mu-ref/ci-workflows
8
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request 'fix(digest): digest 暂存改 mktemp（PLAT-014 二段，v5 前置）' (#3) from task/PLAT-014-digest-mktemp into main

Browse Source
This commit was merged in pull request #3.
This commit is contained in:
dsh-mulm
2026-08-31 13:41:00 +00:00
parent 973ed6cb99 4d9a785ec5
commit ff92951038
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/reusable/oci-build-push-verify.yml
+8 -5
View File
@@ -193,8 +193,11 @@ jobs:
set -eu set -eu
IMAGE_TAG="git-${GITHUB_SHA}" IMAGE_TAG="git-${GITHUB_SHA}"
printf '%s' "${GITHUB_SHA}" | grep -Eq '^[0-9a-f]{40}$' printf '%s' "${GITHUB_SHA}" | grep -Eq '^[0-9a-f]{40}$'
mkdir -p .tmp-ci # PLAT-014: the containerized install chowns the workspace to the
digest_file=".tmp-ci/digests.txt" # helper's node user, so a host-side mkdir in $PWD fails with EACCES
# on the non-root runner. Keep host-written scratch in mktemp space.
digest_dir="$(mktemp -d)"
digest_file="$digest_dir/digests.txt"
: >"$digest_file" : >"$digest_file"
cache_args="" cache_args=""
if [ -n "${CACHE_REGISTRY_REF}" ]; then if [ -n "${CACHE_REGISTRY_REF}" ]; then
@@ -248,7 +251,7 @@ jobs:
--provenance=mode=max \ --provenance=mode=max \
--sbom=true \ --sbom=true \
--push . --push .
manifest_file=".tmp-ci/index-${service}.json" manifest_file="${digest_dir}/index-${service}.json"
docker buildx imagetools inspect "${image}" --raw >"$manifest_file" docker buildx imagetools inspect "${image}" --raw >"$manifest_file"
if [ -n "${VERIFY_COMMAND}" ]; then if [ -n "${VERIFY_COMMAND}" ]; then
# VERIFY_COMMAND carries its own interpreter (e.g. "node x.mjs" # VERIFY_COMMAND carries its own interpreter (e.g. "node x.mjs"
@@ -284,8 +287,8 @@ jobs:
run: | run: |
set -eu set -eu
image_tag="git-${GITHUB_SHA}" image_tag="git-${GITHUB_SHA}"
digest_file=".tmp-ci/digests-script.txt" digest_dir="$(mktemp -d)"
mkdir -p .tmp-ci digest_file="${digest_dir}/digests-script.txt"
: >"$digest_file" : >"$digest_file"
while IFS='|' read -r service dockerfile target; do while IFS='|' read -r service dockerfile target; do
[ -n "${service:-}" ] || continue [ -n "${service:-}" ] || continue