mirror of
https://relay.ngit.dev/npub15qydau2hjma6ngxkl2cyar74wzyjshvl65za5k5rl69264ar2exs5cyejr/ngit-grasp.git
synced 2026-10-30 11:07:33 +00:00
DanConwayDev
b0207aaf2b
Build reusable tool bundles before publisher and container commands. This exposes the pinned CLI, daemon and runtime dependencies to provider caching instead of realizing them without a cache-publication checkpoint. The release CLI check retains its verified executable in its output too. Use workflow/job/step command names throughout. Nix built both bundles, all release command wrappers and release script/CLI checks on de1. No publisher or Docker daemon ran during those builds. The Dockerfile integration test intentionally retains its existing online build policy. Assisted-by: GPT-6
63 lines
2.6 KiB
YAML
63 lines
2.6 KiB
YAML
version: 1
|
|
system: x86_64-linux
|
|
name: container release backfill
|
|
on:
|
|
workflow_dispatch:
|
|
jobs:
|
|
container:
|
|
steps:
|
|
- tools: {build: packages.x86_64-linux.ci-container-tools}
|
|
- build
|
|
requirements:
|
|
resources:
|
|
memory-mib: {gte: 4096}
|
|
environment:
|
|
/configuration/guest/job-uid: {eq: 0}
|
|
/configuration/guest/no-new-privileges: {eq: false}
|
|
/configuration/guest/module-autoload: {eq: true}
|
|
/configuration/guest/kernel-features/NAMESPACES: {eq: true}
|
|
/configuration/guest/kernel-features/PID_NS: {eq: true}
|
|
/configuration/guest/kernel-features/NET_NS: {eq: true}
|
|
/configuration/guest/kernel-features/CGROUPS: {eq: true}
|
|
/configuration/guest/kernel-features/MEMCG: {eq: true}
|
|
/configuration/guest/kernel-features/OVERLAY_FS: {eq: true}
|
|
/configuration/guest/kernel-features/BRIDGE: {eq: true}
|
|
/configuration/guest/kernel-features/VETH: {eq: true}
|
|
/configuration/guest/kernel-features/NETFILTER: {eq: true}
|
|
/configuration/guest/kernel-features/NF_NAT: {eq: true}
|
|
/configuration/guest/kernel-features/NF_TABLES: {eq: true}
|
|
/configuration/guest/kernel-features/SECCOMP_FILTER: {eq: true}
|
|
artifacts:
|
|
layout: layout
|
|
provenance: provenance.json
|
|
publish-container:
|
|
steps:
|
|
- tools: {build: packages.x86_64-linux.ci-publisher-tools}
|
|
- publish
|
|
needs: [container]
|
|
secrets: [NGIT_PUBLISHER_NBUNKSEC]
|
|
verify-container:
|
|
steps:
|
|
- tools: {build: packages.x86_64-linux.ci-container-tools}
|
|
- verify
|
|
needs: [publish-container]
|
|
requirements:
|
|
resources:
|
|
memory-mib: {gte: 4096}
|
|
environment:
|
|
/configuration/guest/job-uid: {eq: 0}
|
|
/configuration/guest/no-new-privileges: {eq: false}
|
|
/configuration/guest/module-autoload: {eq: true}
|
|
/configuration/guest/kernel-features/NAMESPACES: {eq: true}
|
|
/configuration/guest/kernel-features/PID_NS: {eq: true}
|
|
/configuration/guest/kernel-features/NET_NS: {eq: true}
|
|
/configuration/guest/kernel-features/CGROUPS: {eq: true}
|
|
/configuration/guest/kernel-features/MEMCG: {eq: true}
|
|
/configuration/guest/kernel-features/OVERLAY_FS: {eq: true}
|
|
/configuration/guest/kernel-features/BRIDGE: {eq: true}
|
|
/configuration/guest/kernel-features/VETH: {eq: true}
|
|
/configuration/guest/kernel-features/NETFILTER: {eq: true}
|
|
/configuration/guest/kernel-features/NF_NAT: {eq: true}
|
|
/configuration/guest/kernel-features/NF_TABLES: {eq: true}
|
|
/configuration/guest/kernel-features/SECCOMP_FILTER: {eq: true}
|