43 lines
1.8 KiB
YAML
43 lines
1.8 KiB
YAML
# Gitea Actions workflow. Uses the BlueBuild CLI directly — the blue-build/github-action
|
|
# is a GitHub-context composite and is not supported outside GitHub/GitLab CI.
|
|
# Runner requirement: act_runner must allow privileged job containers
|
|
# (container.privileged: true in the runner's config.yaml) — buildah needs it.
|
|
# NOTE: manual-only for now — no Actions runner is registered on the instance, and the
|
|
# image is currently built/pushed locally (see README "Building locally"). When a runner
|
|
# exists, restore the schedule + push triggers below to make builds fully automatic:
|
|
# schedule:
|
|
# - cron: "00 06 * * *" # daily rebuild pulls in base-image updates
|
|
# push:
|
|
# branches: [main]
|
|
# paths-ignore: ["**.md"]
|
|
name: bluebuild
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
bluebuild:
|
|
name: Build Custom Image
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: ghcr.io/blue-build/cli:v0.9
|
|
options: --privileged
|
|
env:
|
|
# Auto-signs on push when this + cosign.pub (repo root) are present.
|
|
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
|
|
# Gitea's auto job token cannot push packages (documented limitation),
|
|
# so registry auth uses a PAT with write:package scope.
|
|
BB_REGISTRY: git.lazypugs.com
|
|
BB_REGISTRY_NAMESPACE: ckoch
|
|
BB_USERNAME: ckoch
|
|
BB_PASSWORD: ${{ secrets.REGISTRY_TOKEN }}
|
|
steps:
|
|
# Plain clone instead of actions/checkout: the CLI job container isn't
|
|
# guaranteed to have node, and the repo is public.
|
|
- name: Clone repo
|
|
run: |
|
|
git config --global --add safe.directory "$(pwd)"
|
|
git clone --depth 1 --branch "${GITHUB_REF_NAME:-main}" "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" .
|
|
|
|
- name: Build and push signed image
|
|
run: bluebuild build --verbose --push --retry-push recipes/recipe.yml
|