|
|
|
@@ -1,6 +1,17 @@
|
|
|
|
|
# Builds the CI tooling images (and the secret-rotator runtime image) with
|
|
|
|
|
# kaniko and pushes them to the Gitea container registry.
|
|
|
|
|
#
|
|
|
|
|
# The kaniko image is NOT Google's. Google archived
|
|
|
|
|
# GoogleContainerTools/kaniko on 2025-06-03, but the original authors forked
|
|
|
|
|
# it to chainguard-dev/kaniko and kept releasing — the pin here is well past
|
|
|
|
|
# the v1.24.0 the Google repo ended on. The fork ships no binaries or images
|
|
|
|
|
# of its own, so these come from gitlab-ci-utils, which builds that fork for
|
|
|
|
|
# amd64 and arm64 under versioned tags. A generic `:debug` tag exists there
|
|
|
|
|
# and is deliberately unused; everything else in this repo is pinned too.
|
|
|
|
|
#
|
|
|
|
|
# The executor path, flags and busybox layout are unchanged from Google's
|
|
|
|
|
# image, which is why the swap touched nothing but the `image:` lines (#552).
|
|
|
|
|
#
|
|
|
|
|
# Credential: ci_images_token — a PAT scoped to `package: read+write` and
|
|
|
|
|
# NOTHING else (verified: 403 on /user/repos, /admin/users and the issues
|
|
|
|
|
# API; 200 on the /v2/ registry endpoints kaniko uses). It replaces the
|
|
|
|
@@ -25,7 +36,7 @@ when:
|
|
|
|
|
|
|
|
|
|
steps:
|
|
|
|
|
- name: build-ansible
|
|
|
|
|
image: gcr.io/kaniko-project/executor:v1.23.2-debug
|
|
|
|
|
image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.18-debug
|
|
|
|
|
directory: ci/images/ansible
|
|
|
|
|
depends_on: []
|
|
|
|
|
# Only rebuild when THIS image's source (or the pipeline file) changed, or
|
|
|
|
@@ -53,7 +64,7 @@ steps:
|
|
|
|
|
--destination gitea.renner.uno/gitea_admin/ci-ansible:latest
|
|
|
|
|
|
|
|
|
|
- name: build-k8s
|
|
|
|
|
image: gcr.io/kaniko-project/executor:v1.23.2-debug
|
|
|
|
|
image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.18-debug
|
|
|
|
|
directory: ci/images/k8s
|
|
|
|
|
depends_on: []
|
|
|
|
|
when:
|
|
|
|
@@ -77,7 +88,7 @@ steps:
|
|
|
|
|
--destination gitea.renner.uno/gitea_admin/ci-k8s:latest
|
|
|
|
|
|
|
|
|
|
- name: build-tofu
|
|
|
|
|
image: gcr.io/kaniko-project/executor:v1.23.2-debug
|
|
|
|
|
image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.18-debug
|
|
|
|
|
directory: ci/images/tofu
|
|
|
|
|
depends_on: []
|
|
|
|
|
when:
|
|
|
|
@@ -108,7 +119,7 @@ steps:
|
|
|
|
|
# Runtime image, not CI tooling: a static musl binary in a FROM-scratch image,
|
|
|
|
|
# used as the base for secret-rotation CronJobs. Replaces per-job inline Python.
|
|
|
|
|
- name: build-secret-rotator
|
|
|
|
|
image: gcr.io/kaniko-project/executor:v1.23.2-debug
|
|
|
|
|
image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.18-debug
|
|
|
|
|
directory: secret-rotator
|
|
|
|
|
depends_on: []
|
|
|
|
|
when:
|
|
|
|
@@ -136,21 +147,6 @@ steps:
|
|
|
|
|
# not for who uses it — its first consumer is the zigbee2mqtt seed-data init
|
|
|
|
|
# container, but nothing about it is zigbee-specific. Exists so tools come from
|
|
|
|
|
# the image rather than an `apk add` on every container start.
|
|
|
|
|
# First step moved to the maintained kaniko fork (#552). Google archived
|
|
|
|
|
# GoogleContainerTools/kaniko on 2025-06-03, but the original authors forked
|
|
|
|
|
# it to chainguard-dev/kaniko and kept releasing: this is v1.25.18, well past
|
|
|
|
|
# the v1.24.0 the Google repo ended on. The fork publishes no binaries of its
|
|
|
|
|
# own, so the image comes from gitlab-ci-utils, which builds it for amd64 and
|
|
|
|
|
# arm64 with versioned tags.
|
|
|
|
|
#
|
|
|
|
|
# Same /kaniko/executor path, same flags, and /bin/sh, base64, tr, mkdir and
|
|
|
|
|
# date are all present — verified by pulling the image and running it, not by
|
|
|
|
|
# reading the README.
|
|
|
|
|
#
|
|
|
|
|
# Deliberately only this step for now. A change to this file rebuilds every
|
|
|
|
|
# step anyway, so one run gives the new executor on alpine-jq beside seven
|
|
|
|
|
# unchanged kaniko builds — an A/B in a single pipeline. The other seven and
|
|
|
|
|
# ci-claude-refresh.yml follow once this one is green.
|
|
|
|
|
- name: build-alpine-jq
|
|
|
|
|
image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.18-debug
|
|
|
|
|
directory: ci/images/alpine-jq
|
|
|
|
@@ -181,7 +177,7 @@ steps:
|
|
|
|
|
# critical path of every node rebuild. The download now happens here, once,
|
|
|
|
|
# where the sha256 is checked — see the Containerfile for the full rationale.
|
|
|
|
|
- name: build-cni-plugins
|
|
|
|
|
image: gcr.io/kaniko-project/executor:v1.23.2-debug
|
|
|
|
|
image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.18-debug
|
|
|
|
|
directory: ci/images/cni-plugins
|
|
|
|
|
depends_on: []
|
|
|
|
|
when:
|
|
|
|
@@ -210,7 +206,7 @@ steps:
|
|
|
|
|
# every paperless pod start. The openssl CLI is genuinely absent from the alpine
|
|
|
|
|
# base, so this one needs an image rather than a busybox substitute.
|
|
|
|
|
- name: build-alpine-openssl
|
|
|
|
|
image: gcr.io/kaniko-project/executor:v1.23.2-debug
|
|
|
|
|
image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.18-debug
|
|
|
|
|
directory: ci/images/alpine-openssl
|
|
|
|
|
depends_on: []
|
|
|
|
|
when:
|
|
|
|
@@ -239,7 +235,7 @@ steps:
|
|
|
|
|
# Ansible converge. Not a ci-* image -- it is a runtime artifact -- but it
|
|
|
|
|
# builds the same way and lands in the same registry so the audit sees it.
|
|
|
|
|
- name: build-heating-can
|
|
|
|
|
image: gcr.io/kaniko-project/executor:v1.23.2-debug
|
|
|
|
|
image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.18-debug
|
|
|
|
|
directory: ci/images/heating-can
|
|
|
|
|
depends_on: []
|
|
|
|
|
when:
|
|
|
|
|