unkin-agent
63cf28c90e
The hand-rolled pre-commit.sh reimplemented what upstream hooks already do. Move to pre-commit.com with the estate's usual pre-commit-hooks set plus hadolint and shellcheck, and keep the one check with no upstream equivalent (distros/ vs the Woodpecker matrices) as a repo: local hook. The test harness goes; tests will be reintroduced differently. - add .pre-commit-config.yaml and ci/check-distros.sh - delete pre-commit.sh, test.sh and .woodpecker/test.yaml - run uvx pre-commit run --all-files from .woodpecker/pre-commit.yaml and make pre-commit - drop the Dockerfile test stage and the make test targets
1.4 KiB
container-base
The estate's base container images, one per distro, replacing what packer-images
built. Published as artifactapi.k8s.syd1.au.unkin.net/docker-internal/<image>:<version>
— the image name is the distro (almalinux9), the repo's single semver is the tag.
| distro | image | from |
|---|---|---|
alma9 |
almalinux9 |
dockerhub/library/almalinux:9 |
Each image bootstraps the internal CA, installs the estate dnf repository configuration pointed at artifactapi, and installs the base package set.
Adding a distro
distros/<name>/distro.env—BASE_IMAGE,IMAGE,CA_RPM_URL,CA_RPM_SHA256,PACKAGES.distros/<name>/yum.repos.d/*.repo— repository configuration for that distro.- One
includeentry in each of.woodpecker/{build,docker}.yaml.
The check-distros pre-commit hook fails if step 1 or 3 is incomplete.
CA bootstrap
unkin-ca-certificates lives in artifactapi, but the image cannot trust artifactapi
over HTTPS until it is installed. The package is therefore fetched over plain HTTP and
checked against CA_RPM_SHA256 before rpm -i; everything after that uses HTTPS. The
pinned hash is the pkgid checksum recorded for the file in the repo's own repodata
(repodata/repomd.xml → *-primary.xml.gz).
Make
make build # build every distro
make pre-commit # uvx pre-commit run --all-files
make build-alma9 # one distro
make patch|minor|major