Christian Manivong
9232b54c6d
CI / Tests, lint (push) Successful in 11s
base-os's nightly asks netOrk's matcher whether a rebuild improves on the pin (image_tools/verify.py). As an action, a workflow needs nothing of this repository but the pinned commit: no install, no checkout. A verdict that could not be reached fails the step, as it does in base-os since the two nights with an empty NETORK_LICENSE_KEY.
40 lines
1.6 KiB
YAML
40 lines
1.6 KiB
YAML
name: Judge a rebuild against the pin
|
|
description: >-
|
|
Whether a candidate improves on the pinned image, by netOrk's matcher in
|
|
kb-server (image_tools/verify.py). Writes verdict.json and report.md, prints
|
|
the report, and fails when no verdict could be reached. The caller passes
|
|
NETORK_LICENSE_KEY, and TRIVY_USERNAME/TRIVY_PASSWORD for the registry, as env.
|
|
inputs:
|
|
current:
|
|
description: The pinned image
|
|
required: true
|
|
candidate:
|
|
description: The rebuild
|
|
required: true
|
|
packages:
|
|
description: The packages the image may hold, for the CIS part of the verdict
|
|
default: packages.allow
|
|
outputs:
|
|
improved:
|
|
description: '"true" when the candidate improves on the pin'
|
|
value: ${{ steps.verdict.outputs.improved }}
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- id: verdict
|
|
shell: bash
|
|
env:
|
|
CURRENT: ${{ inputs.current }}
|
|
CANDIDATE: ${{ inputs.candidate }}
|
|
PACKAGES: ${{ inputs.packages }}
|
|
PYTHONPATH: ${{ github.action_path }}/../..
|
|
run: |
|
|
python3 -m image_tools.verify "$CURRENT" "$CANDIDATE" --packages "$PACKAGES" \
|
|
--json verdict.json --report report.md
|
|
# Into the log: Gitea shows no step summary.
|
|
cat report.md
|
|
cat report.md >> "$GITHUB_STEP_SUMMARY"
|
|
python3 -c "import json; print('improved=' + str(json.load(open('verdict.json'))['improved']).lower())" >> "$GITHUB_OUTPUT"
|
|
# A verdict that could not be reached is no "same": the step fails, so it is seen.
|
|
python3 -c "import json, sys; e = json.load(open('verdict.json'))['error']; sys.exit(f'no verdict: {e}' if e else 0)"
|