root/hitoma-dyndns
Watch
1
0
Fork
You've already forked hitoma-dyndns
 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions
No description
8 commits 2 branches 0 tags 82 KiB
  • Shell 50.5%
  • Dockerfile 49.5%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Shawn McNaughton 0769194aa3
All checks were successful
Build and publish image / upstream (push) Successful in 1s
Details
Build and publish image / image (push) Successful in 0s
Details
Describe the runner's Docker daemon accurately 
Jobs reach a docker:dind sidecar over DOCKER_HOST rather than a host
Docker socket.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-12 23:15:19 -04:00
.forgejo/workflows Queue overlapping builds instead of running them together 2026-10-12 22:23:27 -04:00
test Describe the runner's Docker daemon accurately 2026-10-12 23:15:19 -04:00
Dockerfile Build with current stable Go and email on failed runs 2026-10-12 11:57:10 -04:00
README.md Describe the runner's Docker daemon accurately 2026-10-12 23:15:19 -04:00

README.md

hitoma-dyndns

vulnerabilities

qdm12/ddns-updater rebuilt from its latest release with the current stable Go (golang:alpine) and the latest golang.org/x/net, x/sys and x/crypto, so CVE fixes land without waiting for an upstream release. Runtime behaviour and environment variables match upstream.

docker pull forgejo.hitoma.com/root/hitoma-dyndns:latest

Tests

Every build has to pass both of these before it's pushed:

  • test/verify-image.sh, which needs no network:
    • the image runs as a non-root user
    • the binary reports the release it was built from, matching the image's version label
    • the binary carries its own CA roots, which it needs because the image is FROM scratch
  • test/smoke.sh, which starts the updater with an empty config, so no DNS provider is contacted:
    • the web UI loads, and the healthcheck subcommand passes
    • the config is written to the data directory, so it's writable by the non-root user
    • the logs show no errors

Both run locally too: test/verify-image.sh IMAGE, then test/smoke.sh IMAGE.

CI

.forgejo/workflows/build.yml builds on every push to main, weekly (Monday 06:37 UTC, without cache, to pick up Go and module updates), and on manual dispatch. Dispatch takes an optional version input to build a specific upstream tag; otherwise the latest GitHub release is used. Pull requests are built and tested but not pushed. The workflow only resolves the upstream tag. Building, testing, scanning and pushing happen in the shared hitoma-image-ci pipeline.

Tags: latest, the upstream release (e.g. v2.10.0), YYYYMMDD, and sha-<short>.

Each build is scanned with Trivy after it passes the tests. Builds of main force-push the badge above and the full JSON report to the single-commit badges branch. The run fails when there are fixable HIGH or CRITICAL findings. The image is still pushed, but the red run shows that a Go or module bump is needed.

Go isn't pinned to upstream's go.mod minimum because the latest golang.org/x modules only support the two newest Go releases. If a module bump breaks the build, the job fails and latest stays on the last good image.

Setup:

  • Repository secrets REGISTRY_USER and REGISTRY_TOKEN (a Forgejo access token with write:package scope).
  • A Forgejo runner with the docker label whose job containers can reach a Docker daemon, such as a docker:dind sidecar through DOCKER_HOST.
  • Actions enabled on the repository (Settings → Units → Actions).