OCI Mirror component
Mirrors an OCI image or artifact from a source registry to a destination registry with skopeo copy.
Variables
| Name | required | type | Hints |
|---|---|---|---|
| CI_REGISTRY_USER | required | string | GitLab container registry user. Provided by GitLab CI. |
| CI_REGISTRY_PASSWORD | required | string | GitLab container registry password. Provided by GitLab CI. |
When GITHUB_TOKEN is available, the mirror job automatically authenticates skopeo to ghcr.io. The token owner is discovered through the GitHub API. Set GITHUB_USER when API-based discovery is unavailable or when the registry login must use a specific GitHub username. The token needs the GitHub Packages scopes required by the source or target artifact. Automatic login is best-effort so mirrors that do not use GHCR can continue; a GHCR copy still fails with its native error when credentials are required.
For a private source or destination outside the current GitLab instance, add its credentials to the standard DOCKER_AUTH_CONFIG variable documented by the common component. The job imports that configuration for skopeo while retaining the predefined GitLab registry login.
Usage
Create GitLab pipeline file .gitlab-ci.yml:
include:
- component: $CI_SERVER_FQDN/xrow-public/ci-tools/common@stable
- component: $CI_SERVER_FQDN/xrow-public/ci-tools/oci-mirror@stable
inputs:
source: registry.access.redhat.com/ubi10/ubi:latest
target: $CI_REGISTRY_IMAGE:ubi-latest
Mirror a Helm chart artifact by using normal registry references without the Helm oci:// prefix:
include:
- component: $CI_SERVER_FQDN/xrow-public/ci-tools/common@stable
- component: $CI_SERVER_FQDN/xrow-public/ci-tools/oci-mirror@stable
inputs:
source: ghcr.io/jouve/charts/mailpit:0.34.1
target: $CI_REGISTRY_IMAGE/charts/mailpit:0.34.1
By default the mirror job runs only for tags. Override rules when the mirror should run for branches or merge requests.
Source signatures are removed by default because many destination registries are not configured to store signature attachments, which makes skopeo copy fail. Set remove-signatures: false only when the destination registry supports signature attachments and the signatures must be preserved.
Inputs
| Name | Description | Default | Type |
| --- | --- | --- | --- |
| name | oci | string | |
| needs | The jobs that this job depends on. | [] | array |
| remove-signatures | Remove source image signatures while copying. Disable this only when the destination registry is configured to store signature attachments. | true | boolean |
| rules | The rules that this job depends on. | [{"if":"$CI_COMMIT_TAG","when":"always"},{"when":"never"}] | array |
| source | The source OCI image or artifact reference to mirror. | string | |
| stage | The pipeline stage that the jobs belongs to. | deploy | string |
| tags | The runners that this job depends on. | [] | array |
| target | The destination OCI image or artifact reference to mirror to. | string |