tools/build.yaml at main · getarcaneapp/tools · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
# build.yaml — declarative inputs for the arcane-toolbox image build.
# Edited by humans; consumed by the Justfile via yq (Mike Farah's Go yq, v4+).

image:
  name: ghcr.io/getarcaneapp/tools
  local_tag: ghcr.io/getarcaneapp/tools:dev
  ci_tag: ghcr.io/getarcaneapp/tools:ci

versions:
  alpine: "3.24"
  trivy: "0.73.0"
  busybox: "1.38.0"
  go: "1.26.5"
  acfs: "0.4.0"

platforms:
  validate: linux/amd64
  publish:
    - linux/amd64
    - linux/386
    - linux/arm/v7
    - linux/arm64
    - linux/ppc64le
    - linux/s390x

busybox:
  # CONFIG_* keys forced to =y in the BusyBox .config. The Justfile appends
  # =y when generating dist/busybox.config — encoding values directly here
  # would invite YAML truthy/falsy coercion (`y` -> true).
  config:
    - CONFIG_STATIC
    - CONFIG_LFS
    - CONFIG_ASH
    - CONFIG_SH_IS_ASH
    - CONFIG_ASH_PRINTF
    - CONFIG_FEATURE_FANCY_HEAD
    - CONFIG_FEATURE_FANCY_SLEEP
    - CONFIG_FEATURE_FIND_MAXDEPTH
    - CONFIG_FEATURE_SEAMLESS_GZ
    - CONFIG_FEATURE_STAT_FORMAT
    - CONFIG_FEATURE_TAR_CREATE
    - CONFIG_FEATURE_TAR_GNU_EXTENSIONS
    - CONFIG_FIND
    - CONFIG_GZIP
    - CONFIG_HEAD
    - CONFIG_MKDIR
    - CONFIG_MKTEMP
    - CONFIG_MV
    - CONFIG_READLINK
    - CONFIG_RM
    - CONFIG_RMDIR
    - CONFIG_SLEEP
    - CONFIG_STAT
    - CONFIG_TAR
    - CONFIG_TEST

  # Names symlinked to /bin/busybox in the final image. Also asserted by
  # validate.sh (each must exist as /bin/<name> and be executable).
  applets:
    - sh
    - sleep
    - find
    - gzip
    - stat
    - readlink
    - head
    - rm
    - mkdir
    - mv
    - rmdir
    - mktemp
    - tar
    - test

# Trivy database mirrors. Each entry is mirrored from `source:tag` to
# `target:tag` by .github/workflows/mirror-trivy-db.yaml on a 6h cron.
# These DBs are architecture-independent OCI artifacts
# Tags follow upstream Trivy's pinned major-version convention.
mirrors:
  - name: trivy-db
    source: ghcr.io/aquasecurity/trivy-db
    target: ghcr.io/getarcaneapp/trivy-db
    tag: "2"

  - name: trivy-java-db
    source: ghcr.io/aquasecurity/trivy-java-db
    target: ghcr.io/getarcaneapp/trivy-java-db
    tag: "1"

  - name: trivy-checks
    source: ghcr.io/aquasecurity/trivy-checks
    target: ghcr.io/getarcaneapp/trivy-checks
    tag: "1"