DarkHelm.org/plex-playlist
Public Access
4
1
Fork 0
Code Issues 55 Pull Requests 3 Actions 9 Packages Projects 1 Releases Wiki Activity

ci: harden registry auth host pinning for runner DNS
Some checks failed
CICD / Build and Push CICD Images (pull_request) Failing after 1m0s
Details
CICD / Source Checks (pull_request) Has been skipped
Details
CICD / Dependency Audits (Informational) (pull_request) Has been skipped
Details
CICD / Build Release Images (pull_request) Has been skipped
Details
CICD / Build Tester Images (pull_request) Has been skipped
Details
CICD / CICD Tests Complete (pull_request) Failing after 11s
Details
CICD / Build CICD Image Failure Postmortem (pull_request) Successful in 20s
Details
CICD / Production Images Complete (pull_request) Failing after 6s
Details
CICD / Runtime Black-Box Integration Tests (pull_request) Has been skipped
Details
CICD / End-to-End Tests (pull_request) Has been skipped
Details
CICD / Promote Staging Images To Release (pull_request) Has been skipped
Details
CICD / Production Image Failures Postmortem (pull_request) Has been skipped
Details
CICD / Source Lanes Failure Postmortem (pull_request) Has been skipped
Details
CICD / Integration Tests Failure Postmortem (pull_request) Has been skipped
Details
CICD / E2E Tests Failure Postmortem (pull_request) Has been skipped
Details

Browse Source
This commit is contained in:
copilotcoder
2026-07-17 12:53:33 -04:00
parent f5f5c75949
commit cb491dabd4
1 changed files with 30 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
.gitea/workflows/cicd.yaml
View File

