From 16a84e2bf970f1a02734d47e3f1426f22b5e20c6 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 4 Oct 2026 14:33:11 +1100 Subject: [PATCH] Scaffold tea image on container-base alma9 --- .pre-commit-config.yaml | 30 ++++++++++++++++++ .woodpecker/build.yaml | 35 +++++++++++++++++++++ .woodpecker/docker.yaml | 62 +++++++++++++++++++++++++++++++++++++ .woodpecker/pre-commit.yaml | 18 +++++++++++ Dockerfile | 19 ++++++++++++ Makefile | 39 +++++++++++++++++++++++ README.md | 30 +++++++++++++++++- ci/check-distros.sh | 43 +++++++++++++++++++++++++ distros/alma9/distro.env | 8 +++++ 9 files changed, 283 insertions(+), 1 deletion(-) create mode 100644 .pre-commit-config.yaml create mode 100644 .woodpecker/build.yaml create mode 100644 .woodpecker/docker.yaml create mode 100644 .woodpecker/pre-commit.yaml create mode 100644 Dockerfile create mode 100644 Makefile create mode 100755 ci/check-distros.sh create mode 100644 distros/alma9/distro.env diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..fc38784 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,30 @@ +repos: + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v5.0.0 + hooks: + - id: trailing-whitespace + - id: end-of-file-fixer + - id: check-yaml + - id: check-merge-conflict + - id: mixed-line-ending + args: [--fix=lf] + + - repo: https://github.com/AleksaC/hadolint-py + rev: v2.15.1 + hooks: + - id: hadolint + + - repo: https://github.com/shellcheck-py/shellcheck-py + rev: v0.11.0.1 + hooks: + - id: shellcheck + + # No upstream equivalent: a distro added under distros/ but left out of a + # Woodpecker matrix silently never gets built. + - repo: local + hooks: + - id: check-distros + name: distros match the woodpecker matrices + entry: ci/check-distros.sh + language: system + pass_filenames: false diff --git a/.woodpecker/build.yaml b/.woodpecker/build.yaml new file mode 100644 index 0000000..019acc9 --- /dev/null +++ b/.woodpecker/build.yaml @@ -0,0 +1,35 @@ +when: + - event: pull_request + +matrix: + include: + # One entry per distro. Adding a distro: add distros// and one entry here. + - DISTRO: alma9 + BASE_IMAGE_NAME: almalinux9 + TAG_SUFFIX: alma9 + DEFAULT: "true" + +steps: + - name: build + image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest" + settings: + # registry is what gets the internal CA into the buildkit container: the plugin + # writes a buildkit.toml pointing at /etc/docker/certs.d//ca.crt only + # when it is set. The plugin has no buildkit_config setting. + registry: artifactapi.k8s.syd1.au.unkin.net + repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/tea" + target: image + dry_run: true + build_args: + BASE_IMAGE_NAME: "${BASE_IMAGE_NAME}" + DISTRO: "${DISTRO}" + backend_options: + kubernetes: + serviceAccountName: default + resources: + requests: + memory: 1Gi + cpu: 1 + limits: + memory: 4Gi + cpu: 2 diff --git a/.woodpecker/docker.yaml b/.woodpecker/docker.yaml new file mode 100644 index 0000000..4af27d9 --- /dev/null +++ b/.woodpecker/docker.yaml @@ -0,0 +1,62 @@ +when: + - event: tag + ref: refs/tags/v* + +matrix: + include: + # One entry per distro. Adding a distro: add distros// and one entry here. + - DISTRO: alma9 + BASE_IMAGE_NAME: almalinux9 + TAG_SUFFIX: alma9 + DEFAULT: "true" + +steps: + - name: docker + image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest" + settings: + # registry is what gets the internal CA into the buildkit container: the plugin + # writes a buildkit.toml pointing at /etc/docker/certs.d//ca.crt only + # when it is set. The plugin has no buildkit_config setting. + registry: artifactapi.k8s.syd1.au.unkin.net + repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/tea" + target: