oap/kartuli-ena
Watch
1
0
Fork
You've already forked kartuli-ena
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ci: run publish on the docker label, not on the host #3

Merged
oap merged 1 commit from publish-on-docker into main 2026-10-11 20:48:15 -07:00
Conversation 0 Commits 1 Files changed 1 +12 -2
oap commented 2026-10-11 20:44:19 -07:00
Owner
Copy link

Part of oap/nix-config#130 (the "Optional" item).

Problem

The bump job ran on the nix label: on the nixos host, as gitea-runner. All host jobs share that uid, so any other host job could read KVARTSI_TOKEN while this job ran.

Change

  • runs-on: docker: a new rootless podman container (uid 900, egress to public 80/443 only). The job uses only git, so it does not need the host.
  • New first step: apk add --no-cache git, because the image is node:22-alpine. kvartsi's build job does the same.
  • Both steps use shell: sh. The image has no bash. The script is POSIX, and set -euo pipefail works in BusyBox sh. I checked this with busybox sh -n (BusyBox 1.37.0).

Test

The job runs only on a push to main, so this PR runs no CI. The first real test is the merge, or the next vault backup after it. Check that the run passes, and that kvartsi v5 gets a content: <sha> commit.

If the run fails, revert this commit. The old nix job still works.

🤖 Generated with Claude Code

Part of oap/nix-config#130 (the "Optional" item). ## Problem The `bump` job ran on the `nix` label: on the nixos host, as `gitea-runner`. All host jobs share that uid, so any other host job could read `KVARTSI_TOKEN` while this job ran. ## Change - `runs-on: docker`: a new rootless podman container (uid 900, egress to public 80/443 only). The job uses only git, so it does not need the host. - New first step: `apk add --no-cache git`, because the image is `node:22-alpine`. kvartsi's `build` job does the same. - Both steps use `shell: sh`. The image has no bash. The script is POSIX, and `set -euo pipefail` works in BusyBox `sh`. I checked this with `busybox sh -n` (BusyBox 1.37.0). ## Test The job runs only on a push to `main`, so this PR runs no CI. The first real test is the merge, or the next vault backup after it. Check that the run passes, and that kvartsi `v5` gets a `content: <sha>` commit. If the run fails, revert this commit. The old `nix` job still works. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
ci: run publish on the docker label, not on the host
All checks were successful
publish / bump (push) Successful in 11s
Details
53d48df3b2
 
Problem: the publish job ran on the `nix` label, so KVARTSI_TOKEN was on
the shared gitea-runner uid. Every other host job could read it
(oap/nix-config#130).

Solution: run the job in a rootless podman container on the `docker`
label. Install git with apk, and run both steps with BusyBox sh.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
oap merged commit 53d48df3b2 into main 2026-10-11 20:48:15 -07:00
oap deleted branch publish-on-docker 2026-10-11 20:48:15 -07:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
oap/kartuli-ena!3
No description provided.