From bd329a36f98e21447f9af5e5e7a6a885259e8650 Mon Sep 17 00:00:00 2001 From: Markus Pesch Date: Wed, 2 Sep 2026 20:40:19 +0200 Subject: [PATCH] chore(ci): authenticate against harbor.cryptic.systems before pulling binfmt The workflows pulled tonistiigi/binfmt through an unauthenticated request, either directly from docker.io or from harbor.cryptic.systems before any credentials had been configured. Both variants are subject to upstream rate limiting and made the multi arch builds fail sporadically. The docker/login-action steps are now placed in front of docker/setup-qemu-action and docker/setup-buildx-action, and a second login against harbor.cryptic.systems was added so that the binfmt image is always pulled from the internal registry with valid credentials. Leftover setup-qemu-action and setup-buildx-action steps from the previous ordering were removed. All pinned actions were additionally bumped to their latest upstream release to remove the version drift between the repositories. --- .gitea/workflows/artifacthub-metadata.yaml | 2 +- .gitea/workflows/auto-release.yaml | 2 +- .gitea/workflows/build.yaml | 28 ++++++++++++--- .gitea/workflows/markdown-linters.yaml | 4 +-- .gitea/workflows/release-latest.yaml | 34 ++++++++++++++----- .gitea/workflows/release-tagged.yaml | 34 ++++++++++++++----- .../update-docker-hub-description.yaml | 2 +- 7 files changed, 81 insertions(+), 25 deletions(-) diff --git a/.gitea/workflows/artifacthub-metadata.yaml b/.gitea/workflows/artifacthub-metadata.yaml index 1dc7136..205717d 100644 --- a/.gitea/workflows/artifacthub-metadata.yaml +++ b/.gitea/workflows/artifacthub-metadata.yaml @@ -10,7 +10,7 @@ jobs: name: "Upload artifacthub-repo.yml to OCI registry" runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ${{ github.server_url }} diff --git a/.gitea/workflows/auto-release.yaml b/.gitea/workflows/auto-release.yaml index 81ac8d4..b476442 100644 --- a/.gitea/workflows/auto-release.yaml +++ b/.gitea/workflows/auto-release.yaml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml index a720bc4..b31f8c2 100644 --- a/.gitea/workflows/build.yaml +++ b/.gitea/workflows/build.yaml @@ -12,8 +12,18 @@ jobs: build-arm64: runs-on: ubuntu-latest-arm64 steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + with: + registry: harbor.cryptic.systems + username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }} + password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }} + + - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0 + with: + image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest + - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: Build image @@ -30,8 +40,18 @@ jobs: build-amd64: runs-on: ubuntu-latest-amd64 steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + with: + registry: harbor.cryptic.systems + username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }} + password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }} + + - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0 + with: + image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest + - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: Build image diff --git a/.gitea/workflows/markdown-linters.yaml b/.gitea/workflows/markdown-linters.yaml index 3ad1c65..e05891a 100644 --- a/.gitea/workflows/markdown-linters.yaml +++ b/.gitea/workflows/markdown-linters.yaml @@ -15,7 +15,7 @@ jobs: markdown-lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - - uses: DavidAnson/markdownlint-cli2-action@ded1f9488f68a970bc66ea5619e13e9b52e601cd # v23.2.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24.2.0 with: globs: '**/*.md' diff --git a/.gitea/workflows/release-latest.yaml b/.gitea/workflows/release-latest.yaml index a7efdff..90eb1f8 100644 --- a/.gitea/workflows/release-latest.yaml +++ b/.gitea/workflows/release-latest.yaml @@ -9,10 +9,7 @@ jobs: push-arm64: runs-on: ubuntu-latest-arm64 steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - - - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: @@ -20,6 +17,18 @@ jobs: username: ${{ github.repository_owner }} password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }} + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + with: + registry: harbor.cryptic.systems + username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }} + password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }} + + - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0 + with: + image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest + + - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 + - name: Build and push image run: | docker buildx build \ @@ -34,10 +43,7 @@ jobs: push-amd64: runs-on: ubuntu-latest-amd64 steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - - - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: @@ -45,6 +51,18 @@ jobs: username: ${{ github.repository_owner }} password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }} + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + with: + registry: harbor.cryptic.systems + username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }} + password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }} + + - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0 + with: + image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest + + - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 + - name: Build and push image run: | docker buildx build \ diff --git a/.gitea/workflows/release-tagged.yaml b/.gitea/workflows/release-tagged.yaml index 2d5ce05..afe2f85 100644 --- a/.gitea/workflows/release-tagged.yaml +++ b/.gitea/workflows/release-tagged.yaml @@ -27,20 +27,29 @@ jobs: echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true ref: "${{ steps.version_extraction.outputs.version_raw }}" - - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: git.cryptic.systems username: ${{ github.repository_owner }} password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }} + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + with: + registry: harbor.cryptic.systems + username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }} + password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }} + + - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0 + with: + image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest + + - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 + - name: Build and push image run: | docker buildx build \ @@ -68,20 +77,29 @@ jobs: echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true ref: "${{ steps.version_extraction.outputs.version_raw }}" - - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: git.cryptic.systems username: ${{ github.repository_owner }} password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }} + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + with: + registry: harbor.cryptic.systems + username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }} + password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }} + + - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0 + with: + image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest + + - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 + - name: Build and push image run: | docker buildx build \ diff --git a/.gitea/workflows/update-docker-hub-description.yaml b/.gitea/workflows/update-docker-hub-description.yaml index 650c047..00a6a7a 100644 --- a/.gitea/workflows/update-docker-hub-description.yaml +++ b/.gitea/workflows/update-docker-hub-description.yaml @@ -12,7 +12,7 @@ jobs: update-description-on-hub-docker-io: runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0 with: username: ${{ secrets.DOCKER_IO_USERNAME }}