Merge pull request 'ci: move Go steps to gobuilder with S3 build cache' (#2 ) from benvin/gocache into main

Reviewed-on: #2
ci: bump gobuilder to 0.1.3-alma9
2026-10-03 00:24:13 +10:00 · 2026-10-03 00:18:16 +10:00 · 2026-10-02 23:53:39 +10:00
5 changed files with 77 additions and 8 deletions
@@ -3,7 +3,19 @@ when:

 steps:
  - name: build
-    image: golang:1.25
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.3-alma9
+    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-sshsignhost
+      GOCACHE_METRICS: "true"
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
    commands:
      - make build
    backend_options:
@@ -5,16 +5,26 @@ when:
 # stay exactly what they were; this one needs a Vault next to it.
 steps:
  - name: integration
-    image: golang:1.25
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.3-alma9
    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-sshsignhost
+      GOCACHE_METRICS: "true"
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
      VAULT_VERSION: 1.20.4
      VAULT_SHA256: fc5fb5d01d192f1216b139fb5c6af17e3af742aaeffc289fd861920ec55f2c9c
      SSHSIGNHOST_TEST_VAULT_ADDR: http://127.0.0.1:8200
      # Throwaway dev-mode server on loopback; this token grants nothing.
      VAULT_TOKEN: dev-root-token
    commands:
-      # The golang image does not trust the estate's internal CA, so artifactapi
-      # is fetched over http and the archive is pinned by checksum instead.
+      # Fetched over http and pinned by checksum rather than relying on TLS trust.
      - curl -fsSL -o /tmp/vault.zip "http://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip"
      - echo "$${VAULT_SHA256}  /tmp/vault.zip" | sha256sum -c -
      - python3 -m zipfile -e /tmp/vault.zip /usr/local/bin/
@@ -3,7 +3,19 @@ when:

 steps:
  - name: pre-commit
-    image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.3-alma9
+    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-sshsignhost
+      GOCACHE_METRICS: "true"
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
    commands:
      - uvx pre-commit run --all-files
    backend_options:
@@ -12,7 +12,19 @@ clone:

 steps:
  - name: test
-    image: golang:1.25
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.3-alma9
+    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-sshsignhost
+      GOCACHE_METRICS: "true"
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
    commands:
      - go test -race ./...
    backend_options:
@@ -29,11 +41,22 @@ steps:
  # One driver for both artifact types: the RPM Puppet installs via dnf and the
  # raw binaries the puppetserver-compiler initContainer fetches by URL.
  - name: goreleaser
-    image: golang:1.26
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.3-alma9
    environment:
      GORELEASER_VERSION: v2.17.0
      GITEA_TOKEN:
        from_secret: RELEASER_TOKEN
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-sshsignhost
+      GOCACHE_METRICS: "true"
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
    commands:
      - go install github.com/goreleaser/goreleaser/v2@$${GORELEASER_VERSION}
      - goreleaser release --clean
@@ -18,7 +18,19 @@ steps:
            cpu: 2

  - name: test
-    image: golang:1.25
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.3-alma9
+    environment:
+      GOCACHE_S3_BUCKET: gocache
+      GOCACHE_S3_REGION: us-east-1
+      GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net
+      GOCACHE_S3_PATH_STYLE: "true"
+      GOCACHE_KEY_PREFIX: ci-sshsignhost
+      GOCACHE_METRICS: "true"
+      GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache
+      AWS_ACCESS_KEY_ID:
+        from_secret: GOCACHE_AWS_ACCESS_KEY_ID
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY
    commands:
      - go test -v -race ./...
    backend_options:
Author	SHA1	Message	Date
benvin	02be33f7fe	Merge pull request 'ci: move Go steps to gobuilder with S3 build cache' (#2 ) from benvin/gocache into main Reviewed-on: #2	2026-10-03 00:24:13 +10:00
unkin-agent	08dd51fc44	ci: bump gobuilder to 0.1.3-alma9 ci/woodpecker/pr/build Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/integration Pipeline was successful Details ci/woodpecker/pr/test Pipeline was successful Details 0.1.2-alma9 left $GOPATH/bin off PATH, so release.yaml's goreleaser step would have exited 127 after `go install` on the next tag. 0.1.3-alma9 sets GOPATH=/go and PATH=/go/bin:$PATH.	2026-10-03 00:18:16 +10:00
unkin-agent	0821d50df2	ci: move Go steps to gobuilder with S3 build cache ci/woodpecker/pr/build Pipeline was successful Details ci/woodpecker/pr/integration Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/test Pipeline was successful Details Switches the estate's older base images off in favor of the shared gobuilder image and wires up the S3-backed Go build cache. - Point build/test/lint-adjacent test/pre-commit/integration/release steps at artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9 - Add GOCACHE_S3_* env and GOCACHEPROG=go-cache-plugin with an absolute --cache-dir to each Go-toolchain step - Leave the dedicated golangci-lint step and the RPM upload step on their existing images	2026-10-02 23:53:39 +10:00