ckochandClaude Fable 5
a54cb8df30
bluebuild / Build Custom Image (push) Has been cancelled
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
42 lines
1.6 KiB
YAML
42 lines
1.6 KiB
YAML
# Gitea Actions workflow. Uses the BlueBuild CLI directly — the blue-build/github-action
|
|
# is a GitHub-context composite and is not supported outside GitHub/GitLab CI.
|
|
# Runner requirement: act_runner must allow privileged job containers
|
|
# (container.privileged: true in the runner's config.yaml) — buildah needs it.
|
|
name: bluebuild
|
|
on:
|
|
schedule:
|
|
- cron: "00 06 * * *" # daily rebuild pulls in base-image updates (self-updating)
|
|
push:
|
|
branches:
|
|
- main
|
|
paths-ignore:
|
|
- "**.md"
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
bluebuild:
|
|
name: Build Custom Image
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: ghcr.io/blue-build/cli:v0.9
|
|
options: --privileged
|
|
env:
|
|
# Auto-signs on push when this + cosign.pub (repo root) are present.
|
|
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
|
|
# Gitea's auto job token cannot push packages (documented limitation),
|
|
# so registry auth uses a PAT with write:package scope.
|
|
BB_REGISTRY: git.lazypugs.com
|
|
BB_REGISTRY_NAMESPACE: ckoch
|
|
BB_USERNAME: ckoch
|
|
BB_PASSWORD: ${{ secrets.REGISTRY_TOKEN }}
|
|
steps:
|
|
# Plain clone instead of actions/checkout: the CLI job container isn't
|
|
# guaranteed to have node, and the repo is public.
|
|
- name: Clone repo
|
|
run: |
|
|
git config --global --add safe.directory "$(pwd)"
|
|
git clone --depth 1 --branch "${GITHUB_REF_NAME:-main}" "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" .
|
|
|
|
- name: Build and push signed image
|
|
run: bluebuild build --verbose --push --retry-push recipes/recipe.yml
|