+26

.tangled/workflows/notify.yml

reviewed

··· 1 1 + image: busybox:1 2 2 + architecture: arm64 3 3 + 4 4 + when: 5 5 + - event: ["push"] 6 6 + branch: ["main"] 7 7 + 8 8 + engine: "kubernetes" 9 9 + 10 10 + # TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID come from Loom's secret vault 11 11 + steps: 12 12 + - name: Send Telegram notification 13 13 + command: | 14 14 + SHORT_SHA=$(printf '%.7s' "$TANGLED_COMMIT_SHA") 15 15 + 16 16 + text="*Push to $TANGLED_REPO_NAME* 17 17 + Branch: \`$TANGLED_REF_NAME\` 18 18 + 19 19 + \`$SHORT_SHA\` $TANGLED_COMMIT_MESSAGE" 20 20 + 21 21 + json_text=$(printf '%s' "$text" | sed 's/\\/\\\\/g; s/"/\\"/g' | awk 'NR>1{printf "\\n"}{printf "%s",$0}') 22 22 + 23 23 + wget -q -O /dev/null \ 24 24 + --header='Content-Type: application/json' \ 25 25 + --post-data="{\"chat_id\":\"$TELEGRAM_CHAT_ID\",\"text\":\"$json_text\",\"parse_mode\":\"Markdown\"}" \ 26 26 + "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage"

-16

.tangled/workflows/test.yml

reviewed

··· 1 1 - when: 2 2 - - event: ["push"] 3 3 - tag: ["v*"] 4 4 - branch : ["*"] 5 5 - 6 6 - engine: kubernetes 7 7 - image: busybox:1 8 8 - architecture: arm64 9 9 - 10 10 - environment: 11 11 - IMAGE_REGISTRY: atcr.io 12 12 - 13 13 - steps: 14 14 - - name: test environment vars 15 15 - command: | 16 16 - printenv

+1 -1

k8s/ci/loom-rbac.yaml

reviewed

··· 8 8 apiVersion: v1 9 9 kind: ServiceAccount 10 10 metadata: 11 11 - name: loom-job 11 11 + name: loom-spindle-job-runner 12 12 namespace: ci 13 13 automountServiceAccountToken: false 14 14 ---

+2 -1

k8s/knot/deployment.yaml

reviewed

··· 26 26 subPath: sshd-keys 27 27 containers: 28 28 - name: knot 29 29 - image: tngl/knot:v1.10.0-alpha 29 29 + image: zot.sans-self.org/infra/knot:latest 30 30 ports: 31 31 - name: http 32 32 containerPort: 5555 ··· 84 84 - name: sshd-hardening 85 85 configMap: 86 86 name: sshd-hardening 87 87 +