initial import
This commit is contained in:
sebthom
parent
c8f0805af9
commit
fd83c3ffe7
|
|
@ -0,0 +1,6 @@
|
||||||
|
*.md
|
||||||
|
*.txt
|
||||||
|
.github/
|
||||||
|
.shared/.*
|
||||||
|
.shared/*.md
|
||||||
|
.shared/*.txt
|
||||||
|
|
@ -0,0 +1,18 @@
|
||||||
|
# EditorConfig is awesome: https://EditorConfig.org
|
||||||
|
|
||||||
|
# top-most EditorConfig file
|
||||||
|
root = true
|
||||||
|
|
||||||
|
[*]
|
||||||
|
charset = utf-8
|
||||||
|
end_of_line = lf
|
||||||
|
insert_final_newline = true
|
||||||
|
trim_trailing_whitespace = true
|
||||||
|
indent_style = space
|
||||||
|
indent_size = 3
|
||||||
|
|
||||||
|
[*.{bat,cmd}]
|
||||||
|
end_of_line = crlf
|
||||||
|
|
||||||
|
[*.{yml,yaml}]
|
||||||
|
indent_size = 2
|
||||||
|
|
@ -0,0 +1,132 @@
|
||||||
|
# inspired by
|
||||||
|
# - https://github.com/alexkaratarakis/gitattributes/blob/master/Java.gitattributes
|
||||||
|
# - https://github.com/alexkaratarakis/gitattributes/blob/master/Common.gitattributes
|
||||||
|
|
||||||
|
# Handle line endings automatically for files detected as text
|
||||||
|
# and leave all files detected as binary untouched.
|
||||||
|
* text=auto
|
||||||
|
|
||||||
|
#
|
||||||
|
# The above will handle all files with names NOT matching patterns defined below
|
||||||
|
#
|
||||||
|
|
||||||
|
# Git files
|
||||||
|
.gitattributes text eol=lf
|
||||||
|
**/.gitattributes text eol=lf
|
||||||
|
.gitignore text eol=lf
|
||||||
|
**/.gitignore text eol=lf
|
||||||
|
|
||||||
|
|
||||||
|
# Documents
|
||||||
|
*.doc binary diff=astextplain
|
||||||
|
*.docx binary diff=astextplain
|
||||||
|
*.dot binary diff=astextplain
|
||||||
|
*.pdf binary diff=astextplain
|
||||||
|
*.ppt binary diff=astextplain
|
||||||
|
*.pptx binary diff=astextplain
|
||||||
|
*.rtf binary diff=astextplain
|
||||||
|
*.vsd binary diff=astextplain
|
||||||
|
*.vsdx binary diff=astextplain
|
||||||
|
*.odt binary diff=odf
|
||||||
|
*.ods binary diff=odf
|
||||||
|
*.odp binary diff=odf
|
||||||
|
*.adoc text
|
||||||
|
*.csv text
|
||||||
|
*.md text diff=markdown
|
||||||
|
*.txt text
|
||||||
|
|
||||||
|
|
||||||
|
# Config/Serialisation
|
||||||
|
.editorconfig text
|
||||||
|
**/.editorconfig text
|
||||||
|
*.ini text
|
||||||
|
*.properties text
|
||||||
|
*.json text
|
||||||
|
*.toml text
|
||||||
|
*.xml text
|
||||||
|
*.yaml text
|
||||||
|
*.yml text
|
||||||
|
|
||||||
|
|
||||||
|
# Scripts
|
||||||
|
*.bat text eol=crlf
|
||||||
|
*.cmd text eol=crlf
|
||||||
|
*.ps1 text eol=crlf
|
||||||
|
*.bash text eol=lf
|
||||||
|
*.fish text eol=lf
|
||||||
|
*.sh text eol=lf
|
||||||
|
*.zsh text eol=lf
|
||||||
|
*.lua text
|
||||||
|
*.php text
|
||||||
|
*.python text
|
||||||
|
*.sql text
|
||||||
|
**/Dockerfile text eol=lf
|
||||||
|
|
||||||
|
|
||||||
|
# Archives
|
||||||
|
*.7z binary
|
||||||
|
*.gz binary
|
||||||
|
*.tar binary
|
||||||
|
*.tar.gz binary
|
||||||
|
*.tgz binary
|
||||||
|
*.xz binary
|
||||||
|
*.zip binary
|
||||||
|
|
||||||
|
|
||||||
|
# Native binaries
|
||||||
|
*.dll binary
|
||||||
|
*.dylib binary
|
||||||
|
*.exe binary
|
||||||
|
*.so binary
|
||||||
|
|
||||||
|
|
||||||
|
# Images
|
||||||
|
*.eps binary
|
||||||
|
*.gif binary
|
||||||
|
*.ico binary
|
||||||
|
*.jpg binary
|
||||||
|
*.jpeg binary
|
||||||
|
*.png binary
|
||||||
|
*.svg text
|
||||||
|
*.svgz binary
|
||||||
|
*.tif binary
|
||||||
|
*.tiff binary
|
||||||
|
|
||||||
|
|
||||||
|
# Fonts
|
||||||
|
*.eot binary
|
||||||
|
*.otf binary
|
||||||
|
*.ttf binary
|
||||||
|
*.woff binary
|
||||||
|
|
||||||
|
|
||||||
|
# Java
|
||||||
|
*.gradle text diff=java
|
||||||
|
*.gradle.kts text diff=java
|
||||||
|
*.java text diff=java
|
||||||
|
*.class binary
|
||||||
|
*.ear binary
|
||||||
|
*.jceks binary
|
||||||
|
*.jks binary
|
||||||
|
*.jar binary
|
||||||
|
*.pak binary
|
||||||
|
*.war binary
|
||||||
|
*.jsp text
|
||||||
|
*.jspf text
|
||||||
|
*.jspx text
|
||||||
|
*.tld text
|
||||||
|
*.tag text
|
||||||
|
*.tagx text
|
||||||
|
|
||||||
|
|
||||||
|
# Web
|
||||||
|
*.css text diff=css
|
||||||
|
*.htm text diff=html
|
||||||
|
*.html text diff=html
|
||||||
|
*.js text
|
||||||
|
|
||||||
|
|
||||||
|
# https://git-scm.com/docs/gitattributes#_export_ignore
|
||||||
|
.gitattributes export-ignore
|
||||||
|
