From 4235da63ea700ef92ea36b8f65fce3e20bfa4c6a Mon Sep 17 00:00:00 2001 From: ChatGPT MCP Date: Fri, 28 Aug 2026 18:06:23 +0000 Subject: [PATCH] ci: route trusted Docker gates through isolated DinD --- .gitea/workflows/release-gates.yml | 61 ++++++++++++++++++- .gitea/workflows/runner-docker-diagnostic.yml | 47 -------------- 2 files changed, 60 insertions(+), 48 deletions(-) delete mode 100644 .gitea/workflows/runner-docker-diagnostic.yml diff --git a/.gitea/workflows/release-gates.yml b/.gitea/workflows/release-gates.yml index 2d93f67f..7d2abe2a 100644 --- a/.gitea/workflows/release-gates.yml +++ b/.gitea/workflows/release-gates.yml @@ -15,8 +15,31 @@ concurrency: cancel-in-progress: true jobs: + source-trust: + name: Trusted workflow source + runs-on: ubuntu-latest + timeout-minutes: 5 + steps: + - name: Accept trusted push and manual runs + if: ${{ gitea.event_name != 'pull_request' }} + run: echo "Trusted non-PR workflow source." + - name: Require a same-repository pull request + if: ${{ gitea.event_name == 'pull_request' }} + env: + HEAD_REPOSITORY: ${{ gitea.event.pull_request.head.repo.full_name }} + TARGET_REPOSITORY: ${{ gitea.repository }} + run: | + set -euo pipefail + test -n "$HEAD_REPOSITORY" + if [ "$HEAD_REPOSITORY" != "$TARGET_REPOSITORY" ]; then + echo "Docker-capable release validation refuses forked pull requests." >&2 + exit 1 + fi + echo "Trusted same-repository pull request." + quality: name: Compile, test, contracts and builds + needs: source-trust runs-on: ubuntu-latest timeout-minutes: 45 steps: @@ -24,7 +47,12 @@ jobs: with: persist-credentials: false - name: Verified secret scan - run: bash scripts/scan_secrets.sh + env: + DOCKER_HOST: tcp://gitea-runner-dind:2375 + DOCKER_TLS_CERTDIR: "" + run: | + docker info >/dev/null + bash scripts/scan_secrets.sh - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 with: python-version: "3.11" @@ -68,6 +96,7 @@ jobs: dependency-audit: name: Python and npm vulnerability policy + needs: source-trust runs-on: ubuntu-latest timeout-minutes: 20 steps: @@ -114,6 +143,7 @@ jobs: container-gis: name: GIS image, SBOM and container scan + needs: source-trust runs-on: ubuntu-latest timeout-minutes: 60 steps: @@ -123,7 +153,10 @@ jobs: - name: Build GIS release image env: RELEASE_SHA: ${{ gitea.sha }} + DOCKER_HOST: tcp://gitea-runner-dind:2375 + DOCKER_TLS_CERTDIR: "" run: | + docker info >/dev/null mkdir -p artifacts BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)" docker build \ @@ -137,11 +170,22 @@ jobs: - name: Generate GIS SPDX SBOM env: RELEASE_SHA: ${{ gitea.sha }} + DOCKER_HOST: tcp://gitea-runner-dind:2375 + DOCKER_TLS_CERTDIR: "" run: bash scripts/generate_container_sbom.sh "geointel-ci:$RELEASE_SHA-gis" - name: Enforce GIS container vulnerability policy env: RELEASE_SHA: ${{ gitea.sha }} + DOCKER_HOST: tcp://gitea-runner-dind:2375 + DOCKER_TLS_CERTDIR: "" run: bash scripts/scan_container_image.sh "geointel-ci:$RELEASE_SHA-gis" + - name: Cleanup GIS CI image + if: always() + env: + RELEASE_SHA: ${{ gitea.sha }} + DOCKER_HOST: tcp://gitea-runner-dind:2375 + DOCKER_TLS_CERTDIR: "" + run: docker image rm -f "geointel-ci:$RELEASE_SHA-gis" >/dev/null 2>&1 || true - name: Publish GIS container evidence if: always() uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de @@ -156,6 +200,7 @@ jobs: container-ai: name: AI image, SBOM and container scan + needs: source-trust if: ${{ gitea.event_name == 'pull_request' || gitea.ref == 'refs/heads/main' || gitea.event_name == 'workflow_dispatch' }} runs-on: ubuntu-latest timeout-minutes: 90 @@ -166,7 +211,10 @@ jobs: - name: Build AI release image env: RELEASE_SHA: ${{ gitea.sha }} + DOCKER_HOST: tcp://gitea-runner-dind:2375 + DOCKER_TLS_CERTDIR: "" run: | + docker info >/dev/null mkdir -p artifacts BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)" docker build \ @@ -180,11 +228,22 @@ jobs: - name: Generate AI SPDX SBOM env: RELEASE_SHA: ${{ gitea.sha }} + DOCKER_HOST: tcp://gitea-runner-dind:2375 + DOCKER_TLS_CERTDIR: "" run: bash scripts/generate_container_sbom.sh "geointel-ci:$RELEASE_SHA-ai" - name: Enforce AI container vulnerability policy env: RELEASE_SHA: ${{ gitea.sha }} + DOCKER_HOST: tcp://gitea-runner-dind:2375 + DOCKER_TLS_CERTDIR: "" run: bash scripts/scan_container_image.sh "geointel-ci:$RELEASE_SHA-ai" + - name: Cleanup AI CI image + if: always() + env: + RELEASE_SHA: ${{ gitea.sha }} + DOCKER_HOST: tcp://gitea-runner-dind:2375 + DOCKER_TLS_CERTDIR: "" + run: docker image rm -f "geointel-ci:$RELEASE_SHA-ai" >/dev/null 2>&1 || true - name: Publish AI container evidence if: always() uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de diff --git a/.gitea/workflows/runner-docker-diagnostic.yml b/.gitea/workflows/runner-docker-diagnostic.yml deleted file mode 100644 index 2c29fca5..00000000 --- a/.gitea/workflows/runner-docker-diagnostic.yml +++ /dev/null @@ -1,47 +0,0 @@ -name: Runner Docker diagnostic - -on: - push: - branches: - - chatgpt/geointel-hardening-20260826 - -permissions: - contents: read - -jobs: - diagnostic: - runs-on: ubuntu-latest - timeout-minutes: 10 - env: - DOCKER_HOST: tcp://gitea-runner-dind:2375 - DOCKER_TLS_CERTDIR: "" - steps: - - name: Verify isolated shared runner daemon - shell: bash - run: | - set -euo pipefail - docker info >/tmp/docker-info.txt - docker version - - mapfile -t visible_names < <(docker ps -a --format '{{.Names}}') - echo "visible-container-count=${#visible_names[@]}" - for name in "${visible_names[@]}"; do - case "$name" in - GITEA-ACTIONS-TASK-*) ;; - *) - echo "Unexpected non-Actions container visible: $name" >&2 - exit 1 - ;; - esac - done - - workdir="$(mktemp -d)" - printf 'geo-intel-ci\n' > "${workdir}/proof.txt" - cat > "${workdir}/Dockerfile" <<'EOF' - FROM scratch - COPY proof.txt /proof.txt - EOF - tag="geointel-runner-diagnostic:${GITHUB_RUN_ID:-local}-${GITHUB_RUN_ATTEMPT:-1}" - docker build --pull=false -t "$tag" "${workdir}" - docker image inspect "$tag" --format '{{.Id}}' - docker image rm "$tag" >/dev/null