peetandClaude Fable 5
5f499cd0ac
New scan step between build and push: the built image is exported and scanned with Trivy; fixable HIGH/CRITICAL findings fail the action and block the push. Configurable via new scan / scan-severity inputs. Implements noctrl.podman security review finding #16 (CI level). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
77 lines
2.3 KiB
Markdown
77 lines
2.3 KiB
Markdown
# Gitea Actions
|
|
|
|
Reusable Gitea Actions composite workflows for noctrl infrastructure automation.
|
|
|
|
## Available Actions
|
|
|
|
### Podman Build And Publish
|
|
|
|
Builds and optionally pushes OCI container images to `registry.noctrl.eu` using Podman with isolated storage context.
|
|
|
|
Since `v10`, the built image is scanned with Trivy before the push and the action fails on fixable HIGH/CRITICAL vulnerabilities (tune with `scan-severity`, opt out with `scan: "false"`). Requires the `trivy` binary on the runner (present in `noctrl/gitea-runner` since `v9`).
|
|
|
|
**Location:** [`./podman-build-publish`](./podman-build-publish)
|
|
|
|
**Use in workflows:**
|
|
```yaml
|
|
- uses: https://gitea.noctrl.eu/noctrl/actions/podman-build-publish@v1
|
|
with:
|
|
image-name: noctrl/myapp
|
|
tags: |
|
|
latest
|
|
sha-${{ github.sha }}
|
|
```
|
|
|
|
See [podman-build-publish README](./podman-build-publish/README.md) for full documentation.
|
|
|
|
### Podman Manifest Publish
|
|
|
|
Creates and pushes OCI multi-arch manifest tags to `registry.noctrl.eu` using
|
|
Podman with isolated storage context.
|
|
|
|
**Location:** [`./podman-manifest-publish`](./podman-manifest-publish)
|
|
|
|
**Use in workflows:**
|
|
```yaml
|
|
- uses: https://gitea.noctrl.eu/noctrl/actions/podman-manifest-publish@v1
|
|
with:
|
|
image-name: noctrl/myapp
|
|
manifest-tag: v1.2.3
|
|
source-tags: |
|
|
v1.2.3-tmp-123-amd64
|
|
v1.2.3-tmp-123-arm64
|
|
```
|
|
|
|
See [podman-manifest-publish README](./podman-manifest-publish/README.md) for full documentation.
|
|
|
|
## Usage
|
|
|
|
Reference actions by absolute URL in your workflow:
|
|
|
|
```yaml
|
|
- uses: https://gitea.noctrl.eu/noctrl/actions/<action-name>@<ref>
|
|
```
|
|
|
|
**Ref Options:**
|
|
- `@v1` — points to tag `v1`
|
|
- `@main` — points to default branch
|
|
- `@commit-sha` — points to specific commit
|
|
|
|
## Repository Secrets
|
|
|
|
Actions reference caller repository secrets. Ensure your repository has required secrets defined:
|
|
|
|
- **REGISTRY_USERNAME** — registry.noctrl.eu authentication username
|
|
- **REGISTRY_PASSWORD** — registry.noctrl.eu authentication password
|
|
|
|
Set these in repository **Settings** → **Secrets**.
|
|
|
|
## Contributing
|
|
|
|
When adding new actions:
|
|
1. Create action directory: `./action-name/`
|
|
2. Include `action.yaml` (composite action definition)
|
|
3. Include `README.md` with inputs, outputs, and usage example
|
|
4. Tag stable versions: `git tag v1`, `git tag v2`, etc.
|
|
5. Update this root README
|