Clarify SSH auth is only for crate registry index, overall cleanup

.github/actions/rust-prepare/action.yml

@@ -4,25 +4,17 @@ inputs:
   ssh_auth_sock:
     description: "SSH socket"
     default: "/tmp/ssh_agent.sock"
-    required: true
-  gitlab_ssh:
-    description: "Gitlab ssh"
-    required: true
-  gitlab_user:
-    description: "Gitlab username"
-    required: true
-  gitlab_pass:
-    description: "Gitlab username"
-    required: true
   cargo_home:
     description: "Cargo home"
     default: ".cargo"
-  famedly_crates_registry:
+  crate_registry_name:
     description: "Famedly registry name"
     default: "famedly"
-  famedly_crates_registry_index:
+  crate_registry_index_url:
     description: "URL of famedly registry index"
     default: "ssh://git@ssh.shipyard.rs/famedly/crate-index.git"
+  crate_registry_ssh_privkey:
+    description: "SSH private key for authenticating with famedly registry index. This needs to be set for a private registry to be configured."
   additional_packages:
     description: "Additional package to install during preparation"
     default: ""
@@ -33,19 +25,9 @@ runs:
     - shell: bash
       env:
         SSH_AUTH_SOCK: ${{ inputs.ssh_auth_sock }}
-        GITLAB_SSH: ${{ inputs.gitlab_ssh }}
-      run: $GITHUB_ACTION_PATH/prepare_ssh.sh
-
-    - shell: bash
-      env:
-        GITLAB_USER: ${{ inputs.gitlab_user }}
-        GITLAB_PASS: ${{ inputs.gitlab_pass }}
-      run: $GITHUB_ACTION_PATH/prepare_git.sh
-
-    - shell: bash
-      env:
         CARGO_HOME: ${{ inputs.cargo_home }}
         ADDITIONAL_PACKAGES: ${{ inputs.additional_packages }}
-        FAMEDLY_CRATES_REGISTRY: ${{ inputs.famedly_crates_registry }}
-        FAMEDLY_CRATES_REGISTRY_INDEX: ${{ inputs.famedly_crates_registry_index }}
-      run: $GITHUB_ACTION_PATH/prepare_rust.sh
+        CRATE_REGISTRY_NAME: ${{ inputs.crate_registry_name }}
+        CRATE_REGISTRY_INDEX_URL: ${{ inputs.crate_registry_index_url }}
+        CRATE_REGISTRY_SSH_PRIVKEY: ${{ inputs.crate_registry_ssh_privkey }}
+      run: $GITHUB_ACTION_PATH/prepare.sh

.github/actions/rust-prepare/prepare.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+echo "Preparing Rust build environment"
+
+# Ensure repo path is safe
+git config --global --add safe.directory "$(pwd)"
+
+# Determine sudo availability (works inside and outside containers)
+if [[ "$(id -u)" -eq 0 ]]; then
+	SUDO=""
+else
+	SUDO="sudo"
+fi
+
+if [[ -n "${ADDITIONAL_PACKAGES:-}" ]]; then
+  echo "Installing additional packages: ${ADDITIONAL_PACKAGES}"
+	# We want to be explicit about word splitting here.
+	# https://github.com/koalaman/shellcheck/wiki/Sc2046
+	read -ra packages <<< "${ADDITIONAL_PACKAGES}"
+	$SUDO apt-get install -yqq --no-install-recommends "${packages[@]}"
+else
+	echo "No additional packages specified. Skipping installation."
+fi
+
+
+# TODO: Don't set CARGO_HOME to a relative path. It is supposed to be an absolute path, this is potentially problematic.
+# However, it works for now and any change to this needs to be thoroughly tested as github actions is really weird about runner home directories.
+echo "Setting up build environment"
+echo "CARGO_HOME = ${HOME}/${CARGO_HOME}"
+mkdir -p "${HOME}/${CARGO_HOME}"
+
+# Decide public/private mode based on presence of private key
+if [[ -z "${CRATE_REGISTRY_SSH_PRIVKEY:-}" ]]; then
+	echo "No private registry SSH key provided. Configuring for public builds."
+	export CRATE_REGISTRY_NAME="crates-io"
+else
+	echo "Private registry credentials detected. Configuring SSH and private registry access."
+	USER_NAME="$(whoami)"
+	SSH_HOME="$(getent passwd "$USER_NAME" | cut -d: -f6)"
+	ssh-agent -a "${SSH_AUTH_SOCK}" > /dev/null
+	echo "SSH_AUTH_SOCK=${SSH_AUTH_SOCK}" >> "$GITHUB_ENV"
+	ssh-add -vvv - <<< "${CRATE_REGISTRY_SSH_PRIVKEY}"$'\n'
+	mkdir -p "$SSH_HOME/.ssh"
+	{
+		ssh-keyscan -H ssh.shipyard.rs
+	} >> "$SSH_HOME/.ssh/known_hosts"
+fi
+
+cat << EOF >> "${HOME}/${CARGO_HOME}/config.toml"
+[net]
+git-fetch-with-cli = true
+EOF
+
+if [ "$CRATE_REGISTRY_NAME" != "crates-io" ]; then
+	cat << EOF >> "${HOME}/${CARGO_HOME}/config.toml"
+[registries.${CRATE_REGISTRY_NAME}]
+index = "${CRATE_REGISTRY_INDEX_URL}"
+EOF
+fi
+
+echo "CARGO_HOME=${HOME}/${CARGO_HOME}" >> "$GITHUB_ENV"
+
+# Persist registry settings for subsequent GitHub Actions steps
+echo "CRATE_REGISTRY_NAME=${CRATE_REGISTRY_NAME}" >> "$GITHUB_ENV"
+if [[ -n "${CRATE_REGISTRY_INDEX_URL:-}" ]]; then
+	echo "CRATE_REGISTRY_INDEX_URL=${CRATE_REGISTRY_INDEX_URL}" >> "$GITHUB_ENV"
+fi
+
+echo "Preparations finished"

