msw/CISS.debian.live.builder
SHA256
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

V8.03.148.2025.06.02

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-06-02 15:51:03 +02:00
parent 3210601f48
commit f7fd74226f
3 changed files with 100 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
.gitea/workflows/generate-iso.yaml
View File

@@ -298,7 +298,7 @@ jobs:
run: | run: |
set -euo pipefail set -euo pipefail
PRIVATE_FILE="LIVE_ISO.private" PRIVATE_FILE="LIVE_ISO.private"
git add "${PRIVATE_FILE}" || echo "ℹ️ Nothing to add." git add "${PRIVATE_FILE}" || echo "✔️ Nothing to add."
- name: 🔑 Commit and sign changes with CI metadata. - name: 🔑 Commit and sign changes with CI metadata.
shell: bash shell: bash
@@ -309,7 +309,7 @@ jobs:
export GNUPGHOME="$(pwd)/.gnupg" export GNUPGHOME="$(pwd)/.gnupg"
if git diff --cached --quiet; then if git diff --cached --quiet; then
echo "ℹ️ No staged changes to commit." echo "✔️ No staged changes to commit."
else else
echo "📝 Committing changes with GPG signature ..." echo "📝 Committing changes with GPG signature ..."

129
.gitea/workflows/render-dnssec-status.yaml
View File

@@ -27,12 +27,13 @@ jobs:
build-dnssec-diagram: build-dnssec-diagram:
name: Retrieve the DNSSEC status at the time of updating the repository. name: Retrieve the DNSSEC status at the time of updating the repository.
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Prepare SSH Setup, SSH Deploy Key, Known Hosts, config. - name: ⚙️ Preparing SSH Setup, SSH Deploy Key, Known Hosts, .config.
shell: bash shell: bash
run: | run: |
rm -rf ~/.ssh set -euo pipefail
mkdir -p ~/.ssh rm -rf ~/.ssh && mkdir -m700 ~/.ssh
### Private Key ### Private Key
echo "${{ secrets.SSH_MSW_DEPLOY_CORESECRET_DEV }}" >| ~/.ssh/id_ed25519 echo "${{ secrets.SSH_MSW_DEPLOY_CORESECRET_DEV }}" >| ~/.ssh/id_ed25519
@@ -54,36 +55,27 @@ jobs:
chmod 600 ~/.ssh/config chmod 600 ~/.ssh/config
### https://github.com/actions/checkout/issues/1843 ### https://github.com/actions/checkout/issues/1843
- name: Use manual clone via SSH to circumvent Gitea SHA-256 object issues. - name: 🛠️ Using manual clone via SSH to circumvent Gitea SHA-256 object issues.
shell: bash shell: bash
run: |
git clone --branch "${GITHUB_REF_NAME}" ssh://git@git.coresecret.dev:42842/msw/CISS.debian.live.builder.git .
git fetch --unshallow || echo "Nothing to fetch - already full clone."
env: env:
### GITHUB_REF_NAME contains the branch name from the push event. ### GITHUB_REF_NAME contains the branch name from the push event.
GITHUB_REF_NAME: ${{ github.ref_name }} GITHUB_REF_NAME: ${{ github.ref_name }}
run: |
set -euo pipefail
git clone --branch "${GITHUB_REF_NAME}" ssh://git@git.coresecret.dev:42842/msw/CISS.debian.live.builder.git .
git fetch --unshallow || echo "Nothing to fetch - already full clone."
- name: Clean workspace. - name: 🛠️ Cleaning the workspace.
shell: bash shell: bash
run: | run: |
set -euo pipefail
git reset --hard git reset --hard
git clean -fd git clean -fd
- name: Convert APT sources to HTTPS. - name: ⚙️ Importing the 'CI PGP DEPLOY ONLY' key.
shell: bash
run: |
sed -i 's|http://\(archive\.ubuntu\.com\|security\.ubuntu\.com\)|https://\1|g' /etc/apt/sources.list
sed -i 's|http://\(archive\.ubuntu\.com\|security\.ubuntu\.com\)|https://\1|g' /etc/apt/sources.list.d/*.list || true
- name: Install DNSViz.
shell: bash
run: |
sudo apt-get update
sudo apt-get install -y dnsviz
- name: Import CI PGP DEPLOY ONLY Key.
shell: bash shell: bash
run: | run: |
set -euo pipefail
### GPG-Home relative to the Runner Workspace to avoid changing global files. ### GPG-Home relative to the Runner Workspace to avoid changing global files.
export GNUPGHOME="$(pwd)/.gnupg" export GNUPGHOME="$(pwd)/.gnupg"
mkdir -m 700 "${GNUPGHOME}" mkdir -m 700 "${GNUPGHOME}"
@@ -93,9 +85,10 @@ jobs:
KEY_ID=$(gpg --list-keys --with-colons | awk -F: '/^pub:/ {print $5}') KEY_ID=$(gpg --list-keys --with-colons | awk -F: '/^pub:/ {print $5}')
echo "trust-model always" >| "${GNUPGHOME}/gpg.conf" echo "trust-model always" >| "${GNUPGHOME}/gpg.conf"
- name: Configure Git for signed CI DEPLOY commits. - name: ⚙️ Configuring Git for signed CI/DEPLOY commits.
