denozord/EvoBGP
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 131 Wiki Activity

chore: update CI configuration to disable filesystem entitlement for Docker builds
CI / changes (push) Successful in 7s
Details
CI / openapi (push) Has been skipped
Details
CI / go (push) Successful in 25s
Details
CI / docker-web (push) Failing after 16s
Details
CI / docker-bird (push) Failing after 16s
Details
CI / bird2 (push) Successful in 16s
Details
CI / docker-go (push) Failing after 14s
Details

Browse Source 
Added the BUILDX_BAKE_ENTITLEMENTS_FS environment variable set to "0" in the CI workflow to allow Docker builds to read the repository context. Updated the README to clarify this change and provide guidance on local usage for similar issues.
This commit is contained in:
Denozordec
2026-05-19 10:53:51 +07:00
parent 6025f383f1
commit 9ab7de65ce
2 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci.yaml
+4
View File
@@ -225,6 +225,8 @@ jobs:
SHA_FULL: ${{ github.sha }}
CACHE_REF_GO: git.shts.su/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache:go-buildcache
CACHE_REF_WEB: ""
# buildx bake: context ../.. (корень репо) — на доверенном CI отключаем fs entitlement gate
BUILDX_BAKE_ENTITLEMENTS_FS: "0"
run: |
set -euxo pipefail
cd "${{ github.workspace }}/deploy/docker"
@@ -267,6 +269,7 @@ jobs:
SHA_FULL: ${{ github.sha }}
CACHE_REF_GO: ""
CACHE_REF_WEB: git.shts.su/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache:web-buildcache
BUILDX_BAKE_ENTITLEMENTS_FS: "0"
run: |
set -euxo pipefail
cd "${{ github.workspace }}/deploy/docker"
@@ -310,6 +313,7 @@ jobs:
SHA_FULL: ${{ github.sha }}
CACHE_REF_GO: ""
CACHE_REF_WEB: ""
BUILDX_BAKE_ENTITLEMENTS_FS: "0"
run: |
set -euxo pipefail
cd "${{ github.workspace }}/deploy/docker"
deploy/docker/README.md
+1 -1
View File
@@ -32,7 +32,7 @@ docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl go-images
docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl web-images
```
**CI:** на runner без `buildx bake --var` скрипт `write-bake-override.sh` генерирует `docker-bake.override.hcl` с нужными `variable` (файл не коммитится). Альтернатива на новом buildx: `--var REGISTRY=…` (см. `docker buildx bake --help`).
**CI:** на runner без `buildx bake --var` скрипт `write-bake-override.sh` генерирует `docker-bake.override.hcl`. В workflow задано `BUILDX_BAKE_ENTITLEMENTS_FS=0`, чтобы bake мог читать `context = "../.."` (корень репозитория). Локально при той же ошибке: `docker buildx bake --allow=fs.read=* …` или `export BUILDX_BAKE_ENTITLEMENTS_FS=0`.
Один образ (legacy):