.github/workflows/docker-backend.yml

@@ -12,29 +12,27 @@ on:
         required: true
         type: string
 
-      registry_user:
+      oci_registry_user:
         required: false
         type: string
-        default: ${{ vars.REGISTRY_USER }}
+        default: ${{ vars.OCI_REGISTRY_USER }}
 
     secrets:
-      CI_SSH_PRIVATE_KEY:
+      CRATE_REGISTRY_SSH_PRIVKEY:
         required: false
         description: |
           Private SSH key to use for cargo dependencies that need to
-          either be fetched from private GitHub repositories or a
-          private registry.
-      registry_password:
+          be fetched from a private registry.
+      OCI_REGISTRY_PASSWORD:
         required: false
         description: |
           The password to use to push to the docker registry. If left
           unset, the GitHub token will be used instead.
 
 env:
-  RUSTC_WRAPPER: cachepot
-  REGISTRY_SNAPSHOTS: registry.famedly.net/docker-nightly
-  REGISTRY_RELEASES: registry.famedly.net/docker-releases
-  REGISTRY_OSS: registry.famedly.net/docker-oss
+  OCI_REGISTRY_SNAPSHOTS: registry.famedly.net/docker-nightly
+  OCI_REGISTRY_RELEASES: registry.famedly.net/docker-releases
+  OCI_REGISTRY_OSS: registry.famedly.net/docker-oss
 
 jobs:
   docker-publish:
@@ -47,9 +45,9 @@ jobs:
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
         run: |
           mkdir -p ~/.ssh
-          ssh-keyscan github.com >> ~/.ssh/known_hosts
+          ssh-keyscan git.shipyard.rs >> ~/.ssh/known_hosts
           ssh-agent -a $SSH_AUTH_SOCK > /dev/null
-          ssh-add - <<< "${{ secrets.CI_SSH_PRIVATE_KEY }}" || true
+          ssh-add - <<< "${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY }}" || true
 
       # TODO: consider adding an intermediate `docker build -t base_image --target base` step
       # if current version rebuilds base stage for each target without caching. Ideally we want
@@ -65,35 +63,35 @@ jobs:
             echo "::group::Building ${target}"
 
             docker build --pull -t ${target} --target ${target} \
-              --build-arg CARGO_REGISTRIES_FAMEDLY_INDEX="${{ vars.CARGO_REGISTRIES_FAMEDLY_INDEX }}" \
+              --build-arg CARGO_REGISTRIES_FAMEDLY_INDEX="${{ vars.CRATE_REGISTRY_INDEX_URL }}" \
               --build-arg CARGO_BUILD_RUSTFLAGS="${CARGO_BUILD_RUSTFLAGS}" \
               --ssh default .
 
             echo "::endgroup::"
           done
 
-      - name: Resolve registry to push
+      - name: Resolve OCI registry to push
         shell: bash
         run: |
           if [ ${{ github.ref_type }} = 'branch' ]; then
-            echo "REGISTRY=${{ env.REGISTRY_SNAPSHOTS }}" >> $GITHUB_ENV
+            echo "OCI_REGISTRY=${{ env.OCI_REGISTRY_SNAPSHOTS }}" >> $GITHUB_ENV
           elif [ ${{ github.ref_type }} = 'tag' ]; then
             if [[ ${{ inputs.oss }} == true ]]; then
-              echo "REGISTRY=${{ env.REGISTRY_OSS }}" >> $GITHUB_ENV
+              echo "OCI_REGISTRY=${{ env.OCI_REGISTRY_OSS }}" >> $GITHUB_ENV
             else
-              echo "REGISTRY=${{ env.REGISTRY_RELEASES }}" >> $GITHUB_ENV
+              echo "OCI_REGISTRY=${{ env.OCI_REGISTRY_RELEASES }}" >> $GITHUB_ENV
             fi
             if ! [[ ${{ github.ref_name }} =~ v[0-9]+\.[0-9]+\.[0-9]+ ]]; then
-              echo "REGISTRY=${{ env.REGISTRY_SNAPSHOTS }}" >> $GITHUB_ENV
+              echo "OCI_REGISTRY=${{ env.OCI_REGISTRY_SNAPSHOTS }}" >> $GITHUB_ENV
             fi
           fi
 
