Homelab/workflows
Homelab/workflows
Watch
5
0
Fork
You've already forked workflows
 0
Code Issues 7 Pull requests Projects Releases 95 Packages Wiki Activity Actions
95 releases 129 tags
  • v1.3.1 4dca92ecf9

    v1.3.1
    All checks were successful
    Repository security / security-1 (push) Successful in 1m25s
    Details
    Repository security / security (push) Successful in 0s
    Details
    Library checks / tests (push) Successful in 1m51s
    Details
    Stable

    gitchegumi released this 2026-09-06 00:14:06 -05:00 | 286 commits to main since this release

    v1.3.1

    Fixes Forgejo reusable-workflow dispatch failing with SetJob: yaml: unknown anchor 'id001' referenced.

    • Replaces YAML aliases with explicit environment mappings in bundle builds, container builds, and PV provisioning.
    • Adds regression checks to prevent workflow aliases from being reintroduced.
    • Preserves existing workflow inputs, permissions, and deployment behavior.

    All library, workflow acceptance, and security checks passed.

    Upgrade: Update reusable workflow uses references and matching library_ref values from v1.3.0 to v1.3.1.

    Downloads
  • v1.3.0 899fd7a643

    v1.3.0
    All checks were successful
    Repository security / security-1 (push) Successful in 1m48s
    Details
    Repository security / security (push) Successful in 0s
    Details
    Library checks / tests (push) Successful in 1m53s
    Details
    Stable

    gitchegumi released this 2026-09-05 17:30:10 -05:00 | 288 commits to main since this release

    v1.3.0 — Retained NFS PV provisioning

    Adds a reusable workflow for provisioning retained, prebound NFS PersistentVolumes before application deployment.

    Added

    • Preview mode with server-side dry-run validation and explicit create mode.
    • Protected-branch and approved-actor checks, source scanning, and strict Kubernetes schema validation before cluster access.
    • Provisioning receipts recording the source commit, manifest checksum, PV name, and result.
    • Scoped kubeconfig validation requiring embedded CA data, complete authentication, and matching context references.

    Storage safeguards

    Matching unbound PVs remain unchanged. Conflicting specifications, unexpected fields, unverified claim identities, and Bound/Released/Failed volumes stop for owner review. The workflow never patches, replaces, deletes, or rebinds storage.

    Provisioning uses the UDS-bundled Kubernetes client and requires no Cosign keys. It does not mount data or deploy applications.

    Adoption

    Pin both the reusable workflow reference and library_ref to v1.3.0. Configure the provisioning identity and caller settings, then run preview before create.

    Validation

    All 50 unit tests, workflow acceptance, repository security, and library integration checks passed.

    Downloads
  • v1.2.1 62ddd420fb

    v1.2.1
    All checks were successful
    Repository security / security-1 (push) Successful in 1m19s
    Details
    Repository security / security (push) Successful in 0s
    Details
    Library checks / tests (push) Successful in 1m49s
    Details
    Stable

    gitchegumi released this 2026-09-04 22:29:44 -05:00 | 295 commits to main since this release

    Fixed

    • Bind Trivy IaC fingerprints to individual source occurrences.
    • Reject missing or invalid source lines.
    • Remove coarse file/rule mitigation matching.

    Adoption

    Update both the reusable workflow reference and library_ref to v1.2.1. Rescan and regenerate occurrence-specific IaC mitigations; existing coarse fingerprints no longer match.

    Validation

    All 41 unit tests and 16 scaffold cases pass. Hosted security checks pass with zero blockers and zero scanner errors.

    Downloads
  • v1.2.0 6892147cee

    v1.2.0
    All checks were successful
    Repository security / security-1 (push) Successful in 1m16s
    Details
    Repository security / security (push) Successful in 0s
    Details
    Library checks / tests (push) Successful in 1m48s
    Details
    Stable

    gitchegumi released this 2026-09-04 20:13:32 -05:00 | 299 commits to main since this release

    Added

    • ShellCheck scanning for shell scripts.
    • Configurable Helm and Kustomize rendering before IaC scans.
    • Strict Kubernetes schema validation with checksum-pinned Kubeconform.
    • Trivy scanning of rendered manifests.
    • Scheduled repository security scans using the pinned workflow library.

    Fixed

    • Reject unknown resource kinds, missing schemas, skipped resources, and empty Kubernetes validation plans.
    • Print sanitized finding details and scanner errors for easier troubleshooting.
    • Preserve exact, expiring mitigations for reviewed findings.
    • Remove unsupported Forgejo workflow permissions.

    Adoption

    Update workflow references and library_ref from v1.1.0 to v1.2.0.

    For Kubernetes validation, add .pipeline/validation.json using the supplied example. Configure at least one manifest pattern or render entry. Custom resources without supported schemas fail validation; controller-specific schema support remains future work.

    Downloads
  • v1.1.0 0ba8c3e1a4

    v1.1.0
    All checks were successful
    Library checks / tests (push) Successful in 1m48s
    Details
    Stable

    gitchegumi released this 2026-09-04 15:58:22 -05:00 | 307 commits to main since this release

    Adds manually triggered workflow-library releases and static ci/deploy runner selection. Consumers should update reusable workflow references to @v1.1.0. No input changes are required.

    Downloads