.gitignore export-ignore
|
||||||
|
.gitkeep export-ignore
|
||||||
|
|
@ -0,0 +1,16 @@
|
||||||
|
# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
|
||||||
|
version: 2
|
||||||
|
updates:
|
||||||
|
- package-ecosystem: github-actions
|
||||||
|
directory: /
|
||||||
|
schedule:
|
||||||
|
interval: weekly
|
||||||
|
day: monday
|
||||||
|
time: "09:00"
|
||||||
|
commit-message:
|
||||||
|
prefix: fix
|
||||||
|
prefix-development: chore
|
||||||
|
include: scope
|
||||||
|
labels:
|
||||||
|
- gha
|
||||||
|
- dependencies
|
||||||
|
|
@ -0,0 +1,24 @@
|
||||||
|
# Configuration for probot-stale - https://github.com/probot/stale
|
||||||
|
|
||||||
|
# Number of days of inactivity before an issue becomes stale
|
||||||
|
daysUntilStale: 60
|
||||||
|
|
||||||
|
# Number of days of inactivity before a stale issue is closed
|
||||||
|
daysUntilClose: 7
|
||||||
|
|
||||||
|
# Issues with these labels will never be considered stale
|
||||||
|
exemptLabels:
|
||||||
|
- pinned
|
||||||
|
- security
|
||||||
|
|
||||||
|
# Label to use when marking an issue as stale
|
||||||
|
staleLabel: wontfix
|
||||||
|
|
||||||
|
# Comment to post when marking an issue as stale. Set to `false` to disable
|
||||||
|
markComment: >
|
||||||
|
This issue has been automatically marked as stale because it has not had
|
||||||
|
recent activity. It will be closed in 7 days if no further activity occurs.
|
||||||
|
Thank you for your contributions.
|
||||||
|
|
||||||
|
# Comment to post when closing a stale issue. Set to `false` to disable
|
||||||
|
closeComment: false
|
||||||
|
|
@ -0,0 +1,95 @@
|
||||||
|
# SPDX-FileCopyrightText: © Vegard IT GmbH (https://vegardit.com)
|
||||||
|
# SPDX-FileContributor: Sebastian Thomschke
|
||||||
|
# SPDX-License-Identifier: Apache-2.0
|
||||||
|
# SPDX-ArtifactOfProjectHomePage: https://github.com/vegardit/docker-gitea-act-runner
|
||||||
|
#
|
||||||
|
# https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions
|
||||||
|
name: Build
|
||||||
|
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
branches:
|
||||||
|
- '**'
|
||||||
|
tags-ignore:
|
||||||
|
- '**'
|
||||||
|
paths-ignore:
|
||||||
|
- '**/*.md'
|
||||||
|
- '.github/*.yml'
|
||||||
|
schedule:
|
||||||
|
# https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows
|
||||||
|
- cron: '0 17 * * 3'
|
||||||
|
pull_request:
|
||||||
|
workflow_dispatch:
|
||||||
|
# https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/
|
||||||
|
|
||||||
|
env:
|
||||||
|
DOCKER_IMAGE_REPO: vegardit/gitea-act-runner
|
||||||
|
DOCKER_IMAGE_TAG: latest
|
||||||
|
TRIVY_CACHE_DIR: ~/.trivy/cache
|
||||||
|
|
||||||
|
defaults:
|
||||||
|
run:
|
||||||
|
shell: bash
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
build:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: Git Checkout
|
||||||
|
uses: actions/checkout@v3 #https://github.com/actions/checkout
|
||||||
|
|
||||||
|
- name: Cache trivy cache
|
||||||
|
uses: actions/cache@v3
|
||||||
|
if: env.ACT != 'true' # https://github.com/nektos/act#skipping-steps
|
||||||
|
with:
|
||||||
|
path: ${{ env.TRIVY_CACHE_DIR }}
|
||||||
|
# https://github.com/actions/cache/issues/342#issuecomment-673371329
|
||||||
|
key: ${{ runner.os }}-trivy-${{ github.run_id }}
|
||||||
|
restore-keys: |
|
||||||
|
${{ runner.os }}-trivy-
|
||||||
|
|
||||||
|
- name: Configure fast APT repository mirror
|
||||||
|
uses: vegardit/fast-apt-mirror.sh@v1
|
||||||
|
|
||||||
|
- name: Install dos2unix
|
||||||
|
run: sudo apt-get install --no-install-recommends -y dos2unix
|
||||||
|
|
||||||
|
- name: Build ${{ env.DOCKER_IMAGE_REPO }}:${{ env.DOCKER_IMAGE_TAG }}
|
||||||
|
env:
|
||||||
|
DOCKER_REGISTRY: docker.io
|
||||||
|
DOCKER_REGISTRY_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
|
||||||
|
DOCKER_REGISTRY_TOKEN: ${{ secrets.DOCKER_HUB_TOKEN }}
|
||||||
|
TRIVY_GITHUB_TOKEN: ${{ github.token }}
|
||||||
|
run: |
|
||||||
|
if [[ $GITHUB_REF_NAME == "main" && $ACT != "true" ]]; then
|
||||||
|
export DOCKER_PUSH=1
|
||||||
|
echo "$DOCKER_REGISTRY_TOKEN" | docker login -u="$DOCKER_REGISTRY_USERNAME" "$DOCKER_REGISTRY" --password-stdin
|
||||||
|
fi
|
||||||
|
bash build-image.sh
|
||||||
|
|
||||||
|
- name: Publish Docker image to GH registry
|
||||||
|
