shadowdaoandClaude Opus 5.5
6b015141dc
With the pkg-cache BuildKit mirror on, `FROM almalinux/10-base` was resolved by tag through the cache, so a compromised cache could substitute the image. Each job using the mirror now looks up the base tag's digest DIRECTLY at registry-1.docker.io (.gitea/scripts/resolve-base-image.sh, HTTPS, HEAD on the manifest, regex-validated) and builds FROM image@sha256:... via the BASE_IMAGE build-arg, so the mirror can only serve content-addressed blobs. If the lookup fails, the mirror is NOT used for that job and the tag is pulled straight from Docker Hub. The digest is resolved every run (no manual bumps); local builds default to the tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
94 lines
4.0 KiB
YAML
94 lines
4.0 KiB
YAML
name: Cloud Node Container
|
|
run-name: ${{ gitea.actor }} pushed a change to main
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
jobs:
|
|
Build-and-Push:
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
nodever: [18, 20, 22, 24, 26]
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
# Base image pinned by DIGEST, looked up directly at Docker Hub (never via
|
|
# the pkg-cache mirror), so the mirror can only serve content-addressed
|
|
# blobs that BuildKit verifies. If the lookup fails this job does NOT use
|
|
# the mirror and pulls the tag straight from Docker Hub.
|
|
- name: Resolve base image digest (Docker Hub, direct)
|
|
id: base
|
|
env:
|
|
BASE_TAG: almalinux/10-base:latest
|
|
run: |
|
|
set -uo pipefail
|
|
if ref=$(.gitea/scripts/resolve-base-image.sh "$BASE_TAG") && [[ "$ref" =~ ^[a-z0-9][a-z0-9._/-]*@sha256:[0-9a-f]{64}$ ]]; then
|
|
echo "base-image: ${BASE_TAG} -> ${ref} (digest from registry-1.docker.io)"
|
|
echo "image=${ref}" >> "$GITHUB_OUTPUT"
|
|
echo "pinned=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "::warning::base image ${BASE_TAG}: Docker Hub digest lookup failed - pulling the tag directly from Docker Hub, pkg-cache registry mirror NOT used"
|
|
echo "image=${BASE_TAG}" >> "$GITHUB_OUTPUT"
|
|
echo "pinned=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
# Internal package cache (CT130 pkg-cache). Used ONLY if it answers over
|
|
# TLS with our pinned CA; otherwise this job builds from the upstream repos
|
|
# and Docker Hub exactly as before. Repo cache and registry mirror are
|
|
# probed separately so either can fail back on its own.
|
|
- name: Probe package cache
|
|
id: pkgcache
|
|
# The registry mirror is only used for a digest-pinned base image.
|
|
env:
|
|
BASE_PINNED: ${{ steps.base.outputs.pinned }}
|
|
run: |
|
|
url=""; mirror=""
|
|
if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40/; then url="https://192.168.1.40"; fi
|
|
if [ "$BASE_PINNED" = true ] && curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40:5000/v2/; then mirror="192.168.1.40:5000"; fi
|
|
echo "pkg-cache: repos=${url:-<unreachable: upstream>} registry-mirror=${mirror:-<not used: Docker Hub direct>}"
|
|
[ -n "$url" ] || echo "::warning::pkg-cache unreachable - building from upstream repositories"
|
|
echo "url=${url}" >> "$GITHUB_OUTPUT"
|
|
echo "mirror=${mirror}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v3
|
|
|
|
# BuildKit ignores dockerd's registry-mirrors, so the mirror is set on the
|
|
# builder; BuildKit still falls back to Docker Hub if the mirror stops.
|
|
- name: Set up Docker Buildx (Docker Hub via pkg-cache mirror)
|
|
if: steps.pkgcache.outputs.mirror != ''
|
|
uses: docker/setup-buildx-action@v3
|
|
with:
|
|
buildkitd-config-inline: |
|
|
[registry."docker.io"]
|
|
mirrors = ["192.168.1.40:5000"]
|
|
[registry."192.168.1.40:5000"]
|
|
ca = ["${{ github.workspace }}/keys/pkg-cache/ca.crt"]
|
|
|
|
- name: Set up Docker Buildx
|
|
if: steps.pkgcache.outputs.mirror == ''
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Login to Gitea
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: repo.anhonesthost.net
|
|
username: ${{ secrets.CI_USER }}
|
|
password: ${{ secrets.CI_TOKEN }}
|
|
|
|
- name: Build and Push Image
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
platforms: linux/amd64
|
|
push: true
|
|
build-args: |
|
|
NODEVER=${{ matrix.nodever }}
|
|
BASE_IMAGE=${{ steps.base.outputs.image }}
|
|
PKG_CACHE=${{ steps.pkgcache.outputs.url }}
|
|
tags: |
|
|
repo.anhonesthost.net/cloud-hosting-platform/cnoc:node${{ matrix.nodever }}
|
|
${{ matrix.nodever == '20' && 'repo.anhonesthost.net/cloud-hosting-platform/cnoc:latest' || '' }} |