From c8186c43c31d4dbce89f5702a5c059e81a144f53 Mon Sep 17 00:00:00 2001 From: alessandrovitali Date: Mon, 12 Oct 2026 03:41:40 +0200 Subject: [PATCH 1/6] images: add custom image which packages SOPS. update renovate and add publishing workflow --- .gitea/workflows/build.yml | 22 ++++++++++++++++++++++ images/act/Dockerfile | 15 +++++++++++++++ images/act/README.md | 5 +++++ renovate.json | 8 ++++++++ 4 files changed, 50 insertions(+) create mode 100644 .gitea/workflows/build.yml create mode 100644 images/act/Dockerfile create mode 100644 images/act/README.md diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml new file mode 100644 index 0000000..99eea46 --- /dev/null +++ b/.gitea/workflows/build.yml @@ -0,0 +1,22 @@ +name: build + +on: + push: + branches: [main] + workflow_dispatch: + +jobs: + build: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + - uses: docker/login-action@v3 + with: + registry: git.studiovita.li + username: ${{ gitea.actor }} + password: ${{ secrets.REGISTRY_TOKEN }} + - uses: docker/build-push-action@v6 + with: + context: images/act + push: true + tags: git.studiovita.li/studio/actions:ubuntu-latest diff --git a/images/act/Dockerfile b/images/act/Dockerfile new file mode 100644 index 0000000..b906e9e --- /dev/null +++ b/images/act/Dockerfile @@ -0,0 +1,15 @@ +FROM docker.gitea.com/runner-images:ubuntu-latest + +## renovate: datasource=github-releases depName=getsops/sops +ARG SOPS_VERSION=v3.13.3 + +RUN set -eux; \ + arch=$(dpkg --print-architecture); \ + asset="sops-${SOPS_VERSION}.linux.${arch}"; \ + url="https://github.com/getsops/sops/releases/download/${SOPS_VERSION}"; \ + curl -fsSL -o "/tmp/$asset" "$url/$asset"; \ + curl -fsSL -o /tmp/checksums.txt "$url/sops-${SOPS_VERSION}.checksums.txt"; \ + (cd /tmp && grep " ${asset}$" checksums.txt | sha256sum -c -); \ + install -m 0755 "/tmp/$asset" /usr/local/bin/sops; \ + rm -f "/tmp/$asset" /tmp/checksums.txt; \ + sops --version diff --git a/images/act/README.md b/images/act/README.md new file mode 100644 index 0000000..bf45571 --- /dev/null +++ b/images/act/README.md @@ -0,0 +1,5 @@ +# act runner image + +Gitea / Forgejo Actions runner image based on `runner-images:ubuntu-latest` with the pinned, checksum-verified SOPS build installed. + +Built and pushed to `git.studiovita.li/studio/actions:ubuntu-latest` by the `build` workflow on push to `main`. Update `SOPS_VERSION` in `Dockerfile` to bump SOPS (tracked in renovate.json). \ No newline at end of file diff --git a/renovate.json b/renovate.json index 8fe94d4..d1f00c2 100644 --- a/renovate.json +++ b/renovate.json @@ -13,6 +13,14 @@ "#+\\s*renovate:\\s*datasource=(?[^\\s]+)\\s+depName=(?[^\\s]+)\\s+[A-Z0-9_]+\\s*:\\s*[\"']?(?[^\\s\"'#]+)[\"']?" ], "description": "match any pinned dependency using SCREAMING_SNAKE_CASE naming as ENV" + }, + { + "customType": "regex", + "managerFilePatterns": ["**/Dockerfile"], + "matchStrings": [ + "#+\\s*renovate:\\s*datasource=(?[^\\s]+)\\s+depName=(?[^\\s]+)[ \\t]*\\n[ \\t]*ARG\\s+[A-Z0-9_]+=(?[^\\s\"'#]+)" + ], + "description": "match pinned ARG deps in Dockerfiles" } ] } -- 2.54.0 From 18b1fdb6b4b5454d31de7380e5a42300b52c4159 Mon Sep 17 00:00:00 2001 From: alessandrovitali Date: Mon, 12 Oct 2026 03:49:40 +0200 Subject: [PATCH 2/6] sops: guard SOPS re-download / overwrite --- sops/README.md | 2 +- sops/action.yml | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/sops/README.md b/sops/README.md index f11832e..56eda85 100644 --- a/sops/README.md +++ b/sops/README.md @@ -2,4 +2,4 @@ generate new age keys with `age-keygen -o ~/.config/sops/age/key-name.txt`. encrypt local secrets with `sops -e service-name/.env > service-name/.sops.env`. -the action installs the pinned, checksum-verified SOPS build for the runner's OS/arch and decrypts every `*.sops.