docker-pnpm/.drone.yml
Lukas | AstroGD b031dc1ac3
feat: Second registry, security hardening
- Added second registry
- Added non-root user
- Added supply-chain attestation flags
2025-02-23 17:58:02 +01:00

148 lines
3.3 KiB
YAML

---
kind: pipeline
type: docker
name: build
trigger:
event:
- push
branch:
- main
steps:
- name: build-lts
image: plugins/docker
settings:
purge: false
build_args: --provenance=true --sbom=true
username:
from_secret: registry_username
password:
from_secret: registry_key
repo: astrogd/pnpm
tags:
- lts-alpine
- lts
dockerfile: lts/Dockerfile
- name: build-lts-astrogd
image: plugins/docker
depends_on:
- build-lts
settings:
registry: registry.astrogd.cloud
build_args: --provenance=true --sbom=true
username:
from_secret: astrogd_registry_username
password:
from_secret: astrogd_registry_key
repo: registry.astrogd.cloud/pnpm
tags:
- lts-alpine
- lts
dockerfile: lts/Dockerfile
- name: build-latest
image: plugins/docker
settings:
purge: false
build_args: --provenance=true --sbom=true
username:
from_secret: registry_username
password:
from_secret: registry_key
repo: astrogd/pnpm
tags:
- latest-alpine
- latest
dockerfile: latest/Dockerfile
- name: build-latest-astrogd
image: plugins/docker
depends_on:
- build-latest
settings:
registry: registry.astrogd.cloud
build_args: --provenance=true --sbom=true
username:
from_secret: astrogd_registry_username
password:
from_secret: astrogd_registry_key
repo: registry.astrogd.cloud/pnpm
tags:
- latest-alpine
- latest
dockerfile: latest/Dockerfile
---
kind: pipeline
type: docker
name: cron
trigger:
event:
- cron
cron:
- daily
steps:
- name: build-lts
image: plugins/docker
settings:
purge: false
build_args: --provenance=true --sbom=true
username:
from_secret: registry_username
password:
from_secret: registry_key
repo: astrogd/pnpm
tags:
- lts-alpine
- lts
dockerfile: lts/Dockerfile
- name: build-lts-astrogd
image: plugins/docker
depends_on:
- build-lts
settings:
registry: registry.astrogd.cloud
build_args: --provenance=true --sbom=true
username:
from_secret: astrogd_registry_username
password:
from_secret: astrogd_registry_key
repo: registry.astrogd.cloud/pnpm
tags:
- lts-alpine
- lts
dockerfile: lts/Dockerfile
- name: build-latest
image: plugins/docker
settings:
purge: false
build_args: --provenance=true --sbom=true
username:
from_secret: registry_username
password:
from_secret: registry_key
repo: astrogd/pnpm
tags:
- latest-alpine
- latest
dockerfile: latest/Dockerfile
- name: build-latest-astrogd
image: plugins/docker
depends_on:
- build-latest
settings:
registry: registry.astrogd.cloud
build_args: --provenance=true --sbom=true
username:
from_secret: astrogd_registry_username
password:
from_secret: astrogd_registry_key
repo: registry.astrogd.cloud/pnpm
tags:
- latest-alpine
- latest
dockerfile: latest/Dockerfile
---
kind: signature
hmac: 4273bd6d4fadc37a81c8efee1273325e1ee914798eb00baf73790d4a100eed62
...