if: ${{ github.ref_name == 'main' && !env.ACT }} # https://github.com/nektos/act#skipping-steps
|
||||||
|
run: |
|
||||||
|
set -eux
|
||||||
|
|
||||||
|
echo "${{ github.token }}" | docker login https://ghcr.io -u ${{ github.actor }} --password-stdin
|
||||||
|
|
||||||
|
docker image tag $DOCKER_IMAGE_REPO ghcr.io/$DOCKER_IMAGE_REPO
|
||||||
|
docker push ghcr.io/$DOCKER_IMAGE_REPO
|
||||||
|
|
||||||
|
- name: Delete untagged images
|
||||||
|
uses: actions/github-script@v6
|
||||||
|
if: ${{ github.ref_name == 'main' && !env.ACT }} # https://github.com/nektos/act#skipping-steps
|
||||||
|
with:
|
||||||
|
github-token: ${{ secrets.GHA_DELETE_PACKAGES }}
|
||||||
|
script: |
|
||||||
|
const imageName = /[^/]*$/.exec(process.env.DOCKER_IMAGE_REPO)[0]
|
||||||
|
const basePath = `/orgs/${{ github.repository_owner }}/packages/container/${imageName}/versions`
|
||||||
|
for (version of (await github.request(`GET ${basePath}`, { per_page: 100 })).data) {
|
||||||
|
if (version.metadata.container.tags.length == 0) {
|
||||||
|
console.log(`deleting ${version.name}...`)
|
||||||
|
const delResponse = await github.request(`DELETE ${basePath}/${version.id}`)
|
||||||
|
console.log(`status: ${delResponse.status}`)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,37 @@
|
||||||
|
# Local work folder that is not checked in
|
||||||
|
_LOCAL/
|
||||||
|
|
||||||
|
.shared
|
||||||
|
|
||||||
|
# Eclipse
|
||||||
|
.apt_generated/
|
||||||
|
.checkstyle
|
||||||
|
.classpath
|
||||||
|
.factorypath
|
||||||
|
.project
|
||||||
|
.settings/
|
||||||
|
bin/
|
||||||
|
**/.*.md.html
|
||||||
|
|
||||||
|
# IntelliJ
|
||||||
|
.idea
|
||||||
|
*.iml
|
||||||
|
*.ipr
|
||||||
|
*.iws
|
||||||
|
|
||||||
|
# NetBeans
|
||||||
|
nb-configuration.xml
|
||||||
|
|
||||||
|
# Visual Studio Code
|
||||||
|
.vscode
|
||||||
|
|
||||||
|
# OSX
|
||||||
|
.DS_Store
|
||||||
|
|
||||||
|
# Vim
|
||||||
|
*.swo
|
||||||
|
*.swp
|
||||||
|
|
||||||
|
# patch
|
||||||
|
*.orig
|
||||||
|
*.rej
|
||||||
|
|
@ -0,0 +1,128 @@
|
||||||
|
# Contributor Covenant Code of Conduct
|
||||||
|
|
||||||
|
## Our Pledge
|
||||||
|
|
||||||
|
We as members, contributors, and leaders pledge to make participation in our
|
||||||
|
community a harassment-free experience for everyone, regardless of age, body
|
||||||
|
size, visible or invisible disability, ethnicity, sex characteristics, gender
|
||||||
|
identity and expression, level of experience, education, socio-economic status,
|
||||||
|
nationality, personal appearance, race, religion, or sexual identity
|
||||||
|
and orientation.
|
||||||
|
|
||||||
|
We pledge to act and interact in ways that contribute to an open, welcoming,
|
||||||
|
diverse, inclusive, and healthy community.
|
||||||
|
|
||||||
|
## Our Standards
|
||||||
|
|
||||||
|
Examples of behavior that contributes to a positive environment for our
|
||||||
|
community include:
|
||||||
|
|
||||||
|
* Demonstrating empathy and kindness toward other people
|
||||||
|
* Being respectful of differing opinions, viewpoints, and experiences
|
||||||
|
* Giving and gracefully accepting constructive feedback
|
||||||
|
* Accepting responsibility and apologizing to those affected by our mistakes,
|
||||||
|
and learning from the experience
|
||||||
|
* Focusing on what is best not just for us as individuals, but for the
|
||||||
|
overall community
|
||||||
|
|
||||||
|
Examples of unacceptable behavior include:
|
||||||
|
|
||||||
|
* The use of sexualized language or imagery, and sexual attention or
|
||||||
|
advances of any kind
|
||||||
|
* Trolling, insulting or derogatory comments, and personal or political attacks
|
||||||
|
* Public or private harassment
|
||||||
|
* Publishing others' private information, such as a physical or email
|
||||||
|
address, without their explicit permission
|
||||||
|
* Other conduct which could reasonably be considered inappropriate in a
|
||||||
|
professional setting
|
||||||
|
|
||||||
|
## Enforcement Responsibilities
|
||||||
|
|
||||||
|
Community leaders are responsible for clarifying and enforcing our standards of
|
||||||
|
acceptable behavior and will take appropriate and fair corrective action in
|
||||||
|
response to any behavior that they deem inappropriate, threatening, offensive,
|
||||||
|
or harmful.
