refactor: drop runtime apk installs, build OCI images via kaniko Jobs #11

Merged

crypt merged 2 commits from refactor/nonroot-ci into main 2026-10-03 20:31:07 +00:00

Conversation 0 Commits 2 Files changed 2 +182 -57

crypt commented 2026-10-03 20:14:46 +00:00

Owner

Copy link

Prepares this repo's CI for non-root forgejo runners (part of the CI overhaul, prerequisite for de-privileging the runner pool):

• ci.yml: JDK 21 and Helm are bundled in the runner image (willowcrest-homelab PR #136) - no apk add; golangci-lint installs to GOPATH/bin instead of /usr/local/bin (root-only)
• release.yml: staged artifacts (shadow jars, sportpaper.jar, controller binary) upload to the Forgejo generic packages registry, then five ephemeral kaniko Jobs in kaniko-build clone the repo and download what they need before building - replaces in-runner buildah (root + SYS_ADMIN)
• release.yml chart job: helm/python3/py3-yaml are bundled in the runner image

Note: the images job needs a repo-level CI_TOKEN Actions secret (already created) for the kaniko clone.

Prepares this repo's CI for non-root forgejo runners (part of the CI overhaul, prerequisite for de-privileging the runner pool): - **ci.yml**: JDK 21 and Helm are bundled in the runner image (willowcrest-homelab PR #136) - no apk add; golangci-lint installs to GOPATH/bin instead of /usr/local/bin (root-only) - **release.yml**: staged artifacts (shadow jars, sportpaper.jar, controller binary) upload to the Forgejo generic packages registry, then five ephemeral kaniko Jobs in kaniko-build clone the repo and download what they need before building - replaces in-runner buildah (root + SYS_ADMIN) - **release.yml** chart job: helm/python3/py3-yaml are bundled in the runner image Note: the images job needs a repo-level `CI_TOKEN` Actions secret (already created) for the kaniko clone.

crypt added 1 commit 2026-10-03 20:14:46 +00:00

refactor: drop runtime apk installs, build OCI images via kaniko Jobs ... 50d61e9948

Prepares this repo's CI for non-root forgejo runners:

- ci.yml: JDK 21 and Helm are bundled in the runner image (no apk
  add); golangci-lint installs to GOPATH/bin instead of /usr/local/bin
- release.yml: staged artifacts (shadow jars, sportpaper.jar,
  controller binary) are uploaded to the Forgejo generic packages
  registry instead of being copied into local build contexts, then
  five ephemeral kaniko Jobs in kaniko-build clone the repo and
  download what they need before building (replaces in-runner
  buildah)
- release.yml chart job: helm/python3/py3-yaml are bundled

Prerequisite for de-privileging the runner pool (non-root + baseline
PSA + ephemeral mode).

crypt added 1 commit 2026-10-03 20:20:39 +00:00

ci: re-run against runner image with bundled JDK 28df7a508b

crypt merged commit 4d9d4a81a5 into main 2026-10-03 20:31:07 +00:00

crypt deleted branch refactor/nonroot-ci 2026-10-03 20:31:07 +00:00

crypt referenced this pull request from a commit 2026-10-03 20:31:09 +00:00

refactor: drop runtime apk installs, build OCI images via kaniko Jobs (#11)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

crypt/k8s-mcsg-uhc!11

No description provided.