From 75feed24176d841330abf129e3b4d613a42c090b Mon Sep 17 00:00:00 2001 From: Sharang Parnerkar Date: Wed, 22 Jul 2026 07:43:56 +0000 Subject: [PATCH 1/2] ci: fix cosign install (curl->wget fallback), env-style registry login, portal sign step --- .gitea/workflows/ci.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index d044b09..daed935 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -9,6 +9,13 @@ on: - main env: + # registry + cosign creds via env, NOT inline ${{ }}: the Harbor robot + # username contains '$', which sh expands when interpolated into the + # script (robot$ci-push -> robot-push) => docker login unauthorized. + REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }} + REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }} + COSIGN_KEY: ${{ secrets.COSIGN_KEY }} + COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} CARGO_TERM_COLOR: always RUSTFLAGS: "-D warnings" # sccache caches compilation artifacts within a job so that compiling @@ -278,7 +285,8 @@ jobs: docker login repo.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin docker build -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" . docker push "$IMAGE:latest" - command -v cosign >/dev/null 2>&1 || { curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 && chmod +x /usr/local/bin/cosign; } + { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed" + chmod +x /usr/local/bin/cosign 2>/dev/null || true cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed" docker push "$IMAGE:${GITHUB_SHA}" - name: Trigger orca redeploy -- 2.54.0 From a2bc551ef9d2bf67e4be1be01fed14ed7bf1a4db Mon Sep 17 00:00:00 2001 From: Sharang Parnerkar Date: Wed, 22 Jul 2026 07:45:26 +0000 Subject: [PATCH 2/2] ci: certifai login via env vars too (two-line variant) --- .gitea/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index daed935..cdafbff 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -281,8 +281,8 @@ jobs: - name: Build and push image run: | IMAGE=repo.meghsakha.com/certifai/certifai-dashboard - echo "${{ secrets.REGISTRY_PASSWORD }}" | \ - docker login repo.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin + echo "$REGISTRY_PASSWORD" | \ + docker login repo.meghsakha.com -u "$REGISTRY_USERNAME" --password-stdin docker build -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" . docker push "$IMAGE:latest" { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed" -- 2.54.0