-cache: repos=${url:-<unreachable: upstream>} registry-mirror=${mirror:-<not used: Docker Hub direct>}"
|
|
[ -n "$url" ] || echo "::warning::pkg-cache unreachable - building from upstream repositories"
|
|
echo "url=${url}" >> "$GITHUB_OUTPUT"
|
|
echo "mirror=${mirror}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v3
|
|
|
|
# BuildKit (docker-container driver) ignores dockerd's registry-mirrors,
|
|
# so the mirror is configured on the builder; BuildKit itself still falls
|
|
# back to Docker Hub if the mirror stops answering mid-run.
|
|
- name: Set up Docker Buildx (Docker Hub via pkg-cache mirror)
|
|
if: steps.pkgcache.outputs.mirror != ''
|
|
uses: docker/setup-buildx-action@v3
|
|
with:
|
|
buildkitd-config-inline: |
|
|
[registry."docker.io"]
|
|
mirrors = ["192.168.1.40:5000"]
|
|
[registry."192.168.1.40:5000"]
|
|
ca = ["${{ github.workspace }}/keys/pkg-cache/ca.crt"]
|
|
|
|
- name: Set up Docker Buildx
|
|
if: steps.pkgcache.outputs.mirror == ''
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Login to Gitea
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: repo.anhonesthost.net
|
|
username: ${{ secrets.CI_USER }}
|
|
password: ${{ secrets.CI_TOKEN }}
|
|
|
|
- name: Build Image
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
platforms: linux/amd64
|
|
push: true
|
|
build-args: |
|
|
BASE_IMAGE=${{ steps.base.outputs.image }}
|
|
PKG_CACHE=${{ steps.pkgcache.outputs.url }}
|
|
tags: |
|
|
repo.anhonesthost.net/cloud-hosting-platform/cmc:latest
|