*` file except `.sops.yaml`, writing `service-name/.sops.env` back to `service-name/.env` via a temp file and atomic move. +the action installs the pinned, checksum-verified SOPS build for the runner's OS/arch (skipping the download when `sops` is already on `PATH`, e.g. on the custom `studio/actions:ubuntu-latest` runner image) and decrypts every `*.sops.*` file except `.sops.yaml`, writing `service-name/.sops.env` back to `service-name/.env` via a temp file and atomic move. diff --git a/sops/action.yml b/sops/action.yml index 0697166..d3942c6 100644 --- a/sops/action.yml +++ b/sops/action.yml @@ -1,5 +1,5 @@ name: decrypt SOPS secrets -description: installs SOPS and decrypts all *.sops.* files using an age key +description: installs SOPS if missing and decrypts all *.sops.* files using an age key inputs: sops-age-key: @@ -17,6 +17,8 @@ runs: run: | set -euo pipefail + command -v sops >/dev/null && exit 0 + os=$(uname -s | tr '[:upper:]' '[:lower:]') arch=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') asset="sops-${SOPS_VERSION}.${os}.${arch}" -- 2.54.0 From d03a144566c8e05a502a9a1430eb1152dd7e13ee Mon Sep 17 00:00:00 2001 From: alessandrovitali Date: Mon, 12 Oct 2026 03:55:35 +0200 Subject: [PATCH 3/6] image: install rsync --- images/act/Dockerfile | 6 ++++++ images/act/README.md | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/images/act/Dockerfile b/images/act/Dockerfile index b906e9e..1469b86 100644 --- a/images/act/Dockerfile +++ b/images/act/Dockerfile @@ -1,5 +1,11 @@ FROM docker.gitea.com/runner-images:ubuntu-latest +RUN set -eux; \ + apt-get update; \ + apt-get install -y --no-install-recommends rsync; \ + rm -rf /var/lib/apt/lists/*; \ + rsync --version + ## renovate: datasource=github-releases depName=getsops/sops ARG SOPS_VERSION=v3.13.3 diff --git a/images/act/README.md b/images/act/README.md index bf45571..a9fe6dd 100644 --- a/images/act/README.md +++ b/images/act/README.md @@ -1,5 +1,5 @@ # act runner image -Gitea / Forgejo Actions runner image based on `runner-images:ubuntu-latest` with the pinned, checksum-verified SOPS build installed. +Gitea / Forgejo Actions runner image based on `runner-images:ubuntu-latest` with the pinned, checksum-verified SOPS build installed, plus `rsync` from apt. Built and pushed to `git.studiovita.li/studio/actions:ubuntu-latest` by the `build` workflow on push to `main`. Update `SOPS_VERSION` in `Dockerfile` to bump SOPS (tracked in renovate.json). \ No newline at end of file -- 2.54.0 From c0399df117c9aad980a7258524f5843e474aa99b Mon Sep 17 00:00:00 2001 From: alessandrovitali Date: Mon, 12 Oct 2026 03:59:11 +0200 Subject: [PATCH 4/6] actions: style --- sops/action.yml | 4 ---- ssh-copy/action.yml | 3 +++ ssh-run/action.yml | 2 ++ 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/sops/action.yml b/sops/action.yml index d3942c6..51c31e9 100644 --- a/sops/action.yml +++ b/sops/action.yml @@ -40,7 +40,6 @@ runs: SOPS_AGE_KEY: ${{ inputs.sops-age-key }} run: | set -euo pipefail - echo "searching for SOPS files to decrypt..." while IFS= read -r -d '' file; do @@ -48,9 +47,7 @@ runs: output_file="$dir/${base/.sops/}" echo "decrypting '$file' to '$output_file'" - tmp=$(mktemp "$dir/.sops-decrypt.XXXXXX") - if ! sops --decrypt "$file" > "$tmp" || [ ! -s "$tmp" ]; then echo "decryption of '$file' failed or produced empty output" >&2 rm -f "$tmp" @@ -60,5 +57,4 @@ runs: chmod 600 "$tmp" mv "$tmp" "$output_file" done < <(find . -type f -name "*.sops.