|
||||||
|
|
||||||
|
Community leaders have the right and responsibility to remove, edit, or reject
|
||||||
|
comments, commits, code, wiki edits, issues, and other contributions that are
|
||||||
|
not aligned to this Code of Conduct, and will communicate reasons for moderation
|
||||||
|
decisions when appropriate.
|
||||||
|
|
||||||
|
## Scope
|
||||||
|
|
||||||
|
This Code of Conduct applies within all community spaces, and also applies when
|
||||||
|
an individual is officially representing the community in public spaces.
|
||||||
|
Examples of representing our community include using an official e-mail address,
|
||||||
|
posting via an official social media account, or acting as an appointed
|
||||||
|
representative at an online or offline event.
|
||||||
|
|
||||||
|
## Enforcement
|
||||||
|
|
||||||
|
Instances of abusive, harassing, or otherwise unacceptable behavior may be
|
||||||
|
reported to the community leaders responsible for enforcement at
|
||||||
|
https://vegardit.com/about/legal/.
|
||||||
|
All complaints will be reviewed and investigated promptly and fairly.
|
||||||
|
|
||||||
|
All community leaders are obligated to respect the privacy and security of the
|
||||||
|
reporter of any incident.
|
||||||
|
|
||||||
|
## Enforcement Guidelines
|
||||||
|
|
||||||
|
Community leaders will follow these Community Impact Guidelines in determining
|
||||||
|
the consequences for any action they deem in violation of this Code of Conduct:
|
||||||
|
|
||||||
|
### 1. Correction
|
||||||
|
|
||||||
|
**Community Impact**: Use of inappropriate language or other behavior deemed
|
||||||
|
unprofessional or unwelcome in the community.
|
||||||
|
|
||||||
|
**Consequence**: A private, written warning from community leaders, providing
|
||||||
|
clarity around the nature of the violation and an explanation of why the
|
||||||
|
behavior was inappropriate. A public apology may be requested.
|
||||||
|
|
||||||
|
### 2. Warning
|
||||||
|
|
||||||
|
**Community Impact**: A violation through a single incident or series
|
||||||
|
of actions.
|
||||||
|
|
||||||
|
**Consequence**: A warning with consequences for continued behavior. No
|
||||||
|
interaction with the people involved, including unsolicited interaction with
|
||||||
|
those enforcing the Code of Conduct, for a specified period of time. This
|
||||||
|
includes avoiding interactions in community spaces as well as external channels
|
||||||
|
like social media. Violating these terms may lead to a temporary or
|
||||||
|
permanent ban.
|
||||||
|
|
||||||
|
### 3. Temporary Ban
|
||||||
|
|
||||||
|
**Community Impact**: A serious violation of community standards, including
|
||||||
|
sustained inappropriate behavior.
|
||||||
|
|
||||||
|
**Consequence**: A temporary ban from any sort of interaction or public
|
||||||
|
communication with the community for a specified period of time. No public or
|
||||||
|
private interaction with the people involved, including unsolicited interaction
|
||||||
|
with those enforcing the Code of Conduct, is allowed during this period.
|
||||||
|
Violating these terms may lead to a permanent ban.
|
||||||
|
|
||||||
|
### 4. Permanent Ban
|
||||||
|
|
||||||
|
**Community Impact**: Demonstrating a pattern of violation of community
|
||||||
|
standards, including sustained inappropriate behavior, harassment of an
|
||||||
|
individual, or aggression toward or disparagement of classes of individuals.
|
||||||
|
|
||||||
|
**Consequence**: A permanent ban from any sort of public interaction within
|
||||||
|
the community.
|
||||||
|
|
||||||
|
## Attribution
|
||||||
|
|
||||||
|
This Code of Conduct is adapted from the [Contributor Covenant][homepage],
|
||||||
|
version 2.0, available at
|
||||||
|
https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
|
||||||
|
|
||||||
|
Community Impact Guidelines were inspired by [Mozilla's code of conduct
|
||||||
|
enforcement ladder](https://github.com/mozilla/diversity).
|
||||||
|
|
||||||
|
[homepage]: https://www.contributor-covenant.org
|
||||||
|
|
||||||
|
For answers to common questions about this code of conduct, see the FAQ at
|
||||||
|
https://www.contributor-covenant.org/faq. Translations are available at
|
||||||
|
https://www.contributor-covenant.org/translations.
|
||||||
|
|
@ -0,0 +1,25 @@
|
||||||
|
# Contributing
|
||||||
|
|
||||||
|
Thanks for your interest in contributing to this project!
|
||||||
|
|
||||||
|
We want to make contributing as easy and transparent as possible.
|
||||||
|
|
||||||
|
|
||||||
|
## Code of Conduct
|
||||||
|
|
||||||
|
Our code of conduct is described in [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md).
|
||||||
|
|
||||||
|
|
||||||
|
## Issues
|
||||||
|
|
||||||
|
We use GitHub issues to track bugs and feature requests. Please ensure your description is clear and has sufficient instructions to be able to reproduce the issue.
|
||||||
|
|
||||||
|
|
||||||
|
## Pull Requests
|
||||||
|
|
||||||
|
Before you make a substantial pull request, please file an issue and make sure someone from the team agrees that there is a problem or room for improvement.
