feat: security & integration hardening (ConfigMap + 5 gaps + CI/CD) #14

Closed
rock wants to merge 14 commits from feat/configmap-security-ci into main
Showing only changes of commit b40cc47729 - Show all commits
+11 -20
View File
@@ -9,50 +9,41 @@ jobs:
build-and-push:
name: Build and Push Image
runs-on: rust
container:
image: docker:27-dind
options: --privileged
env:
REGISTRY: forgejo.riotpiao.com
IMAGE: forgejo.riotpiao.com/rock/poimen-memory
# NO container specified - use runner's native environment
# The rust runner has: Rust 1.83-bookworm + docker CLI + git
# Docker daemon available at: tcp://localhost:2376 (TLS)
steps:
- name: Checkout code
run: |
apk add --no-cache git
git clone https://git.riotpiao.com:2222/rock/poimen-memory.git /src
cd /src
git checkout ${{ github.sha }}
uses: actions/checkout@v4
- name: Get commit info
id: info
run: |
cd /src
SHORT_SHA=$(git rev-parse --short HEAD)
echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
echo "Commit SHA: ${SHORT_SHA}"
echo "Building: ${SHORT_SHA}"
- name: Docker login
run: |
echo "${{ secrets.REGISTRY_PAT }}" | \
docker login -u rock --password-stdin ${{ env.REGISTRY }}
docker login -u rock --password-stdin forgejo.riotpiao.com
- name: Build image
run: |
cd /src
docker build \
--tag ${{ env.IMAGE }}:${{ steps.info.outputs.short_sha }} \
--tag ${{ env.IMAGE }}:latest \
--tag forgejo.riotpiao.com/rock/poimen-memory:${{ steps.info.outputs.short_sha }} \
--tag forgejo.riotpiao.com/rock/poimen-memory:latest \
.
echo "✅ Image built successfully"
- name: Push image
run: |
docker push ${{ env.IMAGE }}:${{ steps.info.outputs.short_sha }}
docker push ${{ env.IMAGE }}:latest
docker push forgejo.riotpiao.com/rock/poimen-memory:${{ steps.info.outputs.short_sha }}
docker push forgejo.riotpiao.com/rock/poimen-memory:latest
echo "✅ Image pushed successfully"
- name: Cleanup
if: always()
run: |
docker logout ${{ env.REGISTRY }} || true
docker logout forgejo.riotpiao.com || true
echo "✅ Cleanup complete"