astral/buzz-sheet
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci : fix
CI / Verify and audit (push) Successful in 1m27s
Details
CI / Build, scan and deploy immutable images (push) Failing after 1m44s
Details

Browse Source
This commit is contained in:
gunshiz
2026-09-22 18:37:17 +07:00 Unverified
parent 87e6bcd96f
commit 51dcc4c018
1 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci.yml
+11 -9
View File
@@ -77,16 +77,18 @@ jobs:
--tag "$REGISTRY_IMAGE:$REVISION" .
docker build --target migration --build-arg VCS_REF="$REVISION" \
--tag "$REGISTRY_IMAGE:migrate-$REVISION" .
mkdir -p "$RUNNER_TEMP/buzz-trivy-cache"
for tag in "$REVISION" "migrate-$REVISION"; do
docker save --output "$RUNNER_TEMP/buzz-image.tar" "$REGISTRY_IMAGE:$tag"
docker run --rm --user "$(id -u):$(id -g)" --cap-drop=ALL --security-opt=no-new-privileges \
--volume "$RUNNER_TEMP:/scan:ro" \
--volume "$RUNNER_TEMP/buzz-trivy-cache:/cache" \
docker save --output "$RUNNER_TEMP/buzz-app-image.tar" "$REGISTRY_IMAGE:$REVISION"
docker save --output "$RUNNER_TEMP/buzz-migration-image.tar" "$REGISTRY_IMAGE:migrate-$REVISION"
chmod 644 "$RUNNER_TEMP/buzz-app-image.tar" "$RUNNER_TEMP/buzz-migration-image.tar"
# One scanner container shares its private cache across both images.
docker run --rm --user 0:0 --cap-drop=ALL --security-opt=no-new-privileges \
--volume "$RUNNER_TEMP/buzz-app-image.tar:/scan/buzz-app-image.tar:ro" \
--volume "$RUNNER_TEMP/buzz-migration-image.tar:/scan/buzz-migration-image.tar:ro" \
--entrypoint /bin/sh \
aquasec/trivy@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c \
image --input /scan/buzz-image.tar --cache-dir /cache --scanners vuln --severity HIGH,CRITICAL --exit-code 1
rm "$RUNNER_TEMP/buzz-image.tar"
done
-ec 'trivy image --input /scan/buzz-app-image.tar --cache-dir /tmp/trivy-cache --scanners vuln --severity HIGH,CRITICAL --exit-code 1 &&
trivy image --input /scan/buzz-migration-image.tar --cache-dir /tmp/trivy-cache --scanners vuln --severity HIGH,CRITICAL --exit-code 1'
rm "$RUNNER_TEMP/buzz-app-image.tar" "$RUNNER_TEMP/buzz-migration-image.tar"
docker push "$REGISTRY_IMAGE:$REVISION" | tee "$RUNNER_TEMP/buzz-app-push.log"
docker push "$REGISTRY_IMAGE:migrate-$REVISION" | tee "$RUNNER_TEMP/buzz-migration-push.log"
- name: Set up kubectl