feat: security & integration hardening (ConfigMap + 5 gaps + CI/CD) #14

Closed
rock wants to merge 14 commits from feat/configmap-security-ci into main
Showing only changes of commit b40cc47729 - Show all commits
+11 -20
View File
@@ -9,50 +9,41 @@ jobs:
build-and-push: build-and-push:
name: Build and Push Image name: Build and Push Image
runs-on: rust runs-on: rust
container: # NO container specified - use runner's native environment
image: docker:27-dind # The rust runner has: Rust 1.83-bookworm + docker CLI + git
options: --privileged # Docker daemon available at: tcp://localhost:2376 (TLS)
env:
REGISTRY: forgejo.riotpiao.com
IMAGE: forgejo.riotpiao.com/rock/poimen-memory
steps: steps:
- name: Checkout code - name: Checkout code
run: | uses: actions/checkout@v4
apk add --no-cache git
git clone https://git.riotpiao.com:2222/rock/poimen-memory.git /src
cd /src
git checkout ${{ github.sha }}
- name: Get commit info - name: Get commit info
id: info id: info
run: | run: |
cd /src
SHORT_SHA=$(git rev-parse --short HEAD) SHORT_SHA=$(git rev-parse --short HEAD)
echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
echo "Commit SHA: ${SHORT_SHA}" echo "Building: ${SHORT_SHA}"
- name: Docker login - name: Docker login
run: | run: |
echo "${{ secrets.REGISTRY_PAT }}" | \ echo "${{ secrets.REGISTRY_PAT }}" | \
docker login -u rock --password-stdin ${{ env.REGISTRY }} docker login -u rock --password-stdin forgejo.riotpiao.com
- name: Build image - name: Build image
run: | run: |
cd /src
docker build \ docker build \
--tag ${{ env.IMAGE }}:${{ steps.info.outputs.short_sha }} \ --tag forgejo.riotpiao.com/rock/poimen-memory:${{ steps.info.outputs.short_sha }} \
--tag ${{ env.IMAGE }}:latest \ --tag forgejo.riotpiao.com/rock/poimen-memory:latest \
. .
echo "✅ Image built successfully" echo "✅ Image built successfully"
- name: Push image - name: Push image
run: | run: |
docker push ${{ env.IMAGE }}:${{ steps.info.outputs.short_sha }} docker push forgejo.riotpiao.com/rock/poimen-memory:${{ steps.info.outputs.short_sha }}
docker push ${{ env.IMAGE }}:latest docker push forgejo.riotpiao.com/rock/poimen-memory:latest
echo "✅ Image pushed successfully" echo "✅ Image pushed successfully"
- name: Cleanup - name: Cleanup
if: always() if: always()
run: | run: |
docker logout ${{ env.REGISTRY }} || true docker logout forgejo.riotpiao.com || true
echo "✅ Cleanup complete" echo "✅ Cleanup complete"