commit b05ae4aad248d9a9a38aa264f7bbf1f0036c4c1e
parent 96b51d26e00e1c8d1616d6148546eaf1a04b799d
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Wed, 25 Mar 2026 21:47:13 +0100
fix image scanning and make bookwyrm behave like the other image build tasks
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
3 files changed, 28 insertions(+), 24 deletions(-)
diff --git a/.github/workflows/build-bookwyrm.yaml b/.github/workflows/build-bookwyrm.yaml
@@ -1,6 +1,10 @@
name: Build Bookwyrm Image
on:
+ push:
+ branches: ["main"]
+ paths:
+ - ".github/workflows/build-bookwyrm.yaml"
schedule:
# Check for new upstream releases daily at 04:00 UTC
- cron: "0 4 * * *"
diff --git a/infrastructure_talos/controllers/zot/release.yaml b/infrastructure_talos/controllers/zot/release.yaml
@@ -38,7 +38,7 @@ spec:
memory: 64Mi
limits:
cpu: "1"
- memory: 512Mi
+ memory: 1Gi
# Mount zot-secret at /etc/zot — provides config.json (with real S3 creds) and htpasswd
externalSecrets:
diff --git a/infrastructure_talos/controllers/zot/secret.yaml b/infrastructure_talos/controllers/zot/secret.yaml
@@ -1,28 +1,28 @@
apiVersion: v1
kind: Secret
metadata:
- name: zot-secret
- namespace: zot
+ name: zot-secret
+ namespace: zot
stringData:
- htpasswd: ENC[AES256_GCM,data:wuLopBJVuUUuUIoHBbJfcvi5NZMrNkFUvr5JCe29BGZeoDQDEGjYZEMG+CE+4fR5tH6OlP3wnA3jNt19sTSYdLytJQ==,iv:7PwemWGiCqu0GPG/r8eY3gkNSB1lNReHfHP5N+zveSY=,tag:2W1d8vSqkRe8cUVcR0w5lw==,type:str]
- config.json: ENC[AES256_GCM,data:UkmFe1P6hRxP9nUJ49LaYQ95Oun9AgnfAO2uvyQwYsKtYmupJKCwRBi8Ta7TZTfFyQBO//nAWKihwdS/l+nUhV6GjdY3hEneGi6xLPMO9xsmWTRiSr4fQ3j7F+5PnEKcg/C3wSrSvUPADCVWEu9JgHuZ0cihifwObPEN5+JkUj8fpwcjFB3b/6uXsRJnuckMDJXHaqXdz5jMjQ1/FNHOXb6AEb8sCyrr1eumyZUYdL2tphVfGzKkE/oz/sj7RGQEQ2XoKanZYu7H52whafE3DI+cE51g9ag1quqwGBZ/BVeXPwTu61JoN2D7mRLoOi+F88jI6e20GYwKLodHJ9fQ8aYKpL63daDmrOBO+YziJJF3R5qTXoAObas4njjPWXbI0I5Lw1cSCUUAIaPc8FeUM92RzJZl9wlLN4ksZ2aLMQpiAjibx9oFZ3TT7hIw/jiwDB3WmuoOW0/e9yd6fByJCL6HiPmKJe8R1/HYYFgMzuMgPLT3gaw52bnZ7JzXXZvOHfxzzvH3RtINmKsT41kP7PSPzgaGTM4su+jfj5d19wggbpKBg/PUHH6v1yKRsHg58Es7ro+VBGZu+EwjXExS815DOg/qM3erCLRRh6wTQVydjEB50Rr22veTMQU/Zq1CsQJYuWw36zJ5avfH7feUWZjctVg1mYQeVDJ9Deqia5sdCLq7gGJ9eg6rjtoCRULJhj9SmptjvxAyFi1XAbqjFIzl3fWTyAQ86KVgBDENlqPzzb3euqU3cHzkYS0NAj+dSwen+X8zc2IipxGuMRGu0vu5F64BX1dmMVNTTuqQpv6ypvgDlrLSnOFJOxg4SwRzLVK8RrzXgR8J1F9/GIEVjVonvLK8BcydYVEqLxIxjirKN1wdE7ZTVg2QnmipKohiqaZ1cp7ax/wI2YQ+EDBmFR1sOs5Bsaee9se8vywPveTS1VrKQCOi/6qbGdZgkqxn743IafjuA1aJ1Q0NSxmJ4pW34/q3nODQ1yTiwKYRxZgtYjmSZ3YRBhia3ZbuBxqe6unO6iKhgRQZ7rJjLGuQM0E1xWB10kBDfyeBjwoLPcs2xfhxGHGigO7pWcB8jPTfhsnvEo64VTNIgvhpRfJVkmcyzAzBFCJwsQ95mbr2lj70BQH5jcNVYFvJdxGdvQx33Uq/44qBsx7m55ZU80bGQnKx+Z0QjDQH1fIn7Bxy+pEl0iVYTUozN2yyljoAOadaNRQAQSVl3NcQT3FqLZ00XA9F3wGzQ/xwHA1RO/kCeq9CZN9KrzRDbMNoGiKb7uGFy+0z33xobMTDtFLP0lvrA2dlsGCSmbzfeBXwW6xWzM//ktCkSMYSldBz8r5E42r79TsuFCocD/o5V/9kmaKUe8FKwU33MrN91I1mEQqLo6HRpwmO8faZeDfYkCh3ITsitC7zQ62dsKUeYNs2nKoafPNQ6knT+XP/1W8VzkaGfhYT6YgmcOgrXyDNwjAzJCXG4k5yWdR9m29Nzxi2GsjsJfuSyzCb0ILwSOTX4nR0o5XPIaBnxkC8GrYBApfH5aTPBL5D+HDNQWLOFEE6WQP6DQPj8z+zEKz2DSKL97bk7iEiP9Mln7cGNmnIIBfglqcaUcAxHQ5CnFiaNKtIUrj/kdtqu5bmPTYbmSvZwJrlsbFmpTLBe1t+Z5e5nowxHNGNohBjL/Buz2lSQKs/jAGL1ZS9s3uDpJWzgTvQzuKxgn8wJ7MhbFGrqLsGPWN/q1h5iBUWDIdQvdEwbv5k4QNeMzYuKg==,iv:va34teQuF2XFV5XHYSMarB03Ya+P4w9INBpB/r6xtjw=,tag:2Dz8NbQ/mr9UCjHypgfVNw==,type:str]
+ htpasswd: ENC[AES256_GCM,data:NGSUsJ23LoZQYqIVu7UgXYXvMXI/pfVC0ECC8x/ByJC7aKfBwYzVQY1AIDsZG768ga/isR0hPcdDedyz4LH4D9TYBw==,iv:LjttcsUt6ESQiF39M7D4/97bnYrRuw13RblTotQNf5o=,tag:UUdvynw11qqkUSwCvzoQtg==,type:str]
+ config.json: ENC[AES256_GCM,data:aos/U2NPTQrrVlKnFYOBVvQOVG1Pu1vSFEp/kTPfLiVl1zltnRdRKAYYSNR9Qufjsh5DXJdx1wQ6xFV7ik7MbHG0yYuxCyLJGkoc2dBZCGYDTl8F/A2+NeXsHewhliz3wKvIpowVzqGYDGQr2vYayxvbV4OWss514Q74rF8ikB4F9gFWF1FkJB6JXO987s25ZJlQoE7Ya8ic+u+2zfV5CvXeT0mwstS0bTkM112Mp2XCU943T7SiAGdTZpxjxIRDFFeZthapuVqmraX7CL83lr2khHZ97wDG+eYnyH8IhDCv2B7jSUmyCt5pkIHqaTQAfyX4LKnH0h46CJ65+vByIiNbnhwL0LEwp06tYfT7sQ3FL5mcP6RuWtNy01P0YHQUi8reQQvvXmoR36q3EaRdFK+3ojgewanQtBMbu4TGd8HQecHx0/DBcE5LaLHKCAI3RTEHK+X/JI8u7QFDU+fGWCbYveBkxdRZ4n+OzgfDK2Rcl9qfhxLxY6nxsmKUlVGQ60LIePeVE2AHtV1mCqMZL11dW63eLKCRmyE9uVOIzXYVFv61WtZyFLqIlOjVqvRuvZRXcNwTCP0UHEjKQz7yCyQ46tsoRH3GlsaRcif4q6yHCES5PYg0Qw9NCP6X4zklKjcLAjfsH32TFDJCUW0n03PXDDWHTU45c6JDvqaeyD6sQSFYDb8wi1R7Hys1anhTw0xgrFJuHnyXc5VPK+4TLJD5jTwG2ckUHCbSbCFKwZ/nxkCXz62wGUv9hm2bSfDRj3lwEM/sjUYsISMBFTMWZCTBBHb5RAtKQW6vmZs7YVPGXVjCyS5ojk9COOFDBKiaIrzT1HzgJiiIfRStv5t61GGtne7sRcQEipI3H2TE7PeYs2e9jGVphFALenThNUjFJus63eqsxGIXn1RZJjwqLk/nhv7vS1YxlEKUYD43SlSjLL6ZSy96PkafPAwZ23MTbW6+l+tBStyKsEGbG/VPxEAYn1GbSeCqdo/5GFPEmLnhxm3t0Yvxv+9+rFWByvTNDIzjai8aJrj2ltsPCKJAdCV2+EoRa83ztgqi67FgvEFY/zWwnfQMC/X+eEVzJhNHaSkWUVkrbeybgB6LKgxTTU+s66T5gfEed1Q/81qLB6NTDQy5tR+/nQrjRkkzOQg9iSbSgj+0xzvm0iPLr8a9gUMRGV2lAxVozC9pLz6SULwH83E1YnYXnnLVCSSD3kxJOazMlfju71W2GStkgq0+O40sjIwUyCnfd8Z6qakqq05dk2c2lB5vKHQmLd/cdrT0PeIOcYL2+vpVgEERjOhhu63ipFXwU3dXs9