|
||||||
|
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
By contributing your code, you agree to license your contribution under the [Apache License 2.0](LICENSE.txt).
|
||||||
61
README.md
61
README.md
|
|
@ -1 +1,60 @@
|
||||||
# docker-gitea-act-runner
|
# vegardit/gitea-act-runner <a href="https://github.com/vegardit/docker-gitea-act-runner/" title="GitHub Repo"><img height="30" src="https://raw.githubusercontent.com/simple-icons/simple-icons/develop/icons/github.svg?sanitize=true"></a>
|
||||||
|
|
||||||
|
[](https://github.com/vegardit/docker-gitea-act-runner/actions?query=workflow%3ABuild)
|
||||||
|
[](#license)
|
||||||
|
[](https://hub.docker.com/r/vegardit/gitea-act-runner)
|
||||||
|
[](https://hub.docker.com/r/vegardit/gitea-act-runner)
|
||||||
|
[](CODE_OF_CONDUCT.md)
|
||||||
|
|
||||||
|
1. [What is it?](#what-is-it)
|
||||||
|
1. [License](#license)
|
||||||
|
|
||||||
|
|
||||||
|
## <a name="what-is-it"></a>What is it?
|
||||||
|
|
||||||
|
`debian:stable-slim` based Docker image containing [Gitea](https://gitea.com)'s [act_runner](https://gitea.com/gitea/act_runner/)
|
||||||
|
|
||||||
|
|
||||||
|
## Usage
|
||||||
|
|
||||||
|
Example `docker-compose.yml`:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
version: '3.8' # https://docs.docker.com/compose/compose-file/compose-versioning/
|
||||||
|
|
||||||
|
services:
|
||||||
|
|
||||||
|
gitea_act_runner:
|
||||||
|
image: vegardit/gitea-act-runner:latest
|
||||||
|
#image: ghcr.io/vegardit/gitea-act-runner:latest
|
||||||
|
volumes:
|
||||||
|
- /var/run/docker.sock:/var/run/docker.sock:rw
|
||||||
|
- /my/path/to/data/dir:/data:rw # the config file is located at /data/.runner and needs to survive container restarts
|
||||||
|
environment:
|
||||||
|
TZ: "Europe/Berlin"
|
||||||
|
# config parameters for initial runner registration:
|
||||||
|
GITEA_INSTANCE_URL: 'https://gitea.example.com' # required
|
||||||
|
GITEA_INSTANCE_INSECURE: '0' # optional, default is 0
|
||||||
|
GITEA_RUNNER_REGISTRATION_TOKEN_FILE: 'path/to/file' # only required on first container start
|
||||||
|
# or: GITEA_RUNNER_REGISTRATION_TOKEN: '<INSERT_TOKEN_HERE>'
|
||||||
|
GITEA_RUNNER_NAME: '' # optional, defaults to the container's hostname
|
||||||
|
GITEA_RUNNER_LABELS: '' # optional
|
||||||
|
GITEA_RUNNER_UID: 1200 # optional, default is 1000
|
||||||
|
GITEA_RUNNER_GID: 1200 # optional, default is 1000
|
||||||
|
deploy:
|
||||||
|
restart_policy:
|
||||||
|
condition: on-failure
|
||||||
|
delay: 5s
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
## <a name="license"></a>License
|
||||||
|
|
||||||
|
All files in this repository are released under the [Apache License 2.0](LICENSE.txt).
|
||||||
|
|
||||||
|
Individual files contain the following tag instead of the full license text:
|
||||||
|
```
|
||||||
|
SPDX-License-Identifier: Apache-2.0
|
||||||
|
```
|
||||||
|
|
||||||
|
This enables machine processing of license information based on the SPDX License Identifiers that are available here: https://spdx.org/licenses/.
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,61 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
#
|
||||||
|
# SPDX-FileCopyrightText: © Vegard IT GmbH (https://vegardit.com)
|
||||||
|
# SPDX-FileContributor: Sebastian Thomschke
|
||||||
|
# SPDX-License-Identifier: Apache-2.0
|
||||||
|
# SPDX-ArtifactOfProjectHomePage: https://github.com/vegardit/docker-gitea-act-runner
|
||||||
|
#
|
||||||
|
|
||||||
|
shared_lib="$(dirname $0)/.shared"
|
||||||
|
[ -e "$shared_lib" ] || curl -sSf https://raw.githubusercontent.com/vegardit/docker-shared/v1/download.sh?_=$(date +%s) | bash -s v1 "$shared_lib" || exit 1
|
||||||
|
source "$shared_lib/lib/build-image-init.sh"
|
||||||
|
|
||||||
|
|
||||||
|
#################################################
|
||||||
|
# specify target docker registry/repo
|
||||||
|
#################################################
|
||||||
|
docker_registry=${DOCKER_REGISTRY:-docker.io}
|
||||||
|
image_repo=${DOCKER_REPO:-vegardit/gitea-act-runner}
|
||||||
|
image_name=$image_repo:${DOCKER_IMAGE_TAG:-latest}
|
||||||
|
|
||||||
|
|
||||||
|
#################################################
|
||||||
|
# build the image
|
||||||
|
#################################################
|
||||||
|
echo "Building docker image [$image_name]..."
