unkin-agent
63cf28c90e
The hand-rolled pre-commit.sh reimplemented what upstream hooks already do. Move to pre-commit.com with the estate's usual pre-commit-hooks set plus hadolint and shellcheck, and keep the one check with no upstream equivalent (distros/ vs the Woodpecker matrices) as a repo: local hook. The test harness goes; tests will be reintroduced differently. - add .pre-commit-config.yaml and ci/check-distros.sh - delete pre-commit.sh, test.sh and .woodpecker/test.yaml - run uvx pre-commit run --all-files from .woodpecker/pre-commit.yaml and make pre-commit - drop the Dockerfile test stage and the make test targets
36 lines
1.4 KiB
Markdown
36 lines
1.4 KiB
Markdown
# container-base
|
|
|
|
The estate's base container images, one per distro, replacing what `packer-images`
|
|
built. Published as `artifactapi.k8s.syd1.au.unkin.net/docker-internal/<image>:<version>`
|
|
— the image name is the distro (`almalinux9`), the repo's single semver is the tag.
|
|
|
|
| distro | image | from |
|
|
| --- | --- | --- |
|
|
| `alma9` | `almalinux9` | `dockerhub/library/almalinux:9` |
|
|
|
|
Each image bootstraps the internal CA, installs the estate dnf repository
|
|
configuration pointed at artifactapi, and installs the base package set.
|
|
|
|
## Adding a distro
|
|
|
|
1. `distros/<name>/distro.env` — `BASE_IMAGE`, `IMAGE`, `CA_RPM_URL`, `CA_RPM_SHA256`, `PACKAGES`.
|
|
2. `distros/<name>/yum.repos.d/*.repo` — repository configuration for that distro.
|
|
3. One `include` entry in each of `.woodpecker/{build,docker}.yaml`.
|
|
|
|
The `check-distros` pre-commit hook fails if step 1 or 3 is incomplete.
|
|
|
|
## CA bootstrap
|
|
|
|
`unkin-ca-certificates` lives in artifactapi, but the image cannot trust artifactapi
|
|
over HTTPS until it is installed. The package is therefore fetched over plain HTTP and
|
|
checked against `CA_RPM_SHA256` before `rpm -i`; everything after that uses HTTPS. The
|
|
pinned hash is the `pkgid` checksum recorded for the file in the repo's own repodata
|
|
(`repodata/repomd.xml` → `*-primary.xml.gz`).
|
|
|
|
## Make
|
|
|
|
make build # build every distro
|
|
make pre-commit # uvx pre-commit run --all-files
|
|
make build-alma9 # one distro
|
|
make patch|minor|major
|