gA1w4lmn0gALqcaL86GNkZhIUbjYmjEESQbF+J0dNNMBedhcqTjQN+JbbvAOVRzZ1PfjYHS7B5ZbiA3wfWAquW7aEAc11ix+szfOWBjV7tzHp8OMrppzBgX+otEddHfzD4rkHD4qcbCEXs4HTct+AuLSZoZbQkjNs98K7yqm52nm/S86XJSjwQ2vt6CysmG0IxURZgb1pkJdPe5IUrWuyeWZs7NVdS/0GhH9T0yb2NNovu+0/79sXFW5WQgOravf6jnP+qfq77NL3XbydwXkEDxkDl8tUwjCF7PQU5Y2XE8XZXP1iDPmnCcAesU7lf5To250V6yJ7ueupQXEL9NGjwkifS+YsbrQxrslo3LHcB94WXAM4Vlk3NbsmPfbUANSEhS5smVd7hCqDoE+StPAiizHkHe9e7JQzY3u2KmVH9cZuiDoft3FMiYUxaKUj4AMQnoXkkdTfhiEO9GZuXVhw+Eqy4Y2hsuJot3JtpOyJvLM7+fOCGaNb+DwOLgX2x0tvr,iv:BVmzMkrTV7vxno+kay6c7YrT82P8XMMfSsPpbfM+l5I=,tag:ulDjYeO7PGVkiOHRKJH+5g==,type:str]
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpUXNEcTg5YU9mQTNBV1Fp
- RnNjazg4NG5hdXh4ZU5iS1lSYUtkZjJKVzA4Cm9aSVY5TDBYeE9DbW16czRLa3Ax
- MUV5ekdiOHlKWGZDOUFzWnMwczYxRzQKLS0tIEgycmV5cHdaQ0l0bnBWWUc3Nmoz
- Sm1GdUxCYnpZT3RPdEtCWWR5a2pzR1UK/q5JRcwxWfc+wymf7Y6vxAcnL1mXdU3O
- 31/Eduq7wQNCHaU1OmZHrlRwp8G7hklloeft7Ji6EtG9O+BxAPPo/w==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-03-25T20:28:17Z"
- mac: ENC[AES256_GCM,data:fSn/wEVrRIbdaiQ1uhd2WLaPE73m4eabqEc2gqXPySH2wSxxh/3gqyqGlw8YOxqYwjUHOVQdY3cQdvUgQw6sxB4NZA1Pl1pJmPPAzPK5IwBSunZqDSwuaMnTK57ISHoIAplQK72YKLYrKaY+IOe86I0+EIL/Hon07oP4Ei9qbls=,iv:IocOCa09oOopB3gPvSH8ACSLBlliSWSCLjSYtsfz2vk=,tag:aaGazYrJNIOMdf6BitUhjA==,type:str]
- pgp: []
- encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|smtp_auth_password|addresses|smtp_auth_username|authorization_credentials|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|integration_key|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxdndvV3d3ck5MK1RveWZM
+ RVovOGRtNnQyYjc2V1lEU0ZFbytFOFVKdVJzCnN6UkJ1NGVEQUw1azhuQytBNE9J
+ NktnN2xMSWF4STJ5eTU3Y3lqTmZXVzAKLS0tIGc3Vm9uZ0NSdzV3dEpnRC9JbzRr
+ OS91bk5pdjdCZHoxNnlRakNNOXA4bGsKjHfI8zZHvzcZKC6S7UBMiMa2xcuz2vIW
+ P0NxmOf4NJTjXU5uVMJ+NNb1dbjGqjJAS/BRm1jrWynupa1ussj1aA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-03-25T20:45:58Z"
+ mac: ENC[AES256_GCM,data:20Iu3QOlIdbbY7e0Y0VvMuRnO9M1yZkliRmU2sSp/Kvcol6IJ15r42zLxIT8NGDHQVkaQk3JYhlfeSrYCKOsOru/raLbXx17chpK/Tyvqp+GJC7xpY7tJPyvU6WRoBOTRfXSDm6PxL3P1v6QpdqKkQH3EWCp/LAbYN6x7Pjap7s=,iv:fDjakRkdgZFeerMDRTf2XT2O2yuGYSx6l2vD9mhYtkk=,tag:rsfrncVEI/Cj9FtYA9LYhg==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|smtp_auth_password|addresses|smtp_auth_username|authorization_credentials|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|integration_key|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