|
||||||
|
if [[ $OSTYPE == "cygwin" || $OSTYPE == "msys" ]]; then
|
||||||
|
project_root=$(cygpath -w "$project_root")
|
||||||
|
fi
|
||||||
|
|
||||||
|
DOCKER_BUILDKIT=1 docker build "$project_root" \
|
||||||
|
--file "image/Dockerfile" \
|
||||||
|
--progress=plain \
|
||||||
|
--pull \
|
||||||
|
--build-arg INSTALL_SUPPORT_TOOLS=${INSTALL_SUPPORT_TOOLS:-0} \
|
||||||
|
`# using the current date as value for BASE_LAYER_CACHE_KEY, i.e. the base layer cache (that holds system packages with security updates) will be invalidate once per day` \
|
||||||
|
--build-arg BASE_LAYER_CACHE_KEY=$base_layer_cache_key \
|
||||||
|
--build-arg BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ") \
|
||||||
|
--build-arg GIT_BRANCH="${GIT_BRANCH:-$(git rev-parse --abbrev-ref HEAD)}" \
|
||||||
|
--build-arg GIT_COMMIT_DATE="$(date -d @$(git log -1 --format='%at') --utc +'%Y-%m-%d %H:%M:%S UTC')" \
|
||||||
|
--build-arg GIT_COMMIT_HASH="$(git rev-parse --short HEAD)" \
|
||||||
|
--build-arg GIT_REPO_URL="$(git config --get remote.origin.url)" \
|
||||||
|
-t $image_name \
|
||||||
|
"$@"
|
||||||
|
|
||||||
|
|
||||||
|
#################################################
|
||||||
|
# perform security audit
|
||||||
|
#################################################
|
||||||
|
if [[ "${DOCKER_AUDIT_IMAGE:-1}" == 1 ]]; then
|
||||||
|
bash "$shared_lib/cmd/audit-image.sh" $image_name
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
#################################################
|
||||||
|
# push image with tags to remote docker image registry
|
||||||
|
#################################################
|
||||||
|
if [[ "${DOCKER_PUSH:-0}" == "1" ]]; then
|
||||||
|
docker image tag $image_name $docker_registry/$image_name
|
||||||
|
|
||||||
|
docker push $docker_registry/$image_name
|
||||||
|
fi
|
||||||
|
|
@ -0,0 +1,162 @@
|
||||||
|
#syntax=docker/dockerfile:1.4
|
||||||
|
# see https://github.com/moby/buildkit/blob/master/frontend/dockerfile/docs/syntax.md
|
||||||
|
# see https://docs.docker.com/engine/reference/builder/#syntax
|
||||||
|
#
|
||||||
|
# SPDX-FileCopyrightText: © Vegard IT GmbH (https://vegardit.com)
|
||||||
|
# SPDX-FileContributor: Sebastian Thomschke
|
||||||
|
# SPDX-License-Identifier: Apache-2.0
|
||||||
|
# SPDX-ArtifactOfProjectHomePage: https://github.com/vegardit/docker-gitea-act-runner
|
||||||
|
#
|
||||||
|
# https://hub.docker.com/_/debian?tab=tags&name=stable-slim
|
||||||
|
|
||||||
|
######################
|
||||||
|
# runtime image base
|
||||||
|
######################
|
||||||
|
FROM debian:stable-slim as runtime-base-image
|
||||||
|
|
||||||
|
LABEL maintainer="Vegard IT GmbH (vegardit.com)"
|
||||||
|
|
||||||
|
USER root
|
||||||
|
|
||||||
|
SHELL ["/bin/bash", "-c"]
|
||||||
|
|
||||||
|
ARG BASE_LAYER_CACHE_KEY
|
||||||
|
ARG DEBIAN_FRONTEND=noninteractive
|
||||||
|
ARG LC_ALL=C
|
||||||
|
|
||||||
|
RUN --mount=type=bind,source=.shared,target=/mnt/shared <<EOF
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
/mnt/shared/cmd/debian-install-os-updates.sh
|
||||||
|
/mnt/shared/cmd/debian-install-support-tools.sh
|
||||||
|
|
||||||
|
echo "#################################################"
|
||||||
|
echo "Installing ca-certificates, tini..."
|
||||||
|
echo "#################################################"
|
||||||
|
apt-get install --no-install-recommends -y ca-certificates sudo tini
|
||||||
|
|
||||||
|
echo "#################################################"
|
||||||
|
echo "Adding [act] user..."
|
||||||
|
echo "#################################################"
|
||||||
|
addgroup --gid 1000 act
|
||||||
|
adduser --uid 1000 --ingroup act --home /data --shell /bin/bash --disabled-password --gecos "" act
|
||||||
|
adduser act sudo
|
||||||
|
echo '%sudo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
|
||||||
|
|
||||||
|
/mnt/shared/cmd/debian-cleanup.sh
|
||||||
|
|
||||||
|
EOF
|
||||||
|
|
||||||
|
|
||||||
|
######################
|
||||||
|
# build image
|
||||||
|
######################
|
||||||
|
|
||||||
|
# https://hub.docker.com/_/python?tab=tags&name=3-slim
|
||||||
|
FROM debian:stable-slim AS build-image
|
||||||
|
|
||||||
|
USER root
|
||||||
|
|
||||||
|
SHELL ["/bin/bash", "-c"]
|
||||||
|
|
||||||
|
ARG BASE_LAYER_CACHE_KEY
|
||||||
|
ARG DEBIAN_FRONTEND=noninteractive
|
||||||
|
ARG LC_ALL=C
|
||||||
|
ARG INSTALL_SUPPORT_TOOLS=0
|
||||||
|
|
||||||
|
ARG ACT_RUNNER_DOWNLOAD_URL=https://dl.gitea.com/act_runner/main/act_runner-main-linux-amd64
|
||||||
|
ARG UPX_COMPRESS=true
|
||||||
|
|
||||||
|
RUN --mount=type=bind,source=.shared,target=/mnt/shared <<EOF
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
/mnt/shared/cmd/debian-install-os-updates.sh
|
||||||
|
|
||||||
|
echo "#################################################"
|
||||||
|
echo "Installing tools..."
