From ba56591416c9136e9dcd607b691eff7967d9c585 Mon Sep 17 00:00:00 2001 From: alessandrovitali Date: Mon, 12 Oct 2026 15:31:39 +0200 Subject: [PATCH] images: pin digest and set image rebuild schedule --- .gitea/workflows/build.yml | 5 +++++ images/act/Dockerfile | 3 ++- images/act/README.md | 2 +- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index 99eea46..5038781 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -3,6 +3,11 @@ name: build on: push: branches: [main] + paths: + - 'images/**' + - '.gitea/workflows/build.yml' + schedule: + - cron: '0 4 * * 0' ## weekly sunday 04:00 UTC rebuild workflow_dispatch: jobs: diff --git a/images/act/Dockerfile b/images/act/Dockerfile index 1469b86..5852605 100644 --- a/images/act/Dockerfile +++ b/images/act/Dockerfile @@ -1,4 +1,5 @@ -FROM docker.gitea.com/runner-images:ubuntu-latest +## renovate: datasource=docker depName=docker.gitea.com/runner-images +FROM docker.gitea.com/runner-images:ubuntu-latest@sha256:0e62e56b382ebf485bff1e51a05cbe27c708545a2e91425467fd31eb3e249521 RUN set -eux; \ apt-get update; \ diff --git a/images/act/README.md b/images/act/README.md index a9fe6dd..ab26281 100644 --- a/images/act/README.md +++ b/images/act/README.md @@ -2,4 +2,4 @@ Gitea / Forgejo Actions runner image based on `runner-images:ubuntu-latest` with the pinned, checksum-verified SOPS build installed, plus `rsync` from apt. -Built and pushed to `git.studiovita.li/studio/actions:ubuntu-latest` by the `build` workflow on push to `main`. Update `SOPS_VERSION` in `Dockerfile` to bump SOPS (tracked in renovate.json). \ No newline at end of file +Built and pushed to `git.studiovita.li/studio/actions:ubuntu-latest` by the `build` workflow on push to `main`, weekly on a schedule (Sunday 04:00 cron), and on manual dispatch. The base image is pinned by digest so Renovate opens a PR whenever `runner-images:ubuntu-latest` changes; update `SOPS_VERSION` in `Dockerfile` to bump SOPS (both tracked in renovate.json). \ No newline at end of file