@@ -22,6 +22,8 @@ env:
GITEA_REGISTRY: kankali.darkhelm.lan:3001 GITEA_REGISTRY: kankali.darkhelm.lan:3001
GITEA_REGISTRY_IP: 10.18.75.2 GITEA_REGISTRY_IP: 10.18.75.2
GITEA_REGISTRY_HOST: kankali.darkhelm.lan GITEA_REGISTRY_HOST: kankali.darkhelm.lan
GITEA_REGISTRY_AUTH_HOST: kankali.darkhelm.lan
GITEA_REGISTRY_AUTH_FALLBACK_HOST: dogar.darkhelm.org
CI_PRUNE_AT_JOB_START: "true" CI_PRUNE_AT_JOB_START: "true"
CI_PRUNE_THRESHOLD_PERCENT: "90" CI_PRUNE_THRESHOLD_PERCENT: "90"
@@ -155,12 +157,19 @@ jobs:
echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
fi fi
if [ -n "${GITEA_REGISTRY_AUTH_FALLBACK_HOST:-}" ] && ! grep -q "${GITEA_REGISTRY_AUTH_FALLBACK_HOST}" /etc/hosts; then
echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_AUTH_FALLBACK_HOST}" >> /etc/hosts
fi
headers_file="$(mktemp)" headers_file="$(mktemp)"
if curl -sSI "http://${GITEA_REGISTRY}/v2/" >"${headers_file}"; then if curl -sSI "http://${GITEA_REGISTRY}/v2/" >"${headers_file}"; then
realm_url="$(sed -n 's/.*realm="\([^"]*\)".*/\1/p' "${headers_file}" | head -n 1)" realm_url="$(sed -n 's/.*realm="\([^"]*\)".*/\1/p' "${headers_file}" | head -n 1)"
if [ -n "${realm_url}" ]; then if [ -n "${realm_url}" ]; then
realm_host="$(printf '%s' "${realm_url}" | sed -E 's#^https?://([^/:]+).*$#\1#')" realm_host="$(printf '%s' "${realm_url}" | sed -E 's#^https?://([^/:]+).*$#\1#')"
if [ -n "${realm_host}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_HOST}" ]; then if [ -n "${realm_host}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_HOST}" ]; then
if [ -n "${GITEA_REGISTRY_AUTH_HOST:-}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_AUTH_HOST}" ]; then
echo "Registry advertised auth realm host '${realm_host}' (expected '${GITEA_REGISTRY_AUTH_HOST}'). Applying host pin for reliability."
fi
if ! grep -q "${realm_host}" /etc/hosts; then if ! grep -q "${realm_host}" /etc/hosts; then
echo "${GITEA_REGISTRY_IP} ${realm_host}" >> /etc/hosts echo "${GITEA_REGISTRY_IP} ${realm_host}" >> /etc/hosts
echo "Pinned registry auth realm host: ${realm_host} -> ${GITEA_REGISTRY_IP}" echo "Pinned registry auth realm host: ${realm_host} -> ${GITEA_REGISTRY_IP}"
@@ -267,12 +276,19 @@ jobs:
echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
fi fi
if [ -n "${GITEA_REGISTRY_AUTH_FALLBACK_HOST:-}" ] && ! grep -q "${GITEA_REGISTRY_AUTH_FALLBACK_HOST}" /etc/hosts; then
echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_AUTH_FALLBACK_HOST}" >> /etc/hosts
fi
headers_file="$(mktemp)" headers_file="$(mktemp)"
if curl -sSI "http://${GITEA_REGISTRY}/v2/" >"${headers_file}"; then if curl -sSI "http://${GITEA_REGISTRY}/v2/" >"${headers_file}"; then
realm_url="$(sed -n 's/.*realm="\([^"]*\)".*/\1/p' "${headers_file}" | head -n 1)" realm_url="$(sed -n 's/.*realm="\([^"]*\)".*/\1/p' "${headers_file}" | head -n 1)"
if [ -n "${realm_url}" ]; then if [ -n "${realm_url}" ]; then
realm_host="$(printf '%s' "${realm_url}" | sed -E 's#^https?://([^/:]+).*$#\1#')" realm_host="$(printf '%s' "${realm_url}" | sed -E 's#^https?://([^/:]+).*$#\1#')"
if [ -n "${realm_host}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_HOST}" ]; then if [ -n "${realm_host}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_HOST}" ]; then
if [ -n "${GITEA_REGISTRY_AUTH_HOST:-}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_AUTH_HOST}" ]; then
echo "Registry advertised auth realm host '${realm_host}' (expected '${GITEA_REGISTRY_AUTH_HOST}'). Applying host pin for reliability."
fi
if ! grep -q "${realm_host}" /etc/hosts; then if ! grep -q "${realm_host}" /etc/hosts; then
echo "${GITEA_REGISTRY_IP} ${realm_host}" >> /etc/hosts echo "${GITEA_REGISTRY_IP} ${realm_host}" >> /etc/hosts
echo "Pinned registry auth realm host: ${realm_host} -> ${GITEA_REGISTRY_IP}" echo "Pinned registry auth realm host: ${realm_host} -> ${GITEA_REGISTRY_IP}"
@@ -453,12 +469,19 @@ jobs:
echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
fi fi
if [ -n "${GITEA_REGISTRY_AUTH_FALLBACK_HOST:-}" ] && ! grep -q "${GITEA_REGISTRY_AUTH_FALLBACK_HOST}" /etc/hosts; then
echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_AUTH_FALLBACK_HOST}" >> /etc/hosts
fi
headers_file="$(mktemp)" headers_file="$(mktemp)"
if curl -sSI "http://${GITEA_REGISTRY}/v2/" >"${headers_file}"; then if curl -sSI "http://${GITEA_REGISTRY}/v2/" >"${headers_file}"; then
realm_url="$(sed -n 's/.*realm="\([^"]*\)".*/\1/p' "${headers_file}" | head -n 1)" realm_url="$(sed -n 's/.*realm="\([^"]*\)".*/\1/p' "${headers_file}" | head -n 1)"
if [ -n "${realm_url}" ]; then if [ -n "${realm_url}" ]; then
realm_host="$(printf '%s' "${realm_url}" | sed -E 's#^https?://([^/:]+).*$#\1#')" realm_host="$(printf '%s' "${realm_url}" | sed -E 's#^https?://([^/:]+).*$#\1#')"
if [ -n "${realm_host}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_HOST}" ]; then if [ -n "${realm_host}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_HOST}" ]; then
if [ -n "${GITEA_REGISTRY_AUTH_HOST:-}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_AUTH_HOST}" ]; then
echo "Registry advertised auth realm host '${realm_host}' (expected '${GITEA_REGISTRY_AUTH_HOST}'). Applying host pin for reliability."
fi
if ! grep -q "${realm_host}" /etc/hosts; then if ! grep -q "${realm_host}" /etc/hosts; then
echo "${GITEA_REGISTRY_IP} ${realm_host}" >> /etc/hosts echo "${GITEA_REGISTRY_IP} ${realm_host}" >> /etc/hosts
echo "Pinned registry auth realm host: ${realm_host} -> ${GITEA_REGISTRY_IP}" echo "Pinned registry auth realm host: ${realm_host} -> ${GITEA_REGISTRY_IP}"
@@ -615,12 +638,19 @@ jobs:
echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
fi fi
if [ -n "${GITEA_REGISTRY_AUTH_FALLBACK_HOST:-}" ] && ! grep -q "${GITEA_REGISTRY_AUTH_FALLBACK_HOST}" /etc/hosts; then
echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_AUTH_FALLBACK_HOST}" >> /etc/hosts
fi
headers_file="$(mktemp)" headers_file="$(mktemp)"
if curl -sSI "http://${GITEA_REGISTRY}/v2/" >"${headers_file}"; then if curl -sSI "http://${GITEA_REGISTRY}/v2/" >"${headers_file}"; then
realm_url="$(sed -n 's/.*realm="\([^"]*\)".*/\1/p' "${headers_file}" | head -n 1)" realm_url="$(sed -n 's/.*realm="\([^"]*\)".*/\1/p' "${headers_file}" | head -n 1)"
if [ -n "${realm_url}" ]; then if [ -n "${realm_url}" ]; then
realm_host="$(printf '%s' "${realm_url}" | sed -E 's#^https?://([^/:]+).*$#\1#')" realm_host="$(printf '%s' "${realm_url}" | sed -E 's#^https?://([^/:]+).*$#\1#')"
if [ -n "${realm_host}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_HOST}" ]; then if [ -n "${realm_host}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_HOST}" ]; then
if [ -n "${GITEA_REGISTRY_AUTH_HOST:-}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_AUTH_HOST}" ]; then
echo "Registry advertised auth realm host '${realm_host}' (expected '${GITEA_REGISTRY_AUTH_HOST}'). Applying host pin for reliability."
fi
if ! grep -q "${realm_host}" /etc/hosts; then if ! grep -q "${realm_host}" /etc/hosts; then
echo "${GITEA_REGISTRY_IP} ${realm_host}" >> /etc/hosts echo "${GITEA_REGISTRY_IP} ${realm_host}" >> /etc/hosts
echo "Pinned registry auth realm host: ${realm_host} -> ${GITEA_REGISTRY_IP}" echo "Pinned registry auth realm host: ${realm_host} -> ${GITEA_REGISTRY_IP}"