tegwick
9b4bb25d32
All checks were successful
Publish exact zlib-only remediation candidate / publish-candidate (push) Successful in 13s
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
71 lines
4.7 KiB
YAML
71 lines
4.7 KiB
YAML
name: Publish exact zlib-only remediation candidate
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- ".forgejo/workflows/zlib-overlay-image.yaml"
|
|
- "deploy/zlib-overlay/**"
|
|
- "tools/zlib_overlay/**"
|
|
workflow_dispatch:
|
|
concurrency:
|
|
group: informed-decision-zlib-overlay
|
|
cancel-in-progress: false
|
|
permissions:
|
|
contents: read
|
|
env:
|
|
REGISTRY: forgejo.coulomb.social
|
|
IMAGE_NAME: coulomb/informed-decision
|
|
DOCKER_HOST: tcp://127.0.0.1:2375
|
|
jobs:
|
|
publish-candidate:
|
|
runs-on: container-build
|
|
steps:
|
|
- name: Verify and publish zlib-only candidate
|
|
env:
|
|
REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
set -eu
|
|
umask 077
|
|
REF="${GITHUB_SHA:?exact source revision required}"
|
|
echo "${REF}" | grep -Eq '^[0-9a-f]{40}$'
|
|
test "${GITHUB_REPOSITORY}" = "coulomb/informed-decision"
|
|
if [ -z "${REGISTRY_USER:-}" ] || [ -z "${REGISTRY_TOKEN:-}" ]; then
|
|
echo "Admitted owner registry capability unavailable; no borrowed credential permitted." >&2
|
|
exit 2
|
|
fi
|
|
BUILD_ROOT="$(mktemp -d)"
|
|
export DOCKER_CONFIG="${BUILD_ROOT}/docker-config"
|
|
cleanup() { rm -rf "${BUILD_ROOT}"; }
|
|
trap cleanup EXIT
|
|
mkdir -p "${BUILD_ROOT}/source" "${BUILD_ROOT}/context" "${DOCKER_CONFIG}" "${HOME}/bin"
|
|
wget -qO "${BUILD_ROOT}/source.tar.gz" "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
|
|
tar xzf "${BUILD_ROOT}/source.tar.gz" -C "${BUILD_ROOT}/source" --strip-components=1
|
|
CONTEXT="${BUILD_ROOT}/source/deploy/zlib-overlay"
|
|
for INPUT in .dockerignore Containerfile zlib-1.3.2-r1.apk APKINDEX.tar.gz; do
|
|
cp "${CONTEXT}/${INPUT}" "${BUILD_ROOT}/context/${INPUT}"
|
|
chmod 0644 "${BUILD_ROOT}/context/${INPUT}"
|
|
done
|
|
echo "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47 ${BUILD_ROOT}/context/zlib-1.3.2-r1.apk" | sha256sum -c -
|
|
echo "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5 ${BUILD_ROOT}/context/APKINDEX.tar.gz" | sha256sum -c -
|
|
echo "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a ${BUILD_ROOT}/context/.dockerignore" | sha256sum -c -
|
|
echo "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15 ${BUILD_ROOT}/context/Containerfile" | sha256sum -c -
|
|
wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
|
|
export PATH="${HOME}/bin:${PATH}"
|
|
echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
|
|
BASE="${REGISTRY}/${IMAGE_NAME}@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a"
|
|
docker pull "${BASE}"
|
|
IMAGE="${REGISTRY}/${IMAGE_NAME}:zlib-85091-${REF}"
|
|
docker build --network none --pull=false --memory 256m --cpu-period 100000 --cpu-quota 100000 --build-arg "SOURCE_REVISION=${REF}" --build-arg "SOURCE_CONTEXT_SHA256=c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d" --file "${BUILD_ROOT}/context/Containerfile" --tag "${IMAGE}" "${BUILD_ROOT}/context"
|
|
docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${BASE}" - < "${BUILD_ROOT}/source/tools/zlib_overlay/check_runtime.py" > "${BUILD_ROOT}/base-runtime.json"
|
|
docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${IMAGE}" - < "${BUILD_ROOT}/source/tools/zlib_overlay/check_runtime.py" > "${BUILD_ROOT}/candidate-runtime.json"
|
|
docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${BASE}" - "$(cat "${BUILD_ROOT}/base-runtime.json")" "$(cat "${BUILD_ROOT}/candidate-runtime.json")" < "${BUILD_ROOT}/source/tools/zlib_overlay/compare_runtime.py"
|
|
docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${IMAGE}" - < "${BUILD_ROOT}/source/tools/purpose_overlay/check_installed.py"
|
|
OUTPUT="$(docker push "${IMAGE}")"
|
|
printf '%s\n' "${OUTPUT}"
|
|
DIGEST="$(printf '%s\n' "${OUTPUT}" | tr '\r' '\n' | awk '{for(i=1;i<=NF;i++)if($i~/^sha256:[a-f0-9]{64}$/)print $i}' | tail -1)"
|
|
printf '%s' "${DIGEST}" | grep -Eq '^sha256:[a-f0-9]{64}$'
|
|
echo "published=${REGISTRY}/${IMAGE_NAME}@${DIGEST}"
|
|
echo "source_revision=${REF}"
|
|
echo "context_sha256=c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d"
|
|
echo "candidate_only=true; actual published digest/full scan/SBOM/provenance and distinct native founder release approval remain required"
|