43 lines
2.8 KiB
JSON
43 lines
2.8 KiB
JSON
{
|
|
"name": "verify-secret-scanner",
|
|
"image": "code.forgejo.org/forgejo/forgejo@sha256:691657c7e64af7730a2e885e6d022cf16ae60724931c5392bd61838afadcaeba",
|
|
"imagePullPolicy": "IfNotPresent",
|
|
"command": [
|
|
"sh",
|
|
"-c",
|
|
"#!/bin/sh\nset +vx\nset -eu\ntest \"$(id -u)\" = 1000\ntest -d /data && test ! -L /data\ntest -d /data/security && test ! -L /data/security\ntest -d /data/security/receive-secret-scan && test ! -L /data/security/receive-secret-scan\ntest -d /data/security/receive-secret-scan/20261012-57a0642b6251 && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251\ntest -f /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan\ntest \"$(stat -c %u /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\" = 1000\ntest \"$(sha256sum /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan | cut -d \" \" -f 1)\" = 57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\" in 755|775) ;; *) exit 21;; esac\ntest -f /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks\ntest \"$(stat -c %u /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\" = 1000\ntest \"$(sha256sum /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks | cut -d \" \" -f 1)\" = 88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\" in 755|775) ;; *) exit 21;; esac\nif [ \"${1:-check}\" = apply ]; then\n chmod 755 /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan\n test \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\" = 755\n chmod 755 /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks\n test \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\" = 755\nfi\n",
|
|
"sh",
|
|
"apply"
|
|
],
|
|
"securityContext": {
|
|
"runAsUser": 1000,
|
|
"runAsGroup": 1000,
|
|
"runAsNonRoot": true,
|
|
"allowPrivilegeEscalation": false,
|
|
"readOnlyRootFilesystem": true,
|
|
"capabilities": {
|
|
"drop": [
|
|
"ALL"
|
|
]
|
|
}
|
|
},
|
|
"resources": {
|
|
"requests": {
|
|
"cpu": "10m",
|
|
"memory": "32Mi"
|
|
},
|
|
"limits": {
|
|
"cpu": "100m",
|
|
"memory": "64Mi"
|
|
}
|
|
},
|
|
"volumeMounts": [
|
|
{
|
|
"name": "data",
|
|
"mountPath": "/data/security",
|
|
"subPath": "security"
|
|
}
|
|
],
|
|
"terminationMessagePath": "/dev/termination-log",
|
|
"terminationMessagePolicy": "File"
|
|
}
|