image + build_args: + BASE_IMAGE_NAME: "${BASE_IMAGE_NAME}" + DISTRO: "${DISTRO}" + tags: + - "${CI_COMMIT_TAG##v}-${TAG_SUFFIX}" + backend_options: + kubernetes: + serviceAccountName: default + resources: + requests: + memory: 1Gi + cpu: 1 + limits: + memory: 4Gi + cpu: 2 + + # The default distro's unsuffixed tag is an alias of the image the step above just + # pushed, not a second build of it: imagetools create only writes a new tag reference + # to the existing manifest, so : and :- are one digest. No + # daemon is involved; the internal CA is baked into this image at /etc/docker/certs.d/. + - name: docker-default-tag + image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest" + when: + - evaluate: 'DEFAULT == "true"' + environment: + REPO: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/tea" + VERSION: "${CI_COMMIT_TAG##v}" + SUFFIX: "${TAG_SUFFIX}" + commands: + - 'docker buildx imagetools create -t "$REPO:$VERSION" "$REPO:$VERSION-$SUFFIX"' + backend_options: + kubernetes: + serviceAccountName: default + resources: + requests: + memory: 256Mi + cpu: 250m + limits: + memory: 512Mi + cpu: 500m diff --git a/.woodpecker/pre-commit.yaml b/.woodpecker/pre-commit.yaml new file mode 100644 index 0000000..99db64b --- /dev/null +++ b/.woodpecker/pre-commit.yaml @@ -0,0 +1,18 @@ +when: + - event: pull_request + +steps: + - name: pre-commit + image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.0-alma9" + commands: + - uvx pre-commit run --all-files + backend_options: + kubernetes: + serviceAccountName: default + resources: + requests: + memory: 512Mi + cpu: 1 + limits: + memory: 2Gi + cpu: 2 diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..a60f376 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,19 @@ +ARG REGISTRY=artifactapi.k8s.syd1.au.unkin.net/docker-internal +# The container-base release this image is built on — the one place to bump it. +ARG BASE_VERSION=0.1.3 +ARG BASE_IMAGE_NAME=almalinux9 + +FROM ${REGISTRY}/${BASE_IMAGE_NAME}:${BASE_VERSION} AS image +ARG DISTRO=alma9 + +COPY distros/${DISTRO}/ /tmp/distro/ +# DL3041: versions are pinned in distro.env PACKAGES. SC2086: $PACKAGES is a word list +# on purpose. +# hadolint ignore=DL3041,SC2086 +RUN set -eux; \ + . /tmp/distro/distro.env; \ + dnf install -y $PACKAGES; \ + dnf clean all; \ + rm -rf /var/cache/dnf /tmp/distro; \ + tea --version +CMD ["/bin/bash"] diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..e9577ff --- /dev/null +++ b/Makefile @@ -0,0 +1,39 @@ +REGISTRY := artifactapi.k8s.syd1.au.unkin.net/docker-internal +DISTROS := $(notdir $(wildcard distros/*)) +VERSION ?= $(patsubst v%,%,$(or $(shell git describe --tags --exact-match 2>/dev/null),0.1.0-dev)) + +.PHONY: build clean pre-commit patch minor major +build: $(addprefix build-,$(DISTROS)) +clean: $(addprefix clean-,$(DISTROS)) + +pre-commit: + @uvx pre-commit run --all-files + +# Not .PHONY: GNU make skips implicit-rule search for phony targets. + +build-%: + @set -eu; . ./distros/$*/distro.env; \ + docker build --build-arg "BASE_IMAGE_NAME=$$BASE_IMAGE_NAME" --build-arg "DISTRO=$*" \ + -t "$(REGISTRY)/$$IMAGE:$(VERSION)-$$TAG_SUFFIX" . + +clean-%: + @set -eu; . ./distros/$*/distro.env; \ + docker rmi "$(REGISTRY)/$$IMAGE:$(VERSION)-$$TAG_SUFFIX" 2>/dev/null || true + +_LATEST := $(shell git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$$' | head -1) +_BASE := $(if $(_LATEST),$(_LATEST),v0.0.0) +_MAJ := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f1) +_MIN := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f2) +_PAT := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f3) + +patch: + @NEW=v$(_MAJ).