tegwick
3e4bcb26f8
All checks were successful
Publish exact advisory-purpose overlay candidate / publish-candidate (push) Successful in 8s
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
66 lines
3.9 KiB
YAML
66 lines
3.9 KiB
YAML
name: Publish exact advisory-purpose overlay candidate
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- ".forgejo/workflows/purpose-overlay-image.yaml"
|
|
- "deploy/purpose-overlay/**"
|
|
- "tools/purpose_overlay/**"
|
|
- "informed_decision/policy.py"
|
|
workflow_dispatch:
|
|
concurrency:
|
|
group: informed-decision-purpose-overlay
|
|
cancel-in-progress: false
|
|
permissions:
|
|
contents: read
|
|
env:
|
|
REGISTRY: forgejo.coulomb.social
|
|
IMAGE_NAME: coulomb/informed-decision
|
|
DOCKER_HOST: tcp://127.0.0.1:2375
|
|
jobs:
|
|
publish-candidate:
|
|
runs-on: container-build
|
|
steps:
|
|
- name: Verify and publish single-module overlay
|
|
env:
|
|
REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
set -eu
|
|
umask 077
|
|
REF="${GITHUB_SHA:?exact source revision required}"
|
|
echo "${REF}" | grep -Eq '^[0-9a-f]{40}$'
|
|
test "${GITHUB_REPOSITORY}" = "coulomb/informed-decision"
|
|
if [ -z "${REGISTRY_USER:-}" ] || [ -z "${REGISTRY_TOKEN:-}" ]; then
|
|
echo "Admitted repository registry publication capability is unavailable; no borrowed credential is permitted." >&2
|
|
exit 2
|
|
fi
|
|
BUILD_ROOT="$(mktemp -d)"
|
|
export DOCKER_CONFIG="${BUILD_ROOT}/docker-config"
|
|
cleanup() { rm -rf "${BUILD_ROOT}"; }
|
|
trap cleanup EXIT
|
|
mkdir -p "${BUILD_ROOT}/source" "${BUILD_ROOT}/overlay" "${DOCKER_CONFIG}" "${HOME}/bin"
|
|
wget -qO "${BUILD_ROOT}/source.tar.gz" "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
|
|
tar xzf "${BUILD_ROOT}/source.tar.gz" -C "${BUILD_ROOT}/source" --strip-components=1
|
|
echo "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62 ${BUILD_ROOT}/source/informed_decision/policy.py" | sha256sum -c -
|
|
cp "${BUILD_ROOT}/source/informed_decision/policy.py" "${BUILD_ROOT}/overlay/policy.py"
|
|
cp "${BUILD_ROOT}/source/deploy/purpose-overlay/Containerfile" "${BUILD_ROOT}/overlay/Containerfile"
|
|
chmod 0644 "${BUILD_ROOT}/overlay/policy.py" "${BUILD_ROOT}/overlay/Containerfile"
|
|
wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
|
|
export PATH="${HOME}/bin:${PATH}"
|
|
echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
|
|
BASE="${REGISTRY}/${IMAGE_NAME}@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173"
|
|
docker pull "${BASE}"
|
|
IMAGE="${REGISTRY}/${IMAGE_NAME}:purpose-overlay-${REF}"
|
|
docker build --network none --pull=false --build-arg "SOURCE_REVISION=${REF}" --file "${BUILD_ROOT}/overlay/Containerfile" --tag "${IMAGE}" "${BUILD_ROOT}/overlay"
|
|
docker run --rm -i --network none --read-only --tmpfs /tmp:rw,noexec,nosuid,size=8m --entrypoint python "${IMAGE}" - < "${BUILD_ROOT}/source/tools/purpose_overlay/check_installed.py"
|
|
INSTALLED_POLICY_SHA="$(docker run --rm --network none --read-only --entrypoint sha256sum "${IMAGE}" /opt/venv/lib/python3.12/site-packages/informed_decision/policy.py | awk '{print $1}')"
|
|
test "${INSTALLED_POLICY_SHA}" = "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
|
OUTPUT="$(docker push "${IMAGE}")"
|
|
printf '%s\n' "${OUTPUT}"
|
|
DIGEST="$(printf '%s\n' "${OUTPUT}" | tr '\r' '\n' | awk '{for(i=1;i<=NF;i++)if($i~/^sha256:[a-f0-9]{64}$/)print $i}' | tail -1)"
|
|
printf '%s' "${DIGEST}" | grep -Eq '^sha256:[a-f0-9]{64}$'
|
|
echo "published=${REGISTRY}/${IMAGE_NAME}@${DIGEST}"
|
|
echo "source_revision=${REF}"
|
|
echo "policy_sha256=9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
|
echo "candidate_only=true; native rollout, backup and restore require exact supervisor approval"
|