*" -not -name ".sops.yaml" -print0) - echo "SOPS decryption complete." diff --git a/ssh-copy/action.yml b/ssh-copy/action.yml index 8a6bb34..f774141 100644 --- a/ssh-copy/action.yml +++ b/ssh-copy/action.yml @@ -29,6 +29,7 @@ runs: run: | set -euo pipefail command -v rsync >/dev/null && exit 0 + sudo apt-get -qq update sudo apt-get -yqq install rsync @@ -41,8 +42,10 @@ runs: run: | set -euo pipefail mkdir -p ~/.ssh + printf '%s\n' "$SSH_KEY" > ~/.ssh/id_ed25519 chmod 600 ~/.ssh/id_ed25519 + ssh-keyscan -p "$PORT" -H "$HOST" >> ~/.ssh/known_hosts chmod 600 ~/.ssh/known_hosts diff --git a/ssh-run/action.yml b/ssh-run/action.yml index 3be1c1c..5606760 100644 --- a/ssh-run/action.yml +++ b/ssh-run/action.yml @@ -30,8 +30,10 @@ runs: run: | set -euo pipefail mkdir -p ~/.ssh + printf '%s\n' "$SSH_KEY" > ~/.ssh/id_ed25519 chmod 600 ~/.ssh/id_ed25519 + ssh-keyscan -p "$PORT" -H "$HOST" >> ~/.ssh/known_hosts chmod 600 ~/.ssh/known_hosts -- 2.54.0 From ba56591416c9136e9dcd607b691eff7967d9c585 Mon Sep 17 00:00:00 2001 From: alessandrovitali Date: Mon, 12 Oct 2026 15:31:39 +0200 Subject: [PATCH 5/6] images: pin digest and set image rebuild schedule --- .gitea/workflows/build.yml | 5 +++++ images/act/Dockerfile | 3 ++- images/act/README.md | 2 +- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index 99eea46..5038781 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -3,6 +3,11 @@ name: build on: push: branches: [main] + paths: + - 'images/**' + - '.gitea/workflows/build.yml' + schedule: + - cron: '0 4 * * 0' ## weekly sunday 04:00 UTC rebuild workflow_dispatch: jobs: diff --git a/images/act/Dockerfile b/images/act/Dockerfile index 1469b86..5852605 100644 --- a/images/act/Dockerfile +++ b/images/act/Dockerfile @@ -1,4 +1,5 @@ -FROM docker.gitea.com/runner-images:ubuntu-latest +## renovate: datasource=docker depName=docker.gitea.com/runner-images +FROM docker.gitea.com/runner-images:ubuntu-latest@sha256:0e62e56b382ebf485bff1e51a05cbe27c708545a2e91425467fd31eb3e249521 RUN set -eux; \ apt-get update; \ diff --git a/images/act/README.md b/images/act/README.md index a9fe6dd..ab26281 100644 --- a/images/act/README.md +++ b/images/act/README.md @@ -2,4 +2,4 @@ Gitea / Forgejo Actions runner image based on `runner-images:ubuntu-latest` with the pinned, checksum-verified SOPS build installed, plus `rsync` from apt. -Built and pushed to `git.studiovita.li/studio/actions:ubuntu-latest` by the `build` workflow on push to `main`. Update `SOPS_VERSION` in `Dockerfile` to bump SOPS (tracked in renovate.json). \ No newline at end of file +Built and pushed to `git.studiovita.li/studio/actions:ubuntu-latest` by the `build` workflow on push to `main`, weekly on a schedule (Sunday 04:00 cron), and on manual dispatch. The base image is pinned by digest so Renovate opens a PR whenever `runner-images:ubuntu-latest` changes; update `SOPS_VERSION` in `Dockerfile` to bump SOPS (both tracked in renovate.json). \ No newline at end of file -- 2.54.0 From 43ad6c4033c6ff8d262a68fc51c8db341fe771ca Mon Sep 17 00:00:00 2001 From: alessandrovitali Date: Mon, 12 Oct 2026 15:41:15 +0200 Subject: [PATCH 6/6] ci: request docker socket for image builds --- .gitea/workflows/build.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index 5038781..d96f33a 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -13,6 +13,9 @@ on: jobs: build: runs-on: ubuntu-latest + container: + volumes: + - /var/run/docker.sock:/var/run/docker.sock steps: - uses: actions/checkout@v7 - uses: docker/login-action@v3 -- 2.54.0