peetandClaude Fable 5
0807dc6434
- podman-build-publish: reverted to pure build+push (v8 behavior) — the Trivy gate briefly embedded in v10 moves to an explicit action instead. - trivy-scan (new): scans a registry image ref, fails on fixable HIGH/CRITICAL findings; jobs pin it to amd64 runners. - podman-promote (new): server-side retag via skopeo copy --all — releases promote the scanned sha-<commit> candidate instead of rebuilding. - deploy-prod (new): shared deploy body for the *.podman repos (with the BatchMode/IdentitiesOnly ssh flags only two of the four copies had). - README: documents the standard build.yml/release.yml pipeline; refs standardized on public/actions. Plan: noctrl.podman tmp/WORKFLOW_REWRITE_PLAN.md. Release as v11. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
53 lines
1.8 KiB
YAML
53 lines
1.8 KiB
YAML
name: Podman Promote
|
|
description: >
|
|
Promote an existing image in registry.noctrl.eu by retagging it server-side
|
|
(skopeo copy within the same registry — blobs are reused, no rebuild, no
|
|
transfer). Works for single-arch images and multi-arch manifest lists alike.
|
|
Fails if the source tag does not exist; it never falls back to building.
|
|
|
|
inputs:
|
|
image-name:
|
|
description: Repository/image name path, for example noctrl/gitea-runner
|
|
required: true
|
|
source-tag:
|
|
description: Existing tag to promote, for example sha-abc123
|
|
required: true
|
|
target-tag:
|
|
description: Tag to publish, for example v1.2.3
|
|
required: true
|
|
registry-username:
|
|
description: Registry username for login.
|
|
required: true
|
|
registry-password:
|
|
description: Registry password for login.
|
|
required: true
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- id: promote
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
export REGISTRY_AUTH_FILE="${RUNNER_TEMP}/promote-auth.json"
|
|
|
|
if ! command -v skopeo >/dev/null 2>&1; then
|
|
echo "ERROR: skopeo not found on this runner (needs noctrl/gitea-runner >= v10)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
image_base="registry.noctrl.eu/${{ inputs.image-name }}"
|
|
source_ref="docker://${image_base}:${{ inputs.source-tag }}"
|
|
target_ref="docker://${image_base}:${{ inputs.target-tag }}"
|
|
|
|
cleanup() { rm -f "${REGISTRY_AUTH_FILE}"; }
|
|
trap cleanup EXIT
|
|
|
|
echo "${{ inputs.registry-password }}" | skopeo login registry.noctrl.eu \
|
|
--username "${{ inputs.registry-username }}" --password-stdin
|
|
|
|
echo "Promoting ${source_ref} -> ${target_ref}"
|
|
# --all: copy every manifest of a multi-arch list, or the single image.
|
|
skopeo copy --all "${source_ref}" "${target_ref}"
|