From 97fce89c002fe86e737ca7387170321d464b80d7 Mon Sep 17 00:00:00 2001 From: cesnimda Date: Wed, 9 Sep 2026 18:35:45 +0200 Subject: [PATCH] fix(ci): bootstrap Compose without a GitHub token --- .gitea/workflows/ci-deploy.yml | 21 ++++++++++++------- .../2026-09-07/validation/b06-completion.md | 4 +++- scripts/test-ingress.py | 2 +- 3 files changed, 17 insertions(+), 10 deletions(-) diff --git a/.gitea/workflows/ci-deploy.yml b/.gitea/workflows/ci-deploy.yml index 638a225..9b29234 100644 --- a/.gitea/workflows/ci-deploy.yml +++ b/.gitea/workflows/ci-deploy.yml @@ -56,14 +56,19 @@ jobs: node-version: '20' - name: Setup Compose for configuration checks - # This runner has no Docker CLI/daemon. The official action installs a - # standalone Compose CLI; rendering config never needs engine access. - uses: docker/setup-compose-action@2fe291b7677a45ee1269ec56a42604c143505e7e # v1 - with: - version: v5.3.1 - cache-binary: false - env: - GITHUB_TOKEN: '' # Public release download; never send a Gitea token to GitHub. + # No Docker daemon or GitHub token is required for config rendering. + # Pin the official Linux x86_64 release and verify before execution. + shell: bash + run: | + test "$(uname -m)" = x86_64 + compose_dir="$(mktemp -d)" + curl --fail --silent --show-error --location --retry 3 \ + https://github.com/docker/compose/releases/download/v5.3.1/docker-compose-linux-x86_64 \ + -o "$compose_dir/docker-compose" + echo "f9ebc6ebdb19d769b793c245a736caaeb198c62587f13b25c660c13b4987f959 $compose_dir/docker-compose" | sha256sum --check --strict + chmod +x "$compose_dir/docker-compose" + "$compose_dir/docker-compose" version + echo "$compose_dir" >> "$GITHUB_PATH" - name: Test repository safety scripts # Python standard library and Compose config rendering only; no services start. diff --git a/docs/audits/2026-09-07/validation/b06-completion.md b/docs/audits/2026-09-07/validation/b06-completion.md index fc8fa38..7fab4c6 100644 --- a/docs/audits/2026-09-07/validation/b06-completion.md +++ b/docs/audits/2026-09-07/validation/b06-completion.md @@ -313,6 +313,8 @@ The blocking items are therefore the unavailable local Docker engine, absent ver Connor subsequently authorized commit/push to live. B01–B06 were committed as `0954876`, and the redesign brief as `1bbbd05`; both were pushed to `main`. [Gitea run 736](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/736/jobs/1607) failed before backend/frontend testing: `scripts/test-ingress.py` raised `FileNotFoundError: 'docker'` in the runner. Deployment was skipped; the push was not a successful live rollout. -The workflow now installs pinned Compose v5.3.1 through the [official Docker setup action](https://github.com/docker/setup-compose-action), pinned to commit `2fe291b7677a45ee1269ec56a42604c143505e7e`. It installs the standalone `compose` command when Docker CLI is absent, without requiring engine access. Gitea tokens are not passed to the public GitHub download. The config test accepts that supported standalone command, retaining `docker compose` on existing Docker installations. Nothing is skipped and the production ingress gate remains unchanged. +The first correction (`f485f72`) attempted to install pinned Compose v5.3.1 through the [official Docker setup action](https://github.com/docker/setup-compose-action), pinned to commit `2fe291b7677a45ee1269ec56a42604c143505e7e`. Gitea tokens were deliberately not passed to GitHub. The config test accepts standalone Compose, retaining `docker compose` on existing Docker installations. Nothing is skipped and the production ingress gate remains unchanged. Validation before the corrective push: **3/3 tests through `docker compose` and 3/3 through the real standalone binary** with Docker discovery disabled for the latter fixture; tracked-secret scan and `git diff --check` pass. This corrects a CI dependency assumption; it neither repairs local Docker Desktop nor supplies any missing F04 deployment evidence. + +[Run 737](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/737/jobs/1609) then failed in the action itself: `Parameter token or opts.auth is required`; deployment again skipped. The final setup uses the [official standalone release](https://github.com/docker/compose/releases/tag/v5.3.1) directly, in a runner-local temporary directory. It pins Linux x86_64 and SHA-256 `f9ebc6ebdb19d769b793c245a736caaeb198c62587f13b25c660c13b4987f959`, verifies before execution, and needs neither a daemon nor an authentication token. A fresh local download matches that official release digest; 3/3 ingress config tests and diff validation pass. Runner execution and deployment are tracked separately from these local checks. diff --git a/scripts/test-ingress.py b/scripts/test-ingress.py index 5b447c8..e827ff5 100644 --- a/scripts/test-ingress.py +++ b/scripts/test-ingress.py @@ -25,7 +25,7 @@ class IngressConfigTests(unittest.TestCase): file.write("# No repository secrets are read by this fixture.\n") path = file.name try: - # docker/setup-compose-action supplies `compose` on runners without Docker. + # CI installs standalone Compose; developer machines can use the Docker plugin. command = ["docker", "compose"] if shutil.which("docker") else [shutil.which("compose") or "docker-compose"] base = command + ["--env-file", path, "-f", "docker-compose.yml"] def render(extra):