mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-08-28 05:25:25 +00:00
ac9246cfd3
* ci(docker): mirror signed images to Docker Hub alongside GHCR
docker.yml now publishes to docker.io/abhigyanpatwari/gitnexus{,-web} in
the same build step as the existing GHCR push, so both registries receive
the same digest, the same Cosign keyless signature, and the same SBOM /
build-provenance attestations. The Docker Hub login uses new repo secrets
DOCKERHUB_USERNAME / DOCKERHUB_TOKEN (scoped PAT, not account password).
Supply-chain guarantees carry over unchanged: the signing loop iterates
metadata-action's full tag set, so Docker Hub tags get signed at the
identical digest under the same docker.yml@refs/tags/v* identity. The
ClusterImagePolicy is extended with docker.io / index.docker.io / bare-
namespace globs so admission cannot be sidestepped by registry-prefix
choice. README and .env.example document both registries; RC section in
CONTRIBUTING.md notes the Docker Hub mirror tag.
Closes #1027
* ci(docker): publish to akonlabs Docker Hub namespace; add PR dry-run CI
- Hardcode `akonlabs` as the Docker Hub namespace in metadata-action and
both attestation subject-names (Docker Hub org differs from GitHub org
`abhigyanpatwari`, so `github.repository_owner` would produce the wrong ref)
- Update docs (.env.example, README, CONTRIBUTING) and the Kubernetes
ClusterImagePolicy globs to reference `akonlabs/gitnexus{,-web}`
- Add `pull_request` trigger so the image build runs as CI on every PR
(build only — no push, sign, or attestation)
- Add `workflow_dispatch` with `dry_run: boolean` (default true) for
manual build-only runs; all publish steps gated on
`github.event_name != 'pull_request' && !inputs.dry_run`
19 lines
803 B
Text
19 lines
803 B
Text
# Images (signed Cosign keyless on every push from main / vX.Y.Z tags).
|
|
# Available from both GHCR (default below) and Docker Hub — pick one:
|
|
# GHCR: ghcr.io/abhigyanpatwari/gitnexus{,-web}:latest
|
|
# Docker Hub: akonlabs/gitnexus{,-web}:latest
|
|
# Both registries receive the same digest from a single signed build.
|
|
SERVER_IMAGE=ghcr.io/abhigyanpatwari/gitnexus:latest
|
|
WEB_IMAGE=ghcr.io/abhigyanpatwari/gitnexus-web:latest
|
|
|
|
# Container names
|
|
SERVER_CONTAINER_NAME=gitnexus-server
|
|
WEB_CONTAINER_NAME=gitnexus-web
|
|
|
|
# Host ports — the web UI expects the server on http://localhost:4747 by default.
|
|
SERVER_HOST_PORT=4747
|
|
WEB_HOST_PORT=4173
|
|
|
|
# Optional read-only mount, exposed to the server as /workspace.
|
|
# Override with the directory that contains the repos you want to index.
|
|
WORKSPACE_DIR=./
|