Gitea workflow: build ipcrd on IPCR Forge (runs-on: ipcr → staging → IPFS); listings → ipcr 1.6.1, ipcr-forge 0.6.3
ipcr / image (push) Successful in 4m55s
ipcr / image (push) Successful in 4m55s
This commit is contained in:
Worph
@@ -0,0 +1,43 @@
|
||||
# IPCR Forge: builds ipcrd's image (the Dockerfile at the root) for every v* tag pushed to this repository's Gitea copy, and pushes it
|
||||
# to the forge's staging registry; IPCR imports it from there within a minute and publishes it on
|
||||
# IPFS under the forge's name (<forge>/ipcr/ipcr).
|
||||
#
|
||||
# GitHub ignores .gitea/ (it runs .github/workflows/image.yml → ghcr.io), and Gitea ignores
|
||||
# .github/ as soon as this folder exists: one repository, one workflow on each side.
|
||||
#
|
||||
# runs-on: ipcr the forge's own runner, the only one that reaches the staging registry
|
||||
# localhost:5000 that registry, logged in to as this repository (IPCR_PUSH_TOKEN, a
|
||||
# secret the forge sets on every repository allowed to publish)
|
||||
# network=host so buildx's builder can reach it too
|
||||
name: ipcr
|
||||
on:
|
||||
push:
|
||||
tags: ['v*']
|
||||
jobs:
|
||||
image:
|
||||
runs-on: ipcr
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: docker/login-action@v3
|
||||
with:
|
||||
registry: localhost:5000
|
||||
username: ${{ github.repository }}
|
||||
password: ${{ secrets.IPCR_PUSH_TOKEN }}
|
||||
- uses: docker/metadata-action@v5
|
||||
id: meta
|
||||
with:
|
||||
images: localhost:5000/${{ github.repository }}
|
||||
tags: |
|
||||
type=semver,pattern={{version}}
|
||||
type=semver,pattern={{major}}.{{minor}}
|
||||
type=raw,value=latest
|
||||
- uses: docker/setup-buildx-action@v3
|
||||
with:
|
||||
driver-opts: network=host
|
||||
- uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
push: true
|
||||
tags: ${{ steps.meta.outputs.tags }}
|
||||
labels: ${{ steps.meta.outputs.labels }}
|
||||
build-args: VERSION=${{ steps.meta.outputs.version }}
|
||||
@@ -35,7 +35,7 @@ services:
|
||||
# with the stock `rad` CLI against the node's own home. Serves the forge's page on :8080.
|
||||
# Its install step (forge-setup, below) mints its Gitea token and registers the webhook.
|
||||
ipcr-forge:
|
||||
image: ghcr.io/yundera/ipcr-forge:0.6.2
|
||||
image: ghcr.io/yundera/ipcr-forge:0.6.3
|
||||
container_name: ipcr-forge
|
||||
user: $PUID:$PGID
|
||||
read_only: true
|
||||
@@ -285,7 +285,7 @@ services:
|
||||
# push that name only; IPCR logs in as the importer (state/staging-auth, which it generates).
|
||||
# Same image as the forge service (`ipcr-forge gate`, forge/gate.go in ipcr-forge). See rationale.md.
|
||||
forge-gate:
|
||||
image: ghcr.io/yundera/ipcr-forge:0.6.2
|
||||
image: ghcr.io/yundera/ipcr-forge:0.6.3
|
||||
container_name: forge-gate
|
||||
user: $PUID:$PGID
|
||||
read_only: true
|
||||
@@ -479,7 +479,7 @@ services:
|
||||
# ipcrd: TLS front door on 127.0.0.1:4767. Passes /ipfs/<cid> through to the stock nerdctl
|
||||
# registry below, resolves /ipns/<name>:<tag> itself, and pins every image it serves.
|
||||
ipcr-gateway:
|
||||
image: ghcr.io/yundera/ipcr:1.6.0
|
||||
image: ghcr.io/yundera/ipcr:1.6.1
|
||||
container_name: ipcr-gateway
|
||||
# Root for one reason: it writes its CA into the host's Docker trust store (the narrow
|
||||
# bind below), which is root-owned. See rationale.md.
|
||||
@@ -567,7 +567,7 @@ services:
|
||||
# then works on any machine, without IPCR. A pull here pins nothing. The admin pages switch it
|
||||
# off (config.json "public": false). Not on the admin or CI networks. See rationale.md.
|
||||
ipcr-public:
|
||||
image: ghcr.io/yundera/ipcr:1.6.0
|
||||
image: ghcr.io/yundera/ipcr:1.6.1
|
||||
container_name: ipcr-public
|
||||
user: $PUID:$PGID
|
||||
read_only: true
|
||||
@@ -615,7 +615,7 @@ services:
|
||||
# ── Stock nerdctl IPFS registry ─────────────────────────────────────────────
|
||||
# `nerdctl ipfs registry serve`, unmodified: translates the registry API into IPFS reads.
|
||||
ipcr-registry:
|
||||
image: ghcr.io/yundera/ipcr:1.6.0
|
||||
image: ghcr.io/yundera/ipcr:1.6.1
|
||||
container_name: ipcr-registry
|
||||
# Root because nerdctl run as any other uid assumes rootless mode and refuses to start
|
||||
# without a rootless containerd — which `ipfs registry serve` never uses. The service has
|
||||
@@ -980,7 +980,7 @@ x-compose-app:
|
||||
# the example repository (in that organisation). Idempotent, so on every start: it repairs the webhook.
|
||||
# The admin password is used here only, never stored.
|
||||
- name: forge-setup
|
||||
image: ghcr.io/yundera/ipcr-forge:0.6.2
|
||||
image: ghcr.io/yundera/ipcr-forge:0.6.3
|
||||
user: $PUID:$PGID
|
||||
phase: post_up
|
||||
network: $APP_NET
|
||||
|
||||
@@ -39,7 +39,7 @@ services:
|
||||
# with the stock `rad` CLI against the node's own home. Serves the forge's page on :8080.
|
||||
# Its install step (forge-setup, below) mints its Gitea token and registers the webhook.
|
||||
ipcr-forge:
|
||||
image: ghcr.io/yundera/ipcr-forge:0.6.2
|
||||
image: ghcr.io/yundera/ipcr-forge:0.6.3
|
||||
container_name: ipcr-forge
|
||||
user: $PUID:$PGID
|
||||
read_only: true
|
||||
@@ -210,7 +210,7 @@ services:
|
||||
# push that name only; IPCR logs in as the importer (state/staging-auth, which it generates).
|
||||
# Same image as the forge service (`ipcr-forge gate`, forge/gate.go in ipcr-forge). See rationale.md.
|
||||
forge-gate:
|
||||
image: ghcr.io/yundera/ipcr-forge:0.6.2
|
||||
image: ghcr.io/yundera/ipcr-forge:0.6.3
|
||||
container_name: forge-gate
|
||||
user: $PUID:$PGID
|
||||
read_only: true
|
||||
@@ -277,7 +277,7 @@ services:
|
||||
# ipcrd: TLS front door on 127.0.0.1:4767. Passes /ipfs/<cid> through to the stock nerdctl
|
||||
# registry below, resolves /ipns/<name>:<tag> itself, and pins every image it serves.
|
||||
ipcr-gateway:
|
||||
image: ghcr.io/yundera/ipcr:1.6.0
|
||||
image: ghcr.io/yundera/ipcr:1.6.1
|
||||
container_name: ipcr-gateway
|
||||
# Root for one reason: it writes its CA into the host's Docker trust store (the narrow
|
||||
# bind below), which is root-owned. See rationale.md.
|
||||
@@ -365,7 +365,7 @@ services:
|
||||
# then works on any machine, without IPCR. A pull here pins nothing. The admin pages switch it
|
||||
# off (config.json "public": false). Not on the admin or CI networks. See rationale.md.
|
||||
ipcr-public:
|
||||
image: ghcr.io/yundera/ipcr:1.6.0
|
||||
image: ghcr.io/yundera/ipcr:1.6.1
|
||||
container_name: ipcr-public
|
||||
user: $PUID:$PGID
|
||||
read_only: true
|
||||
@@ -413,7 +413,7 @@ services:
|
||||
# ── Stock nerdctl IPFS registry ─────────────────────────────────────────────
|
||||
# `nerdctl ipfs registry serve`, unmodified: translates the registry API into IPFS reads.
|
||||
ipcr-registry:
|
||||
image: ghcr.io/yundera/ipcr:1.6.0
|
||||
image: ghcr.io/yundera/ipcr:1.6.1
|
||||
container_name: ipcr-registry
|
||||
# Root because nerdctl run as any other uid assumes rootless mode and refuses to start
|
||||
# without a rootless containerd — which `ipfs registry serve` never uses. The service has
|
||||
@@ -747,7 +747,7 @@ x-compose-app:
|
||||
# never stored. Waits up to 240s for the Gitea app, then records why it could not go on
|
||||
# (forge/secrets/setup-status, shown on the forge's page) and lets the start finish.
|
||||
- name: forge-setup
|
||||
image: ghcr.io/yundera/ipcr-forge:0.6.2
|
||||
image: ghcr.io/yundera/ipcr-forge:0.6.3
|
||||
user: $PUID:$PGID
|
||||
phase: post_up
|
||||
network: $APP_NET
|
||||
|
||||
+1
-1
Submodule ipcr-forge updated: b508bd267b...17df335e3d
Reference in New Issue
Block a user