       - name: Tag
         shell: bash
-        if: env.REGISTRY != null
+        if: env.OCI_REGISTRY != null
         run: |
           for target in $(echo "${{ inputs.targets }}" | tr ',' '\n'); do
-            IMAGE_PATH="${{ env.REGISTRY }}/${target}"
+            IMAGE_PATH="${{ env.OCI_REGISTRY }}/${target}"
             echo "::group::Tagging ${IMAGE_PATH}"
 
             if [ ${{ github.ref_type }} = 'branch' ]; then
@@ -113,20 +111,20 @@ jobs:
             echo "::endgroup::"
           done
 
-      - name: Log into registry ${{ env.REGISTRY }}
+      - name: Log into registry ${{ env.OCI_REGISTRY }}
         uses: famedly/login-action@v2
-        if: env.REGISTRY != null
+        if: env.OCI_REGISTRY != null
         with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ inputs.registry_user }}
-          password: ${{ secrets.registry_password || secrets.GITHUB_TOKEN }}
+          registry: ${{ env.OCI_REGISTRY }}
+          username: ${{ inputs.oci_registry_user }}
+          password: ${{ secrets.OCI_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}
 
       - name: Push
-        if: env.REGISTRY != null
+        if: env.OCI_REGISTRY != null
         shell: bash
         run: |
           for target in $(echo "${{ inputs.targets }}" | tr ',' '\n'); do
-            IMAGE_PATH="${{ env.REGISTRY }}/${target}"
+            IMAGE_PATH="${{ env.OCI_REGISTRY }}/${target}"
             echo "::group::Pushing ${IMAGE_PATH}"
             docker image push --all-tags "${IMAGE_PATH}"
             echo "::endgroup::"

.github/workflows/publish-crate.yml

@@ -15,25 +15,25 @@ name: Publish Rust crates
 on:
   workflow_call:
     inputs:
-      registry-name:
+      crate_registry_name:
         description: "Name of the registry to publish to"
         type: string
-        default: "famedly"
-      registry-index:
+        default: "${{ vars.CRATE_REGISTRY_NAME }}"
+      crate_registry_index_url:
         description: "URL of the registry index"
         type: string
-        default: "ssh://git@ssh.shipyard.rs/famedly/crate-index.git"
+        default: "${{ vars.CRATE_REGISTRY_INDEX_URL }}"
       packages:
         description: "List of packages to publish; space-separated list"
         type: string
       features:
         description: "List of features to publish; space-separated list"
         type: string
     secrets:
-      CI_SSH_PRIVATE_KEY:
-        description: "SSH key to use for authentication against the crate index"
+      CRATE_REGISTRY_SSH_PRIVKEY:
+        description: "SSH key to use for authentication against the registry crate index"
         required: true
-      registry-auth-token:
+      CRATE_REGISTRY_AUTH_TOKEN:
         description: "Auth token for the registry to publish to"
         required: true
 
@@ -42,26 +42,24 @@ jobs:
     # Enforce only publishing tagged commits
     if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
-    container: registry.famedly.net/docker-oss/rust-container:nightly
+    container: ghcr.io/famedly/rust-container:nightly
     steps:
       - uses: actions/checkout@v4
-      - uses: famedly/backend-build-workflows/.github/actions/rust-prepare@main
+      - uses: ./.github/actions/rust-prepare
         with:
-          gitlab_user: ${{ secrets.GITLAB_USER }}
-          gitlab_pass: ${{ secrets.GITLAB_PASS }}
-          gitlab_ssh: ${{ secrets.CI_SSH_PRIVATE_KEY }}
-          famedly_crates_registry: ${{ inputs.registry-name }}
-          famedly_crates_registry_index: ${{ inputs.registry-index }}
+          crate_registry_name: ${{ inputs.crate_registry_name }}
+          crate_registry_index_url: ${{ inputs.crate_registry_index_url }}
+          crate_registry_ssh_privkey: ${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY}}
       - name: Install registry token
         # Uses `echo` (bash built-in) to prevent leaking the token
         # through CLI args in /proc
         run: |
           cat << EOF > "${CARGO_HOME}/credentials.toml"
-          [${{ inputs.registry-name != 'crates-io' && format('registries.{0}', inputs.registry-name) || 'registry' }}]
-          token = "${{ secrets.registry-auth-token }}"
+          [${{ inputs.crate_registry_name != 'crates-io' && format('registries.{0}', inputs.crate_registry_name) || 'registry' }}]
+          token = "${{ secrets.CRATE_REGISTRY_AUTH_TOKEN }}"
           EOF
       - name: Publish
         run: |
-          cargo publish ${{ inputs.registry-name != 'crates-io' && format('--registry {0}', inputs.registry-name) || '' }} \
+          cargo publish ${{ inputs.crate_registry_name != 'crates-io' && format('--registry {0}', inputs.crate_registry_name) || '' }} \
             ${{ inputs.packages != null && format('--package {0}', inputs.packages) || '' }} \
             ${{ inputs.features != null && format('--features {0}', inputs.features) || '' }}