From 584e3342641f0c4ee89434671a90031227311895 Mon Sep 17 00:00:00 2001 From: Markus Pesch Date: Wed, 2 Sep 2026 20:40:19 +0200 Subject: [PATCH] chore(ci): authenticate against harbor.cryptic.systems before pulling binfmt The workflows pulled tonistiigi/binfmt through an unauthenticated request, either directly from docker.io or from harbor.cryptic.systems before any credentials had been configured. Both variants are subject to upstream rate limiting and made the multi arch builds fail sporadically. The docker/login-action steps are now placed in front of docker/setup-qemu-action and docker/setup-buildx-action, and a second login against harbor.cryptic.systems was added so that the binfmt image is always pulled from the internal registry with valid credentials. Leftover setup-qemu-action and setup-buildx-action steps from the previous ordering were removed. All pinned actions were additionally bumped to their latest upstream release to remove the version drift between the repositories. --- .gitea/workflows/build.yaml | 15 ++++++++---- .gitea/workflows/markdown-linters.yaml | 4 ++-- .gitea/workflows/release.yaml | 24 ++++++++++++------- .../update-docker-hub-description.yaml | 2 +- 4 files changed, 30 insertions(+), 15 deletions(-) diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml index 0ae555a..ee51028 100644 --- a/.gitea/workflows/build.yaml +++ b/.gitea/workflows/build.yaml @@ -15,7 +15,7 @@ jobs: build-arm64: runs-on: ubuntu-latest-arm64 steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: @@ -23,7 +23,7 @@ jobs: username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }} password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }} - - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 + - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0 with: image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest @@ -43,8 +43,15 @@ jobs: build-amd64: runs-on: ubuntu-latest-amd64 steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + with: + registry: harbor.cryptic.systems + username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }} + password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }} + + - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0 with: image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 diff --git a/.gitea/workflows/markdown-linters.yaml b/.gitea/workflows/markdown-linters.yaml index 1e62196..2a68476 100644 --- a/.gitea/workflows/markdown-linters.yaml +++ b/.gitea/workflows/markdown-linters.yaml @@ -16,7 +16,7 @@ jobs: runs-on: - ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - - uses: DavidAnson/markdownlint-cli2-action@ded1f9488f68a970bc66ea5619e13e9b52e601cd # v23.2.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24.2.0 with: globs: '**/*.md' diff --git a/.gitea/workflows/release.yaml b/.gitea/workflows/release.yaml index 7d1ad8d..465a8d4 100644 --- a/.gitea/workflows/release.yaml +++ b/.gitea/workflows/release.yaml @@ -9,9 +9,9 @@ jobs: push-arm64: runs-on: ubuntu-latest-arm64 steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: docker/login-action@v4.1.0 + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: git.cryptic.systems username: ${{ github.repository_owner }} @@ -23,7 +23,7 @@ jobs: username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }} password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }} - - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 + - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0 with: image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest @@ -45,11 +45,7 @@ jobs: push-amd64: runs-on: ubuntu-latest-amd64 steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - with: - image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest - - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: @@ -57,6 +53,18 @@ jobs: username: ${{ github.repository_owner }} password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }} + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + with: + registry: harbor.cryptic.systems + username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }} + password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }} + + - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0 + with: + image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest + + - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 + - name: Build and push image run: | TAG=$(echo ${{ github.ref_name }} | sed 's/v//gm') diff --git a/.gitea/workflows/update-docker-hub-description.yaml b/.gitea/workflows/update-docker-hub-description.yaml index f59b32e..586e358 100644 --- a/.gitea/workflows/update-docker-hub-description.yaml +++ b/.gitea/workflows/update-docker-hub-description.yaml @@ -13,7 +13,7 @@ jobs: runs-on: - ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0 with: username: ${{ secrets.DOCKER_IO_USERNAME }}