shadowdaoandClaude Opus 5.5
dc1cbeb12a
- Dockerfile: optional ARG PKG_CACHE; the apt RUN (dist-upgrade + pinned haproxy) rewrites sources via scripts/pkg-cache-repos.sh apt and restores them before the RUN ends. Without PKG_CACHE: upstream Debian, as before. - coraza-spoa/Dockerfile: same for the build stage's apt RUN; go mod download / go build (build + catalog stages) use go-env (GOPROXY via the cache with proxy.golang.org fallback; GOSUMDB unchanged) and restore. Build context is ./coraza-spoa, so coraza-spoa/scripts/pkg-cache-repos.sh and coraza-spoa/keys/pkg-cache/ are byte-identical copies of the root ones. - build-push.yaml / build-push-coraza.yaml: "Probe package cache" step (TLS with the pinned CA), PKG_CACHE build-arg. Bases come from repo.anhonesthost.net / gcr.io, not docker.io: registry mirror not used. - mirror-base-image.yaml: resolve the tag's digest directly at Docker Hub (.gitea/scripts/resolve-base-image.sh) and pull docker.io/library/<img>@sha256 so the mirrored content is exactly the digest Docker Hub reported; same destination tags. Values reach run: via env only. - Canonical copies (byte-identical) of scripts/pkg-cache-repos.sh, .gitea/scripts/resolve-base-image.sh and keys/pkg-cache/ from cloud-apache-container. - VERSION 2026.10.7 so the rebuild does not overwrite the 2026.10.6 tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
79 lines
3.4 KiB
YAML
79 lines
3.4 KiB
YAML
name: HAProxy Manager Build and Push
|
|
run-name: ${{ gitea.actor }} pushed a change to main
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
jobs:
|
|
Build-and-Push:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
# Internal package cache (CT130 pkg-cache; canonical docs: docs/pkg-cache.md
|
|
# in cloud-apache-container). Used ONLY if it answers over TLS with our
|
|
# pinned CA; otherwise (down, unreachable, bad/expired cert) this job builds
|
|
# from the upstream repositories exactly as before. The base image comes
|
|
# from the in-house registry (repo.anhonesthost.net, weekly digest-pinned
|
|
# mirror of Docker Hub - mirror-base-image.yaml), not docker.io, so the
|
|
# pkg-cache registry mirror is never used here: repos only.
|
|
- name: Probe package cache
|
|
id: pkgcache
|
|
run: |
|
|
url=""
|
|
if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40/; then url="https://192.168.1.40"; fi
|
|
echo "pkg-cache: repos=${url:-<unreachable: upstream>} registry-mirror=<not used: no docker.io base (base from repo.anhonesthost.net)>"
|
|
[ -n "$url" ] || echo "::warning::pkg-cache unreachable - building from upstream repositories"
|
|
echo "url=${url}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v3
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: https://github.com/docker/setup-buildx-action@v3
|
|
|
|
- name: Login to Gitea
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: repo.anhonesthost.net
|
|
username: ${{ secrets.CI_USER }}
|
|
password: ${{ secrets.CI_TOKEN }}
|
|
|
|
# Second push target so the image is also available from GitHub Container
|
|
# Registry under the user's account. The PAT only needs write:packages
|
|
# (and read:packages if the package is private). Stored in Gitea as
|
|
# secrets.GHCR_TOKEN; username is the literal GitHub login.
|
|
- name: Login to GHCR
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: shadowdao
|
|
password: ${{ secrets.GHCR_TOKEN }}
|
|
|
|
# Read the human-readable release version from the VERSION file so every
|
|
# build is pinnable for rollback (alongside the immutable git SHA). Bump
|
|
# VERSION (YYYY.MM.N) in the same commit as a release-worthy change.
|
|
- name: Read version
|
|
id: ver
|
|
run: echo "version=$(cat VERSION)" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Build Image
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
platforms: linux/amd64
|
|
push: true
|
|
build-args: |
|
|
VERSION=${{ steps.ver.outputs.version }}
|
|
PKG_CACHE=${{ steps.pkgcache.outputs.url }}
|
|
# Three tags per registry: :latest (moving), :<version> (human-readable
|
|
# release), :<sha> (immutable, guaranteed-unique rollback target).
|
|
tags: |
|
|
repo.anhonesthost.net/cloud-hosting-platform/haproxy-manager-base:latest
|
|
repo.anhonesthost.net/cloud-hosting-platform/haproxy-manager-base:${{ steps.ver.outputs.version }}
|
|
repo.anhonesthost.net/cloud-hosting-platform/haproxy-manager-base:${{ gitea.sha }}
|
|
ghcr.io/shadowdao/haproxy-manager-base:latest
|
|
ghcr.io/shadowdao/haproxy-manager-base:${{ steps.ver.outputs.version }}
|
|
ghcr.io/shadowdao/haproxy-manager-base:${{ gitea.sha }}
|