shell: bash shell: bash
run: | run: |
set -euo pipefail
export GNUPGHOME="$(pwd)/.gnupg" export GNUPGHOME="$(pwd)/.gnupg"
git config user.name "Marc S. Weidner BOT" git config user.name "Marc S. Weidner BOT"
git config user.email "msw+bot@coresecret.dev" git config user.email "msw+bot@coresecret.dev"
@@ -103,43 +96,105 @@ jobs:
git config gpg.program gpg git config gpg.program gpg
git config gpg.format openpgp git config gpg.format openpgp
- name: Ensure docs/SECURITY/ directory exists. - name: ⚙️ Convert APT sources to HTTPS.
shell: bash
run: |
set -euo pipefail
sed -i 's|http://\(archive\.ubuntu\.com\|security\.ubuntu\.com\)|https://\1|g' /etc/apt/sources.list
sed -i 's|http://\(archive\.ubuntu\.com\|security\.ubuntu\.com\)|https://\1|g' /etc/apt/sources.list.d/*.list || true
- name: 🛠️ Install DNSViz.
shell: bash
run: |
sudo apt-get update
sudo apt-get install -y dnsviz
- name: ⚙️ Ensure docs/SECURITY/ directory exists.
shell: bash shell: bash
run: | run: |
mkdir -p docs/SECURITY/ mkdir -p docs/SECURITY/
rm -f docs/SECURITY/coresecret.dev.png rm -f docs/SECURITY/coresecret.dev.png
- name: Prepare DNS Cache. - name: 🛠️ Prepare DNS Cache.
shell: bash shell: bash
run: | run: |
sudo apt-get install -y dnsutils sudo apt-get install -y dnsutils
dig +dnssec +multi coresecret.dev @8.8.8.8 dig +dnssec +multi coresecret.dev @8.8.8.8
- name: Retrieve Zone Dump and generate .png Visualization. - name: 🛠️ Retrieve Zone Dump and generate .png Visualization.
shell: bash shell: bash
run: | run: |
dnsviz probe -s 8.8.8.8 -R SOA,A,AAAA,CAA,CDS,CDNSKEY,LOC,HTTPS,MX,NS,TXT coresecret.dev >| coresecret.dev.json dnsviz probe -s 8.8.8.8 -R SOA,A,AAAA,CAA,CDS,CDNSKEY,LOC,HTTPS,MX,NS,TXT coresecret.dev >| coresecret.dev.json
dnsviz graph -T png < coresecret.dev.json >| docs/SECURITY/coresecret.dev.png dnsviz graph -T png < coresecret.dev.json >| docs/SECURITY/coresecret.dev.png
- name: Stage generated files. - name: 🔄 Sync with remote before commit using merge strategy.
shell: bash shell: bash
run: |
git add docs/SECURITY/*.png
env: env:
GIT_SSH_COMMAND: "ssh -p 42842" GIT_SSH_COMMAND: "ssh -p 42842"
- name: Commit and Sign changes.
shell: bash
run: | run: |
set -euo pipefail
export GNUPGHOME="$(pwd)/.gnupg" export GNUPGHOME="$(pwd)/.gnupg"
git commit -S -m "DEPLOY BOT: Auto-Generate DNSSEC Status [skip ci]" || echo "No Changes, nothing to Sign or to Commit."
env:
GIT_SSH_COMMAND: "ssh -p 42842"
- name: Push back to Repository. echo "🔄 Fetching origin/master ..."
git fetch origin master
echo "🔁 Merging origin/master into current branch ..."
git merge --no-edit origin/master || echo "✔️ Already up to date or fast-forward."
echo "📋 Post-merge status :"
git status
git log --oneline -n 5
- name: 📦 Stage generated files.
shell: bash shell: bash
run: |
git push origin HEAD:${GITHUB_REF_NAME}
env: env:
GIT_SSH_COMMAND: "ssh -p 42842" GIT_SSH_COMMAND: "ssh -p 42842"
run: |
set -euo pipefail
git add docs/SECURITY/*.png || echo "✔️ Nothing to add."
- name: 🔑 Commit and sign changes with CI metadata.
shell: bash
env:
GIT_SSH_COMMAND: "ssh -p 42842"
run: |
set -euo pipefail
export GNUPGHOME="$(pwd)/.gnupg"
if git diff --cached --quiet; then
echo "✔️ No staged changes to commit."
else
echo "📝 Committing changes with GPG signature ..."
### CI Metadata
TIMESTAMP_UTC="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
HOSTNAME="$(hostname -f || hostname)"
GIT_SHA="$(git rev-parse --short HEAD)"
GIT_REF="$(git symbolic-ref --short HEAD || echo detached)"
WORKFLOW_ID="${GITHUB_WORKFLOW:-render-md-to-html.yaml}"
CI_HEADER="X-CI-Metadata: ${GIT_REF}@${GIT_SHA} at ${TIMESTAMP_UTC} on ${HOSTNAME}"
COMMIT_MSG="DEPLOY BOT: Auto-Generate DNSSEC Status [skip ci]
${CI_HEADER}
Generated at: ${TIMESTAMP_UTC}
Runner Host : ${HOSTNAME}
Workflow ID : ${WORKFLOW_ID}
Git Commit : ${GIT_SHA} HEAD → ${GIT_REF}
"
echo "🔏 Commit message :"
echo "${COMMIT_MSG}"
git commit -S -m "${COMMIT_MSG}"
fi
- name: 🔁 Push back to repository.
shell: bash
env:
GIT_SSH_COMMAND: "ssh -p 42842"
run: |
set -euo pipefail
echo "📤 Pushing changes to ${GITHUB_REF_NAME} ..."
git push origin HEAD:${GITHUB_REF_NAME}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml

10
.gitea/workflows/render-md-to-html.yaml
View File

@@ -111,12 +111,12 @@ jobs:
sudo apt-get update sudo apt-get update
sudo apt-get install -y pandoc sudo apt-get install -y pandoc
#- name: Ensure .html/ directory exists. #- name: ⚙️ Ensure .html/ directory exists.
# shell: bash # shell: bash
# run: # run:
# mkdir -p .html # mkdir -p .html
#- name: Render *.md to full standalone HTML. #- name: 🛠️ Render *.md to full standalone HTML.
# shell: bash # shell: bash
# run: | # run: |
# set -euo pipefail # set -euo pipefail
@@ -134,7 +134,7 @@ jobs:
# -o .html/"${out}" # -o .html/"${out}"
# done # done
- name: 📥 Extract HTML fragment for Gitea for *.md. - name: 🛠️ Extract HTML fragment for Gitea for *.md.
shell: bash shell: bash
run: | run: |
set -euo pipefail set -euo pipefail
@@ -174,7 +174,7 @@ jobs:
GIT_SSH_COMMAND: "ssh -p 42842" GIT_SSH_COMMAND: "ssh -p 42842"
run: | run: |
set -euo pipefail set -euo pipefail
git add *.html || echo "ℹ️ Nothing to add." git add *.html || echo "✔️ Nothing to add."
- name: 🔑 Commit and sign changes with CI metadata. - name: 🔑 Commit and sign changes with CI metadata.
shell: bash shell: bash
@@ -185,7 +185,7 @@ jobs:
export GNUPGHOME="$(pwd)/.gnupg" export GNUPGHOME="$(pwd)/.gnupg"
if git diff --cached --quiet; then if git diff --cached --quiet; then
echo "ℹ️ No staged changes to commit." echo "✔️ No staged changes to commit."
else else
echo "📝 Committing changes with GPG signature ..." echo "📝 Committing changes with GPG signature ..."