A step that runs `go install <tool>@<version>` and then invokes the tool fails
with exit 127: the binary lands in $GOPATH/bin, which nothing adds to PATH, and
GOPATH defaults to /root/go. Pipelines moving here from docker.io/golang, where
/go/bin is on PATH, break on that difference.
- Set GOPATH=/go and prepend /go/bin to PATH, matching the official golang images.
- Create /go/bin mode 1777 so go install also works if the image runs as non-root.
- Document the installed-tool contract in the README.
The 0.1.0 base shipped only the root CA in unkin-ca-certificates, so
s3.ceph.unkin.net — a bare leaf issued by the intermediate — failed to
verify and the baked-in go-cache-plugin could never reach the shared
build cache. 0.1.3 ships both anchors.
- Bump BASE_VERSION to 0.1.3.
A floating tag silently substitutes the image under consumers who did not ask
for a new one — the same hazard already avoided by pinning the pre-commit step.
Alias only :<version> onto the default distro's build.
Drop the :latest references from the README, distro.env and check-distros.
The unsuffixed :<version> and :latest came from a second, independent buildx
step, so they resolved to a different digest than :<version>-<suffix> — nobody
had tested the bits consumers pin. Published v0.1.0 shows it: the amd64 children
share four layers and differ in the top one.
Retag the manifest the matrix step just pushed with imagetools create.
Drop the duplicate build.
The step needs uvx, so it ran on the packer-built almalinux9-gobuilder —
the image these repos exist to replace.
- switch the pre-commit step to docker-internal/gobuilder:0.1.0-alma9
The buildkit_config setting does not exist in the plugin-docker-buildx build
we run: the binary has no PLUGIN_BUILDKIT_CONFIG, so the block was dead YAML
and `docker buildx create` ran without --config, leaving the spawned buildkit
container with no internal CA. The plugin only writes a buildkit.toml
(pointing at /etc/docker/certs.d/<registry>/ca.crt) when `registry` is set.
Set registry on the build step, drop the dead block from every step, and
fail ci/check-distros.sh when a matrix value restating a distro.env key
drifts from it.
The hand-rolled pre-commit.sh reimplemented what upstream hooks already do.
Move to pre-commit.com with the estate's usual pre-commit-hooks set plus
hadolint and shellcheck, and keep the one check with no upstream equivalent
(distros/ vs the Woodpecker matrices) as a repo: local hook.
The test harness goes; tests will be reintroduced differently.
- add .pre-commit-config.yaml and ci/check-distros.sh
- delete pre-commit.sh, test.sh and .woodpecker/test.yaml
- run uvx pre-commit run --all-files from .woodpecker/pre-commit.yaml and make pre-commit
- drop the Dockerfile test stage and the make test targets
Replace the packer-images gobuilder with a Dockerfile matrix built on each
container-base distro image, on a single repo semver.
- install golang, gcc and nfpm
- bake the sha256-pinned go-cache-plugin v0.1.0 binary onto PATH
- run in-image assertions as a --target test build stage
- add pull_request build/test/pre-commit and tag-triggered docker workflows
unkin-agent
benvin
gitadmin