shadowdaoandClaude Opus 5.5
6eed6aa615
CI resolves httpd:alpine to httpd@sha256:<digest> directly at registry-1.docker.io (.gitea/scripts/resolve-base-image.sh) and passes it as BASE_IMAGE. Only when the base is digest-pinned AND the pkg-cache registry mirror (192.168.1.40:5000) answers over TLS with the pinned CA is the buildx builder configured with the mirror; otherwise Docker Hub direct as before. The image installs no OS packages, so no PKG_CACHE build-arg / pkg-cache-repos.sh is needed; keys/pkg-cache/ is carried for the CA (identical copy of cloud-apache-container's). Local builds without build-args still use httpd:alpine. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
90 lines
4.0 KiB
YAML
90 lines
4.0 KiB
YAML
name: WHP Default Container
|
|
run-name: ${{ gitea.actor }} pushed a change to main
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
jobs:
|
|
Build-and-Push:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
# Base image pinned by DIGEST, looked up directly at Docker Hub (never via
|
|
# the pkg-cache mirror), so the mirror can only serve content-addressed
|
|
# blobs that BuildKit verifies. If the lookup fails this job does NOT use
|
|
# the mirror and pulls the tag straight from Docker Hub.
|
|
# Canonical docs: cloud-apache-container docs/pkg-cache.md.
|
|
- name: Resolve base image digest (Docker Hub, direct)
|
|
id: base
|
|
env:
|
|
BASE_TAG: httpd:alpine
|
|
run: |
|
|
set -uo pipefail
|
|
if ref=$(.gitea/scripts/resolve-base-image.sh "$BASE_TAG") && [[ "$ref" =~ ^[a-z0-9][a-z0-9._/-]*@sha256:[0-9a-f]{64}$ ]]; then
|
|
echo "base-image: ${BASE_TAG} -> ${ref} (digest from registry-1.docker.io)"
|
|
echo "image=${ref}" >> "$GITHUB_OUTPUT"
|
|
echo "pinned=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "::warning::base image ${BASE_TAG}: Docker Hub digest lookup failed - pulling the tag directly from Docker Hub, pkg-cache registry mirror NOT used"
|
|
echo "image=${BASE_TAG}" >> "$GITHUB_OUTPUT"
|
|
echo "pinned=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
# Internal package cache (CT130 pkg-cache). Used ONLY if it answers over
|
|
# TLS with our pinned CA; otherwise this job builds from Docker Hub exactly
|
|
# as before. This image installs no OS packages, so only the registry
|
|
# mirror is used (repos= is probed and logged for parity with the other
|
|
# repos but not passed to the build).
|
|
- name: Probe package cache
|
|
id: pkgcache
|
|
# The registry mirror is only used for a digest-pinned base image.
|
|
env:
|
|
BASE_PINNED: ${{ steps.base.outputs.pinned }}
|
|
run: |
|
|
url=""; mirror=""
|
|
if curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40/; then url="https://192.168.1.40"; fi
|
|
if [ "$BASE_PINNED" = true ] && curl -fsS --max-time 5 --cacert keys/pkg-cache/ca.crt -o /dev/null https://192.168.1.40:5000/v2/; then mirror="192.168.1.40:5000"; fi
|
|
echo "pkg-cache: repos=${url:-<unreachable: upstream>} registry-mirror=${mirror:-<not used: Docker Hub direct>}"
|
|
[ -n "$url" ] || echo "::warning::pkg-cache unreachable - building from upstream repositories"
|
|
echo "url=${url}" >> "$GITHUB_OUTPUT"
|
|
echo "mirror=${mirror}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v3
|
|
|
|
# BuildKit (docker-container driver) ignores dockerd's registry-mirrors,
|
|
# so the mirror is configured on the builder; BuildKit itself still falls
|
|
# back to Docker Hub if the mirror stops answering mid-run.
|
|
- name: Set up Docker Buildx (Docker Hub via pkg-cache mirror)
|
|
if: steps.pkgcache.outputs.mirror != ''
|
|
uses: https://github.com/docker/setup-buildx-action@v3
|
|
with:
|
|
buildkitd-config-inline: |
|
|
[registry."docker.io"]
|
|
mirrors = ["192.168.1.40:5000"]
|
|
[registry."192.168.1.40:5000"]
|
|
ca = ["${{ github.workspace }}/keys/pkg-cache/ca.crt"]
|
|
|
|
- name: Set up Docker Buildx
|
|
if: steps.pkgcache.outputs.mirror == ''
|
|
uses: https://github.com/docker/setup-buildx-action@v3
|
|
|
|
- name: Login to Gitea
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: repo.anhonesthost.net
|
|
username: ${{ secrets.CI_USER }}
|
|
password: ${{ secrets.CI_TOKEN }}
|
|
|
|
- name: Build Image
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
platforms: linux/amd64
|
|
push: true
|
|
build-args: |
|
|
BASE_IMAGE=${{ steps.base.outputs.image }}
|
|
tags: |
|
|
repo.anhonesthost.net/cloud-hosting-platform/whp-default:latest |