Merge pull request 'Put GOPATH/bin on PATH so go install-ed tools run' (#6) from container-gopath-bin into main

Reviewed-on: #6

.woodpecker/docker.yaml

@@ -36,28 +36,27 @@ steps:
             memory: 4Gi
             cpu: 2
 
-  # The default distro also carries the unsuffixed tags.
+  # The default distro's unsuffixed tag is an alias of the image the step above just
-  - name: docker-default
+  # pushed, not a second build of it: imagetools create only writes a new tag reference
+  # to the existing manifest, so :<version> and :<version>-<suffix> are one digest. No
+  # daemon is involved; the internal CA is baked into this image at /etc/docker/certs.d/.
+  - name: docker-default-tag
     image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
     when:
       - evaluate: 'DEFAULT == "true"'
-    settings:
+    environment:
-      registry: artifactapi.k8s.syd1.au.unkin.net
+      REPO: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder"
-      repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder"
+      VERSION: "${CI_COMMIT_TAG##v}"
-      target: image
+      SUFFIX: "${TAG_SUFFIX}"
-      build_args:
+    commands:
-        BASE_IMAGE_NAME: "${BASE_IMAGE_NAME}"
+      - 'docker buildx imagetools create -t "$REPO:$VERSION" "$REPO:$VERSION-$SUFFIX"'
-        DISTRO: "${DISTRO}"
-      tags:
-        - "${CI_COMMIT_TAG##v}"
-        - latest
     backend_options:
       kubernetes:
         serviceAccountName: default
         resources:
           requests:
-            memory: 1Gi
+            memory: 256Mi
-            cpu: 1
+            cpu: 250m
           limits:
-            memory: 4Gi
+            memory: 512Mi
-            cpu: 2
+            cpu: 500m

.woodpecker/pre-commit.yaml

@@ -3,7 +3,7 @@ when:
 
 steps:
   - name: pre-commit
-    image: "git.unkin.net/unkin/almalinux9-gobuilder:20260606"
+    image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.0-alma9"
     commands:
       - uvx pre-commit run --all-files
     backend_options:

Dockerfile

@@ -1,12 +1,19 @@
 ARG REGISTRY=artifactapi.k8s.syd1.au.unkin.net/docker-internal
 # The container-base release this image is built on — the one place to bump it.
-ARG BASE_VERSION=0.1.0
+ARG BASE_VERSION=0.1.3
 ARG BASE_IMAGE_NAME=almalinux9
 
 FROM ${REGISTRY}/${BASE_IMAGE_NAME}:${BASE_VERSION} AS image
 ARG DISTRO=alma9
 ARG GO_CACHE_PLUGIN_VERSION=v0.1.0
 ARG GO_CACHE_PLUGIN_SHA256=0eb23d06a0dcf395559cb6447864579c220e60148fdcd6a6f841c2b17169b9b8
+# `go install` writes to $GOPATH/bin, which nothing puts on PATH by default, so an
+# installed tool is not runnable. Match the official golang images: GOPATH out of root's
+# home, its bin on PATH, and world-writable so this still works if the image ever runs
+# as non-root.
+ENV GOPATH=/go
+ENV PATH=/go/bin:$PATH
+
 COPY distros/${DISTRO}/ /tmp/distro/
 # DL3041: versions are pinned by the estate dnf repos, not here. SC2086: $PACKAGES is a
 # word list on purpose. DL4006: the only pipe ends in sha256sum, whose status is the
@@ -20,5 +27,7 @@ RUN set -eux; \
       "https://git.unkin.net/unkin/go-cache-plugin/releases/download/${GO_CACHE_PLUGIN_VERSION}/go-cache-plugin-linux-amd64"; \
     echo "$GO_CACHE_PLUGIN_SHA256  /usr/local/bin/go-cache-plugin" | sha256sum -c -; \
     chmod 0755 /usr/local/bin/go-cache-plugin; \
+    mkdir -p "$GOPATH/bin"; \
+    chmod -R 1777 "$GOPATH"; \
     rm -rf /var/cache/dnf /tmp/distro
 CMD ["/bin/bash"]

README.md

@@ -2,7 +2,8 @@
 
 The estate's Go toolchain image, built on each `container-base` distro image.
 Published as `artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:<version>-<suffix>`;
-the default distro also gets the unsuffixed `:<version>` and `:latest`.
+the default distro's build is retagged as the unsuffixed `:<version>`, so both resolve
+to one digest. Only explicit versions are published; never a floating tag.
 
 | distro | from | tag suffix | default |
 | --- | --- | --- | --- |
@@ -12,6 +13,9 @@ Adds `golang`, `gcc` and `nfpm`, and bakes in the `go-cache-plugin` binary on `P
 so Go pipelines get the shared build cache with no download step. No credentials and no
 `GOCACHEPROG` value are baked in — consumers set those.
 
+`GOPATH` is `/go` with `/go/bin` on `PATH`, as on the official `golang` images, so a tool
+installed with `go install <tool>@<version>` is runnable by name in the same step.
+
 The `container-base` release this image builds on is `BASE_VERSION` in the `Dockerfile`.
 
 ## Adding a distro

ci/check-distros.sh

@@ -36,7 +36,7 @@ EOF
   done
 done
 
-# Exactly one distro owns the unsuffixed :<version> and :latest tags.
+# Exactly one distro owns the unsuffixed :<version> tag.
 defaults=$(grep -l 'DEFAULT="true"' distros/*/distro.env | wc -l)
 [ "$defaults" -eq 1 ] || { echo "expected exactly one distro with DEFAULT=\"true\", found ${defaults}"; fail=1; }
 

distros/alma9/distro.env

@@ -2,7 +2,7 @@
 BASE_IMAGE_NAME="almalinux9"
 IMAGE="gobuilder"
 TAG_SUFFIX="alma9"
-# The default distro also gets the unsuffixed :<version> and :latest tags.
+# The default distro also gets the unsuffixed :<version> tag.
 DEFAULT="true"
 
 # Estate local repo used to prove inherited HTTPS trust.