|
||||||
|
echo "#################################################"
|
||||||
|
apt-get install --no-install-recommends -y binutils ca-certificates curl xz-utils
|
||||||
|
|
||||||
|
if [[ $UPX_COMPRESS == "true" ]]; then
|
||||||
|
echo "#################################################"
|
||||||
|
echo "Downloading UPX..."
|
||||||
|
echo "#################################################"
|
||||||
|
mkdir /opt/upx
|
||||||
|
upx_download_url=$(curl -fsSL https://api.github.com/repos/upx/upx/releases/latest | grep browser_download_url | grep amd64_linux.tar.xz | cut "-d\"" -f4)
|
||||||
|
echo "Downloading [$upx_download_url]..."
|
||||||
|
curl -fL $upx_download_url | tar Jxv -C /opt/upx --strip-components=1
|
||||||
|
/opt/upx/upx --version
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "#################################################"
|
||||||
|
echo "Downloading Gitea act runner..."
|
||||||
|
echo "#################################################"
|
||||||
|
mkdir /opt/act
|
||||||
|
curl -fsSL $ACT_RUNNER_DOWNLOAD_URL -o /opt/act/runner
|
||||||
|
chmod 755 /opt/act/runner
|
||||||
|
ls -l /opt/act/runner
|
||||||
|
echo "Stripping..."
|
||||||
|
strip --strip-unneeded /opt/act/runner
|
||||||
|
ls -l /opt/act/runner
|
||||||
|
if [[ $UPX_COMPRESS == "true" ]]; then
|
||||||
|
/opt/upx/upx -9 /opt/act/runner
|
||||||
|
fi
|
||||||
|
/opt/act/runner --version
|
||||||
|
|
||||||
|
EOF
|
||||||
|
|
||||||
|
|
||||||
|
######################
|
||||||
|
# runtime image
|
||||||
|
######################
|
||||||
|
FROM runtime-base-image
|
||||||
|
COPY --from=build-image /opt/act/runner /opt/act/runner
|
||||||
|
|
||||||
|
ARG BUILD_DATE
|
||||||
|
ARG GIT_BRANCH
|
||||||
|
ARG GIT_COMMIT_HASH
|
||||||
|
ARG GIT_COMMIT_DATE
|
||||||
|
ARG GIT_REPO_URL
|
||||||
|
|
||||||
|
LABEL \
|
||||||
|
org.label-schema.schema-version="1.0" \
|
||||||
|
org.label-schema.build-date=$BUILD_DATE \
|
||||||
|
org.label-schema.vcs-ref=$GIT_COMMIT_HASH \
|
||||||
|
org.label-schema.vcs-url=$GIT_REPO_URL
|
||||||
|
|
||||||
|
# Default configuration: can be overridden at the docker command line
|
||||||
|
ENV \
|
||||||
|
INIT_SH_FILE='' \
|
||||||
|
#
|
||||||
|
GITEA_RUNNER_NAME='' \
|
||||||
|
GITEA_RUNNER_LABELS='' \
|
||||||
|
GITEA_INSTANCE_INSECURE=0 \
|
||||||
|
GITEA_RUNNER_UID=1000 \
|
||||||
|
GITEA_RUNNER_GID=1000
|
||||||
|
|
||||||
|
RUN <<EOF
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
echo "#################################################"
|
||||||
|
echo "Writing build_info..."
|
||||||
|
echo "#################################################"
|
||||||
|
echo -e "
|
||||||
|
GIT_REPO: $GIT_REPO_URL
|
||||||
|
GIT_BRANCH: $GIT_BRANCH
|
||||||
|
GIT_COMMIT: $GIT_COMMIT_HASH @ $GIT_COMMIT_DATE
|
||||||
|
IMAGE_BUILD: $BUILD_DATE" >/opt/build_info
|
||||||
|
cat /opt/build_info
|
||||||
|
|
||||||
|
EOF
|
||||||
|
|
||||||
|
COPY image/*.sh /opt/
|
||||||
|
COPY .shared/lib/bash-init.sh /opt/bash-init.sh
|
||||||
|
|
||||||
|
USER act
|
||||||
|
|
||||||
|
VOLUME [ "/data" ]
|
||||||
|
|
||||||
|
ENTRYPOINT ["/usr/bin/tini", "--"]
|
||||||
|
|
||||||
|
CMD ["/bin/bash", "/opt/run.sh"]
|
||||||
|
|
@ -0,0 +1,68 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
#
|
||||||
|
# SPDX-FileCopyrightText: © Vegard IT GmbH (https://vegardit.com)
|
||||||
|
# SPDX-FileContributor: Sebastian Thomschke
|
||||||
|
# SPDX-License-Identifier: Apache-2.0
|
||||||
|
# SPDX-ArtifactOfProjectHomePage: https://github.com/vegardit/docker-gitea-act-runner
|
||||||
|
#
|
||||||
|
|
||||||
|
source /opt/bash-init.sh
|
||||||
|
|
||||||
|
#################################################
|
||||||
|
# print header
|
||||||
|
#################################################
|
||||||
|
cat <<'EOF'
|
||||||
|
_____ _ _ _ _____
|
||||||
|
/ ____(_) | /\ | | | __ \
|
||||||
|
| | __ _| |_ ___ __ _ / \ ___| |_ | |__) | _ _ __ _ __ ___ _ __
|
||||||
|
| | |_ | | __/ _ \/ _` | / /\ \ / __| __| | _ / | | | '_ \| '_ \ / _ \ '__|
|
||||||
|
| |__| | | || __/ (_| | / ____ \ (__| |_ | | \ \ |_| | | | | | | | __/ |
|
||||||
|
\_____|_|\__\___|\__,_| /_/ \_\___|\__| |_| \_\__,_|_| |_|_| |_|\___|_|