$(_MIN).$(shell expr $(_PAT) + 1); \ + git tag $$NEW && echo "Tagged $$NEW" && git push origin $$NEW + +minor: + @NEW=v$(_MAJ).$(shell expr $(_MIN) + 1).0; \ + git tag $$NEW && echo "Tagged $$NEW" && git push origin $$NEW + +major: + @NEW=v$(shell expr $(_MAJ) + 1).0.0; \ + git tag $$NEW && echo "Tagged $$NEW" && git push origin $$NEW diff --git a/README.md b/README.md index a2ea05d..bd166c4 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,31 @@ # container-tea -Gitea tea CLI container image, built on container-base, used by Woodpecker release steps to publish Gitea releases. \ No newline at end of file +The estate's Gitea `tea` CLI image for Woodpecker release steps, built on each `container-base` +distro image. Published as +`artifactapi.k8s.syd1.au.unkin.net/docker-internal/tea:-`; +the default distro's build is retagged as the unsuffixed `:`, so both resolve +to one digest. Only explicit versions are published; never a floating tag. + +| distro | from | tag suffix | default | +| --- | --- | --- | --- | +| `alma9` | `docker-internal/almalinux9:` | `alma9` | yes | + +Adds `tea` from the `rpm-vendor-el9` dnf repo on top of the base image's `git`, `curl`, +`jq` and internal CA. The pinned tea version is `PACKAGES` in `distros//distro.env`. + +The `container-base` release this image builds on is `BASE_VERSION` in the `Dockerfile`. + +## Adding a distro + +1. `distros//distro.env` — `BASE_IMAGE_NAME`, `IMAGE`, `TAG_SUFFIX`, `DEFAULT`, `PACKAGES`. +2. One `include` entry in each of `.woodpecker/{build,docker}.yaml`. + +The `check-distros` pre-commit hook fails if step 1 or 2 is incomplete, or if more than +one distro claims `DEFAULT`. + +## Make + + make build # build every distro + make pre-commit # uvx pre-commit run --all-files + make build-alma9 # one distro + make patch|minor|major diff --git a/ci/check-distros.sh b/ci/check-distros.sh new file mode 100755 index 0000000..4cdc7fb --- /dev/null +++ b/ci/check-distros.sh @@ -0,0 +1,43 @@ +#!/usr/bin/env bash +# Every distros// needs a complete distro.env and an entry in every Woodpecker +# matrix, or a newly added distro silently never gets built. +set -uo pipefail + +KEYS="BASE_IMAGE_NAME IMAGE TAG_SUFFIX DEFAULT PACKAGES" +WORKFLOWS=(.woodpecker/build.yaml .woodpecker/docker.yaml) + +fail=0 +for d in distros/*/; do + n=$(basename "$d") + for k in $KEYS; do + grep -q "^${k}=" "${d}distro.env" || { echo "${d}distro.env: missing ${k}"; fail=1; } + done + for wf in "${WORKFLOWS[@]}"; do + grep -q "DISTRO: ${n}\$" "$wf" || { echo "${wf}: distro ${n} missing from matrix"; fail=1; } + + # A matrix entry that restates a distro.env key must not drift from it — a stale + # BASE_IMAGE here silently overrides distro.env for every CI build. + while IFS='=' read -r k v; do + [ -n "$k" ] || continue + grep -q "^${k}=" "${d}distro.env" || continue + ev=$(sed -n "s/^${k}=//p" "${d}distro.env" | head -1 | sed 's/^"//;s/"$//') + [ "$v" = "$ev" ] || { echo "${wf}: matrix ${k}=\"${v}\" for ${n} disagrees with ${d}distro.env (\"${ev}\")"; fail=1; } + done < tag. +defaults=$(grep -l 'DEFAULT="true"' distros/*/distro.env | wc -l) +[ "$defaults" -eq 1 ] || { echo "expected exactly one distro with DEFAULT=\"true\", found ${defaults}"; fail=1; } + +exit "$fail" diff --git a/distros/alma9/distro.env b/distros/alma9/distro.env new file mode 100644 index 0000000..5e1bfd6 --- /dev/null +++ b/distros/alma9/distro.env @@ -0,0 +1,8 @@ +# alma9 — built on the container-base almalinux9 image +BASE_IMAGE_NAME="almalinux9" +IMAGE="tea" +TAG_SUFFIX="alma9" +# The default distro also gets the unsuffixed : tag. +DEFAULT="true" + +PACKAGES="tea-0.14.0"