Maidn/tekton-pipelines
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

feat: isolate delivery task credentials

Browse source
This commit is contained in:
Maidn 2026-09-08 15:24:09 +02:00 committed by eding
parent 94cfa67d33
commit 484744b07f
2 changed files with 124 additions and 30 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

122
catalog/maidn-node-static-image.yaml
View file

@ -1,7 +1,7 @@
apiVersion: tekton.dev/v1
kind: Task
metadata:
name: maidn-node-static-image
name: maidn-git-clone
namespace: tekton-pipelines
spec:
stepTemplate:
@ -23,28 +23,8 @@ spec:
type: string
- name: revision
type: string
- name: image
type: string
- name: output-directory
type: string
- name: build-configuration
type: string
default: ci
- name: base-image
type: string
default: nginx:1.27-alpine
- name: target-directory
type: string
default: /www/target
workspaces:
- name: source
volumes:
- name: registry-credentials
secret:
secretName: forgejo-registry-credentials
items:
- key: .dockerconfigjson
path: config.json
steps:
- name: clone
image: alpine/git:2.47.2
@ -67,14 +47,43 @@ spec:
git clone "$REPOSITORY_URL" "$SOURCE_PATH"
git config --global --add safe.directory "$SOURCE_PATH"
git -C "$SOURCE_PATH" checkout "$REVISION"
---
apiVersion: tekton.dev/v1
kind: Task
metadata:
name: maidn-node-static-build
namespace: tekton-pipelines
spec:
stepTemplate:
env:
- name: HOME
value: /tekton/home
securityContext:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
params:
- name: output-directory
type: string
- name: build-configuration
type: string
default: ci
- name: target-directory
type: string
default: /www/target
workspaces:
- name: source
steps:
- name: build-layer
image: node:22-alpine
workingDir: $(workspaces.source.path)
env:
- name: IMAGE
value: $(params.image)
- name: REVISION
value: $(params.revision)
- name: OUTPUT_DIRECTORY
value: $(params.output-directory)
- name: TARGET_DIRECTORY
@ -84,15 +93,11 @@ spec:
script: |
#!/bin/sh
set -eu
case "$IMAGE" in git.pingu.pw/*) ;; *) exit 1 ;; esac
image_path=${IMAGE#git.pingu.pw/}
case "$image_path" in ''|*[!A-Za-z0-9._/-]*|/*|*//*|*..*|*/) exit 1 ;; esac
case "$REVISION" in [A-Za-z0-9]*) ;; *) exit 1 ;; esac
case "$REVISION" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
case "$OUTPUT_DIRECTORY" in ''|/*|-*|*[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
case "$TARGET_DIRECTORY" in /*) ;; *) exit 1 ;; esac
target_path=${TARGET_DIRECTORY#/}
case "$target_path" in ''|-*|*[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
case "$BUILD_CONFIGURATION" in ''|-*|*[!A-Za-z0-9._-]*) exit 1 ;; esac
# ponytail: no lockfile; skip install scripts and use npm ci when package-lock.json is committed.
npm install --ignore-scripts --no-audit --no-fund --package-lock=false
npm run build -- --configuration "$BUILD_CONFIGURATION"
@ -102,6 +107,63 @@ spec:
mkdir -p "$layer_dir/$target_path"
cp -R "$OUTPUT_DIRECTORY"/. "$layer_dir/$target_path/"
tar -C "$layer_dir" -cf layer.tar "$target_path"
---
apiVersion: tekton.dev/v1
kind: Task
metadata:
name: maidn-node-static-push
namespace: tekton-pipelines
spec:
stepTemplate:
env:
- name: HOME
value: /tekton/home
securityContext:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
params:
- name: image
type: string
- name: revision
type: string
- name: base-image
type: string
default: nginx:1.27-alpine
workspaces:
- name: source
volumes:
- name: registry-credentials
secret:
secretName: forgejo-registry-credentials
items:
- key: .dockerconfigjson
path: config.json
steps:
- name: validate-inputs
image: alpine:3.21.3
env:
- name: IMAGE
value: $(params.image)
- name: REVISION
value: $(params.revision)
- name: BASE_IMAGE
value: $(params.base-image)
script: |
#!/bin/sh
set -eu
case "$IMAGE" in git.pingu.pw/*) ;; *) exit 1 ;; esac
image_path=${IMAGE#git.pingu.pw/}
case "$image_path" in ''|*[!A-Za-z0-9._/-]*|/*|*//*|*..*|*/) exit 1 ;; esac
case "$REVISION" in [A-Za-z0-9]*) ;; *) exit 1 ;; esac
case "$REVISION" in *[!A-Za-z0-9._/-]*|*..*|*//*|*/) exit 1 ;; esac
case "$BASE_IMAGE" in ''|-*|*[!A-Za-z0-9._/@:-]*|/*|*//*|*..*) exit 1 ;; esac
- name: push
image: gcr.io/go-containerregistry/crane:v0.21.7
args:

32
catalog/test-node-static-image.sh Normal file
View file

@ -0,0 +1,32 @@
#!/bin/sh
set -eu
root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
catalog="$root/catalog/maidn-node-static-image.yaml"
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT
task() {
awk -v name="$1" '
/^---$/ { if (found) exit }
$0 == " name: " name { found=1 }
found { print }
' "$catalog"
}
[ "$(grep -c '^apiVersion: tekton.dev/v1$' "$catalog")" -eq 3 ]
[ "$(grep -c '^kind: Task$' "$catalog")" -eq 3 ]
[ "$(grep -cF 'runAsNonRoot: true' "$catalog")" -eq 3 ]
[ "$(grep -cF 'forgejo-registry-credentials' "$catalog")" -eq 1 ]
for name in maidn-git-clone maidn-node-static-build maidn-node-static-push; do
task "$name" > "$tmp/$name"
grep -qF " name: $name" "$tmp/$name"
grep -qF ' - name: source' "$tmp/$name"
done
grep -qF 'git clone "$REPOSITORY_URL" "$SOURCE_PATH"' "$tmp/maidn-git-clone"
grep -qF 'tar -C "$layer_dir" -cf layer.tar "$target_path"' "$tmp/maidn-node-static-build"
grep -qF 'image: gcr.io/go-containerregistry/crane:v0.21.7' "$tmp/maidn-node-static-push"
grep -qF ' - append' "$tmp/maidn-node-static-push"
grep -qF 'mountPath: /tekton/home/.docker' "$tmp/maidn-node-static-push"