Miles WardandClaude Fable 5
b20949fcc9
Sync upstream and build image / sync-and-build (push) Successful in 2m18s
The Actions GITHUB_TOKEN can push git refs but the container registry rejects it (run 1 failure). Also adds a manual, never-executes-the-image forensic workflow comparing a third-party image on the runner host's daemon against the trusted build. Co-Authored-By: Claude Fable 5 <[email protected]>
98 lines
3.4 KiB
YAML
98 lines
3.4 KiB
YAML
name: Sync upstream and build image
|
|
|
|
# Keeps this repository current with the official upstream
|
|
# (https://github.com/deepseek-ai/deepseek-harness):
|
|
# 1. Mirrors upstream master and dsh-v* tags into this repo.
|
|
# 2. Reads the official npm dist-tag "latest" of @deepseek-ai/dsh.
|
|
# 3. If the Gitea container registry does not yet hold an image for that
|
|
# version, builds one from the pinned official npm release and pushes
|
|
# gitea.milesward.dev/mward4/deepseek-harness:<version> and :latest.
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '17 */6 * * *'
|
|
workflow_dispatch: {}
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- Dockerfile
|
|
- docker-entrypoint.sh
|
|
- .gitea/workflows/sync-upstream.yml
|
|
|
|
env:
|
|
UPSTREAM: https://github.com/deepseek-ai/deepseek-harness.git
|
|
REGISTRY: gitea.milesward.dev
|
|
IMAGE: mward4/deepseek-harness
|
|
|
|
jobs:
|
|
sync-and-build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Runner environment
|
|
run: |
|
|
uname -a
|
|
docker version || echo "NO DOCKER CLI"
|
|
node --version || true
|
|
|
|
- name: Checkout CI branch
|
|
uses: actions/checkout@v4
|
|
with:
|
|
ref: main
|
|
|
|
- name: Mirror upstream refs into this repository
|
|
env:
|
|
TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
set -eux
|
|
git clone --bare "$UPSTREAM" /tmp/upstream
|
|
cd /tmp/upstream
|
|
git remote add mirror "https://oauth2:${TOKEN}@${REGISTRY}/${IMAGE}.git"
|
|
git push mirror '+refs/heads/master:refs/heads/master'
|
|
git push mirror '+refs/tags/dsh-v*:refs/tags/dsh-v*'
|
|
|
|
- name: Resolve official release version
|
|
id: version
|
|
run: |
|
|
set -eu
|
|
VERSION=$(npm view @deepseek-ai/dsh@latest version)
|
|
echo "official npm latest: $VERSION"
|
|
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Check registry for existing image
|
|
id: exists
|
|
env:
|
|
TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
set -eu
|
|
CODE=$(curl -s -o /dev/null -w '%{http_code}' \
|
|
-u "${{ github.repository_owner }}:${TOKEN}" \
|
|
-H 'Accept: application/vnd.oci.image.index.v1+json' \
|
|
-H 'Accept: application/vnd.oci.image.manifest.v1+json' \
|
|
-H 'Accept: application/vnd.docker.distribution.manifest.list.v2+json' \
|
|
-H 'Accept: application/vnd.docker.distribution.manifest.v2+json' \
|
|
"https://${REGISTRY}/v2/${IMAGE}/manifests/${{ steps.version.outputs.version }}")
|
|
echo "manifest HTTP $CODE"
|
|
if [ "$CODE" = "200" ]; then
|
|
echo "exists=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "exists=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Build and push image
|
|
if: steps.exists.outputs.exists == 'false'
|
|
env:
|
|
# Dedicated write:package token; the ephemeral GITHUB_TOKEN can push
|
|
# git refs but is not accepted by the container registry.
|
|
TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
VERSION: ${{ steps.version.outputs.version }}
|
|
run: |
|
|
set -eux
|
|
echo "$TOKEN" | docker login "$REGISTRY" -u "${{ github.repository_owner }}" --password-stdin
|
|
docker build \
|
|
--build-arg "DSH_VERSION=${VERSION}" \
|
|
-t "${REGISTRY}/${IMAGE}:${VERSION}" \
|
|
-t "${REGISTRY}/${IMAGE}:latest" \
|
|
.
|
|
docker push "${REGISTRY}/${IMAGE}:${VERSION}"
|
|
docker push "${REGISTRY}/${IMAGE}:latest"
|