mirror of
https://github.com/mudler/LocalAI.git
synced 2026-09-30 10:04:32 -04:00
localai-org-maint-botandlocalai-org-maint-bot
490b952d06
* feat(gallery): publish signed OCI fallbacks Publish both official gallery indexes with their local base configs so an outage of the HTTP and GitHub sources can fall back to Quay. Keep artifact signing policies separate from backend image policies, and expose each moving gallery tag only after its digest is signed. Assisted-by: Codex:gpt-6 * fix(gallery): confine packaged files to selected roots Use directory-scoped file access to reject symlink escapes during gallery packaging. Create private bundle files for the publishing runner. Assisted-by: Codex:GPT-6 --------- Co-authored-by: localai-org-maint-bot <306269227+localai-org-maint-bot@users.noreply.github.com>
79 lines
2.4 KiB
YAML
79 lines
2.4 KiB
YAML
name: Publish official OCI galleries
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
paths:
|
|
- 'gallery/**'
|
|
- 'backend/index.yaml'
|
|
- 'scripts/build/gallery/**'
|
|
- '.github/workflows/gallery_publish.yml'
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: publish-official-galleries
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
publish:
|
|
if: github.repository == 'mudler/LocalAI' && github.ref == 'refs/heads/master'
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
env:
|
|
COSIGN_EXPERIMENTAL: '1'
|
|
GALLERY_REPOSITORY: quay.io/go-skynet/local-ai-backends
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- source: gallery
|
|
tag: gallery-models
|
|
- source: backend
|
|
tag: gallery-backends
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: go.mod
|
|
- name: Test and package gallery
|
|
env:
|
|
GALLERY_SOURCE: ${{ matrix.source }}
|
|
run: |
|
|
go test ./scripts/build/gallery -count=1
|
|
go run ./scripts/build/gallery . "$GALLERY_SOURCE" "$RUNNER_TEMP/gallery"
|
|
- uses: oras-project/setup-oras@v1
|
|
with:
|
|
version: '1.3.0'
|
|
- uses: sigstore/cosign-installer@v3
|
|
with:
|
|
cosign-release: 'v2.6.5'
|
|
- name: Login to Quay.io
|
|
uses: docker/login-action@v4
|
|
with:
|
|
registry: quay.io
|
|
username: ${{ secrets.LOCALAI_REGISTRY_USERNAME }}
|
|
password: ${{ secrets.LOCALAI_REGISTRY_PASSWORD }}
|
|
- name: Publish and sign gallery
|
|
shell: bash
|
|
env:
|
|
GALLERY_TAG: ${{ matrix.tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
cd "$RUNNER_TEMP/gallery"
|
|
files=()
|
|
while IFS= read -r -d '' file; do
|
|
files+=("${file#./}:application/yaml")
|
|
done < <(find . -type f -print0 | sort -z)
|
|
# Publish an immutable revision, then expose latest only after signing.
|
|
ref="$GALLERY_REPOSITORY:$GALLERY_TAG-$GITHUB_SHA"
|
|
oras push --artifact-type application/vnd.localai.gallery.v1 \
|
|
--format json "$ref" "${files[@]}" > "$RUNNER_TEMP/push.json"
|
|
digest=$(jq -er '.digest' "$RUNNER_TEMP/push.json")
|
|
cosign sign --yes --new-bundle-format \
|
|
--registry-referrers-mode=oci-1-1 "$GALLERY_REPOSITORY@$digest"
|
|
oras tag "$GALLERY_REPOSITORY@$digest" "$GALLERY_TAG"
|