|
||||||
|
EOF
|
||||||
|
|
||||||
|
cat /opt/build_info
|
||||||
|
echo
|
||||||
|
|
||||||
|
log INFO "Timezone is $(date +"%Z %z")"
|
||||||
|
log INFO "Hostname: $(hostname -f)"
|
||||||
|
log INFO "IP Addresses: "
|
||||||
|
awk '/32 host/ { if(uniq[ip]++ && ip != "127.0.0.1") print " - " ip } {ip=$2}' /proc/net/fib_trie
|
||||||
|
|
||||||
|
|
||||||
|
#################################################################
|
||||||
|
# Adjust UID/GID and file permissions based on env var config
|
||||||
|
#################################################################
|
||||||
|
if [ -n "${GITEA_RUNNER_UID:-}" ]; then
|
||||||
|
effective_uid=$(id -u act)
|
||||||
|
if [ "$GITEA_RUNNER_UID" != "$effective_uid" ]; then
|
||||||
|
log INFO "Changing UID of user [act] from $effective_uid to $GITEA_RUNNER_UID..."
|
||||||
|
sudo usermod -o -u "$GITEA_RUNNER_UID" act
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
if [ -n "${GITEA_RUNNER_GID:-}" ]; then
|
||||||
|
effective_gid=$(id -g act)
|
||||||
|
if [ "$GITEA_RUNNER_GID" != "$effective_gid" ]; then
|
||||||
|
log INFO "Changing GID of user [act] from $effective_gid to $GITEA_RUNNER_GID..."
|
||||||
|
sudo usermod -o -u "$GITEA_RUNNER_GID" act
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
sudo chown -R act:act /data
|
||||||
|
|
||||||
|
docker_group=$(stat -c '%G' /var/run/docker.sock)
|
||||||
|
if [[ $docker_group == "UNKNOWN" ]]; then
|
||||||
|
docker_gid=$(stat -c '%g' /var/run/docker.sock)
|
||||||
|
docker_group="docker$docker_gid"
|
||||||
|
log INFO "Creating group [$docker_group]..."
|
||||||
|
sudo addgroup --gid $docker_gid $docker_group
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! id -nG act | grep -qw "$docker_group"; then
|
||||||
|
log INFO "Adding user [act] to group [$docker_group]..."
|
||||||
|
sudo usermod -aG $docker_group act
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
#################################################################
|
||||||
|
# Launch the runner with adjusted UID/GID
|
||||||
|
#################################################################
|
||||||
|
exec sudo -u act -g act -E bash /opt/run_runner.sh
|
||||||
|
|
@ -0,0 +1,46 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
#
|
||||||
|
# SPDX-FileCopyrightText: © Vegard IT GmbH (https://vegardit.com)
|
||||||
|
# SPDX-FileContributor: Sebastian Thomschke
|
||||||
|
# SPDX-License-Identifier: Apache-2.0
|
||||||
|
# SPDX-ArtifactOfProjectHomePage: https://github.com/vegardit/docker-gitea-act-runner
|
||||||
|
#
|
||||||
|
source /opt/bash-init.sh
|
||||||
|
|
||||||
|
log INFO "Effective user: $(id)"
|
||||||
|
|
||||||
|
cd /data
|
||||||
|
|
||||||
|
#################################################
|
||||||
|
# load custom init script if specified
|
||||||
|
#################################################
|
||||||
|
if [[ -f $INIT_SH_FILE ]]; then
|
||||||
|
log INFO "Loading [$INIT_SH_FILE]..."
|
||||||
|
source "$INIT_SH_FILE"
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
#################################################
|
||||||
|
# register act runner if required
|
||||||
|
#################################################
|
||||||
|
if [[ ! -s .runner ]]; then
|
||||||
|
if [[ ${GITEA_INSTANCE_INSECURE:-} == '1' ]]; then
|
||||||
|
insecure_flag=--insecure
|
||||||
|
fi
|
||||||
|
if [[ -z ${GITEA_RUNNER_REGISTRATION_TOKEN:-} ]]; then
|
||||||
|
read -r GITEA_RUNNER_REGISTRATION_TOKEN < "$GITEA_RUNNER_REGISTRATION_TOKEN_FILE"
|
||||||
|
fi
|
||||||
|
/opt/act/runner register \
|
||||||
|
--instance "${GITEA_INSTANCE_URL}" \
|
||||||
|
--token "${GITEA_RUNNER_REGISTRATION_TOKEN}" \
|
||||||
|
--name "${GITEA_RUNNER_NAME}" \
|
||||||
|
--labels "${GITEA_RUNNER_LABELS}" \
|
||||||
|
$( [[ ${GITEA_INSTANCE_INSECURE:-} == '1' ]] && echo "--insecure" || true) \
|
||||||
|
--no-interactive
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
#################################################
|
||||||
|
# run the act runner
|
||||||
|
#################################################
|
||||||
|
exec /opt/act/runner daemon
|
||||||
Loading…
Reference in New Issue