Scaffold build repo for pinned tailscale/go-cache-plugin #1

Merged

benvin merged 5 commits from benvin/scaffold into main 2026-09-27 00:35:13 +10:00

Conversation 2 Commits 5 Files Changed 13

+659 -1

unkin-agent commented 2026-09-26 21:37:47 +10:00

Member

Copy Link

Copy Source

Upstream publishes no releases, so CI has nothing to curl for an S3-backed Go build cache and the cluster has no image to run it from.

• pin cmd/go-cache-plugin at 3031b5d via the go.mod tool directive
• build a static stripped binary with make build
• test the built binary: static ELF, pinned provenance, and a real go build driven through it as a GOCACHEPROG against a stub S3
• package the binary into a distroless image pushed to docker-internal on tag
• add PR build/test/pre-commit workflows and a tag release workflow attaching linux/amd64 and linux/arm64 to a Gitea release

Upstream publishes no releases, so CI has nothing to curl for an S3-backed Go build cache and the cluster has no image to run it from. - pin `cmd/go-cache-plugin` at `3031b5d` via the `go.mod` tool directive - build a static stripped binary with `make build` - test the built binary: static ELF, pinned provenance, and a real `go build` driven through it as a GOCACHEPROG against a stub S3 - package the binary into a distroless image pushed to docker-internal on tag - add PR build/test/pre-commit workflows and a tag release workflow attaching linux/amd64 and linux/arm64 to a Gitea release

unkin-agent added 1 commit 2026-09-26 21:37:47 +10:00

Scaffold build repo for pinned tailscale/go-cache-plugin ... 3e2f7e59b6

Upstream publishes no releases, so CI has nothing to curl.

- pin cmd/go-cache-plugin at 3031b5d via the go.mod tool directive
- build a static stripped binary with make build
- test the built binary: static ELF, pinned provenance, and a real
  go build driven through it as a GOCACHEPROG against a stub S3
- add PR build/test/pre-commit workflows and a tag release workflow
  attaching linux/amd64 and linux/arm64 to a Gitea release

unkin-agent commented 2026-09-26 22:10:29 +10:00

Author

Member

Copy Link

Copy Source

build_test.go:35-36 — TestMain builds the plugin with its own hardcoded go build -ldflags=-s -w + CGO_ENABLED=0, never shelling out to make build. TestBinaryIsStatic/TestBuiltFromPinnedVersion therefore validate a shadow build, not the Makefile recipe the release pipeline actually ships (release.yaml calls make build directly). A regression in the Makefile build target (e.g. dropped CGO_ENABLED=0, wrong $(PKG)) would pass CI undetected. -> have TestMain exec make build (or invoke the same target) so the tested binary is the shipped one.
nit: README.md:51 — CI curl example hardcodes releases/download/v0.1.0/..., but the Makefile bump targets start from v0.0.0, so the first tag will be v0.0.1, not v0.1.0. -> use a placeholder like <tag> or fix once a real first tag exists.
nit: Makefile:19 — test runs go test -v ./... without -race, unlike node-lookups convention (go test -v -race ./...). -> add -race for consistency, or drop the comparison expectation.

build_test.go:35-36 — TestMain builds the plugin with its own hardcoded `go build -ldflags=-s -w` + `CGO_ENABLED=0`, never shelling out to `make build`. TestBinaryIsStatic/TestBuiltFromPinnedVersion therefore validate a shadow build, not the Makefile recipe the release pipeline actually ships (release.yaml calls `make build` directly). A regression in the Makefile build target (e.g. dropped `CGO_ENABLED=0`, wrong `$(PKG)`) would pass CI undetected. -> have TestMain exec `make build` (or invoke the same target) so the tested binary is the shipped one. nit: README.md:51 — CI curl example hardcodes `releases/download/v0.1.0/...`, but the Makefile bump targets start from v0.0.0, so the first tag will be v0.0.1, not v0.1.0. -> use a placeholder like `<tag>` or fix once a real first tag exists. nit: Makefile:19 — `test` runs `go test -v ./...` without `-race`, unlike node-lookups convention (`go test -v -race ./...`). -> add `-race` for consistency, or drop the comparison expectation.

unkin-agent added 1 commit 2026-09-26 22:18:42 +10:00

Test the Makefile build recipe, not a copy of it 6a1db8d209

unkin-agent added 1 commit 2026-09-26 22:22:35 +10:00

Rename GOFLAGS make variable to LDFLAGS d288f225ee

unkin-agent commented 2026-09-26 22:27:18 +10:00

Author

Member

Copy Link

Copy Source

No findings.

No findings.

unkin-agent referenced this pull request 2026-09-27 00:26:24 +10:00

Add container image build #2

benvin added 2 commits 2026-09-27 00:31:23 +10:00

Add container image build ... b5e68da270

Ship a distroless image so the plugin can run in-cluster in serve mode,
letting developer laptops use the shared cache without S3 credentials.

- Dockerfile: golang builder running `make build`, distroless static nonroot
- `make docker` for a local smoke build
- `.woodpecker/docker.yaml` pushes to docker-internal on tag
- README: image name and the SSL_CERT_DIR mount the internal CA needs

Merge pull request 'Add container image build' (#2) from benvin/image into benvin/scaffold ... 4210106a0c

Reviewed-on: #2

benvin merged commit 91b9e5a3c7 into main 2026-09-27 00:35:13 +10:00

benvin deleted branch benvin/scaffold 2026-09-27 00:35:14 +10:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something is not working

duplicate

This issue or pull request already exists

enhancement

New feature

help wanted

Need some help

invalid

Something is wrong

question

More information is needed

wontfix

This won't be fixed

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/go-cache-plugin#1