public/actions
Public Access
1
0 Fork 0
Code Pull Requests Actions Activity
21 Commits 2 Branches 13 Tags
main
Commit Graph
17 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
peet c4e10c5044 Add pre commit (#6)
Validate actions / validate (push) Successful in 3s
Details 
Reviewed-on: #6
Co-authored-by: peet <peet@noctrl.eu>
 2026-09-06 15:53:44 +02:00
peetandClaude Fable 5 cc11e264c6 trivy-fs-scan: enforce by default; 'false' is the emergency escape (#5) 
Feedback from the first rollout: a default-off gate is the wrong way
around — the default must be active and enforced, with the opt-out as an
explicit, documented per-invocation emergency flag (same posture as the
image-scan gate).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
Reviewed-on: #5
Co-authored-by: peet <peet@noctrl.eu>
 2026-08-30 19:36:33 +02:00
peetandClaude Fable 5 e501ab145f trivy-scan: optional skip-dirs input for vendored toolchains (#4) 
For directories whose bundled dependencies cannot be upgraded in place —
first user: the Android SDK cmdline-tools jars (old protobuf/guava et al.
inside sdkmanager) in the gitea-runner-android image. Callers must leave a
comment in the workflow explaining each exclusion.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
Reviewed-on: #4
Co-authored-by: peet <peet@noctrl.eu>
 2026-08-30 10:26:35 +02:00
peetandClaude Fable 5 54cdfad823 android-signing and trivy-fs-scan actions (android repo cleanup) 
- android-signing: the keystore-restore step previously copy-pasted in
  habitude and ablage-android; no-op without the secret (unsigned build).
- trivy-fs-scan: lockfile-based dependency scan for artifact-building
  repos (APKs); non-blocking by default via enforce input.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
 2026-08-30 10:01:15 +02:00
peetandClaude Fable 5 0807dc6434 Build-scan-promote pipeline: explicit trivy-scan, podman-promote, deploy-prod actions 
- podman-build-publish: reverted to pure build+push (v8 behavior) — the
  Trivy gate briefly embedded in v10 moves to an explicit action instead.
- trivy-scan (new): scans a registry image ref, fails on fixable
  HIGH/CRITICAL findings; jobs pin it to amd64 runners.
- podman-promote (new): server-side retag via skopeo copy --all — releases
  promote the scanned sha-<commit> candidate instead of rebuilding.
- deploy-prod (new): shared deploy body for the *.podman repos (with the
  BatchMode/IdentitiesOnly ssh flags only two of the four copies had).
- README: documents the standard build.yml/release.yml pipeline; refs
  standardized on public/actions.

Plan: noctrl.podman tmp/WORKFLOW_REWRITE_PLAN.md. Release as v11.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
 2026-08-29 13:40:46 +02:00
peetandClaude Fable 5 ec5a498266 Use docker-archive for the Trivy scan export (oci-archive unsupported) 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
 2026-08-29 09:39:49 +02:00
peetandClaude Fable 5 5f499cd0ac podman-build-publish: gate pushes on a Trivy vulnerability scan 
New scan step between build and push: the built image is exported and
scanned with Trivy; fixable HIGH/CRITICAL findings fail the action and
block the push. Configurable via new scan / scan-severity inputs.
Implements noctrl.podman security review finding #16 (CI level).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
 2026-08-29 09:38:38 +02:00
peet 06fd1a015a build isolation oci for arm64 builds 2026-06-14 13:24:43 +02:00
peet fa3f894736 podman storage driver overlayfs+fuse and vfs as fallback 2026-05-28 14:42:29 +02:00
peet cb24d45011 credentials required 2026-05-28 00:44:22 +02:00
peet 78d9ca75f3 registry credentials optional 2026-05-27 16:20:25 +02:00
peet 316a41d231 podman manifest action 2026-05-26 19:25:25 +02:00
peet b0ceee7e9b push is optional now 2026-05-26 19:16:43 +02:00
peet 5ff1f840dc fix github_env 2026-04-24 21:59:31 +02:00
peet 512d32e285 fix podman root 2026-04-24 21:55:34 +02:00
peet 201c1568df fix registry authentication 2026-04-24 21:51:09 +02:00
peet 4a66d2b26d Gitea Actions Podman build and push 2026-04-24 21:04:19 +02:00