coulomb/policy-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Run source fetch in pinned CI container
Some checks failed
Build and publish policy-nexus image / build-and-push (push) Failing after 5s
Details

Browse source
This commit is contained in:
tegwick 2026-08-18 13:27:33 +02:00
parent 03a4fab9e0
commit 093913719f
2 changed files with 24 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

23
.forgejo/workflows/publish-image.yaml
View file

@ -53,19 +53,24 @@ jobs:
tar xzf "${BUILD_ROOT}/policy-nexus.tar.gz" \
-C "${BUILD_CONTEXT}" --strip-components=1
python3 "${BUILD_CONTEXT}/tools/fetch_sources.py" \
--config "${BUILD_CONTEXT}/source-inventory.config.json" \
--destination "${BUILD_CONTEXT}/_sources" \
--policy-revision "${REF}"
NETKINGDOM_REVISION="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["repositories"]["net-kingdom"]["revision"])' "${BUILD_CONTEXT}/_sources/source-lock.json")"
SOURCE_SET_DIGEST="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["source_set_digest"])' "${BUILD_CONTEXT}/_sources/source-lock.json")"
SOURCE_TAG="source-${SOURCE_SET_DIGEST}"
REVISION_TAG="git-${REF}-sources-${SOURCE_SET_DIGEST:0:16}"
wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz \
| tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
export PATH="${HOME}/bin:${PATH}"
docker version
PYTHON_IMAGE="docker.io/library/python@sha256:d09d15e60962ca365d1cd544a48773bac9d33f2fb1b00f2aa0deec78ade7dc31"
docker run --rm \
--volume "${BUILD_CONTEXT}:/workspace" \
--workdir /workspace \
"${PYTHON_IMAGE}" \
python3 tools/fetch_sources.py \
--config source-inventory.config.json \
--destination _sources \
--policy-revision "${REF}"
NETKINGDOM_REVISION="$(docker run --rm --volume "${BUILD_CONTEXT}:/workspace" "${PYTHON_IMAGE}" python3 -c 'import json; print(json.load(open("/workspace/_sources/source-lock.json"))["repositories"]["net-kingdom"]["revision"])')"
SOURCE_SET_DIGEST="$(docker run --rm --volume "${BUILD_CONTEXT}:/workspace" "${PYTHON_IMAGE}" python3 -c 'import json; print(json.load(open("/workspace/_sources/source-lock.json"))["source_set_digest"])')"
SOURCE_TAG="source-${SOURCE_SET_DIGEST}"
REVISION_TAG="git-${REF}-sources-${SOURCE_SET_DIGEST:0:16}"
echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
-u "${REGISTRY_USER}" --password-stdin