From 0821d50df200ff9f8f703f1c3c3e56cffc5796cf Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Fri, 2 Oct 2026 23:53:39 +1000 Subject: [PATCH 1/2] ci: move Go steps to gobuilder with S3 build cache Switches the estate's older base images off in favor of the shared gobuilder image and wires up the S3-backed Go build cache. - Point build/test/lint-adjacent test/pre-commit/integration/release steps at artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9 - Add GOCACHE_S3_* env and GOCACHEPROG=go-cache-plugin with an absolute --cache-dir to each Go-toolchain step - Leave the dedicated golangci-lint step and the RPM upload step on their existing images --- .woodpecker/build.yaml | 14 +++++++++++++- .woodpecker/integration.yaml | 16 +++++++++++++--- .woodpecker/pre-commit.yaml | 14 +++++++++++++- .woodpecker/release.yaml | 27 +++++++++++++++++++++++++-- .woodpecker/test.yaml | 14 +++++++++++++- 5 files changed, 77 insertions(+), 8 deletions(-) diff --git a/.woodpecker/build.yaml b/.woodpecker/build.yaml index 74123b5..8448f17 100644 --- a/.woodpecker/build.yaml +++ b/.woodpecker/build.yaml @@ -3,7 +3,19 @@ when: steps: - name: build - image: golang:1.25 + image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9 + environment: + GOCACHE_S3_BUCKET: gocache + GOCACHE_S3_REGION: us-east-1 + GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net + GOCACHE_S3_PATH_STYLE: "true" + GOCACHE_KEY_PREFIX: ci-sshsignhost + GOCACHE_METRICS: "true" + GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache + AWS_ACCESS_KEY_ID: + from_secret: GOCACHE_AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY: + from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY commands: - make build backend_options: diff --git a/.woodpecker/integration.yaml b/.woodpecker/integration.yaml index 167558a..0fa47d2 100644 --- a/.woodpecker/integration.yaml +++ b/.woodpecker/integration.yaml @@ -5,16 +5,26 @@ when: # stay exactly what they were; this one needs a Vault next to it. steps: - name: integration - image: golang:1.25 + image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9 environment: + GOCACHE_S3_BUCKET: gocache + GOCACHE_S3_REGION: us-east-1 + GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net + GOCACHE_S3_PATH_STYLE: "true" + GOCACHE_KEY_PREFIX: ci-sshsignhost + GOCACHE_METRICS: "true" + GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache + AWS_ACCESS_KEY_ID: + from_secret: GOCACHE_AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY: + from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY VAULT_VERSION: 1.20.4 VAULT_SHA256: fc5fb5d01d192f1216b139fb5c6af17e3af742aaeffc289fd861920ec55f2c9c SSHSIGNHOST_TEST_VAULT_ADDR: http://127.0.0.1:8200 # Throwaway dev-mode server on loopback; this token grants nothing. VAULT_TOKEN: dev-root-token commands: - # The golang image does not trust the estate's internal CA, so artifactapi - # is fetched over http and the archive is pinned by checksum instead. + # Fetched over http and pinned by checksum rather than relying on TLS trust. - curl -fsSL -o /tmp/vault.zip "http://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" - echo "$${VAULT_SHA256} /tmp/vault.zip" | sha256sum -c - - python3 -m zipfile -e /tmp/vault.zip /usr/local/bin/ diff --git a/.woodpecker/pre-commit.yaml b/.woodpecker/pre-commit.yaml index d57b508..710c327 100644 --- a/.woodpecker/pre-commit.yaml +++ b/.woodpecker/pre-commit.yaml @@ -3,7 +3,19 @@ when: steps: - name: pre-commit - image: git.unkin.net/unkin/almalinux9-gobuilder:20260606 + image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9 + environment: + GOCACHE_S3_BUCKET: gocache + GOCACHE_S3_REGION: us-east-1 + GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net + GOCACHE_S3_PATH_STYLE: "true" + GOCACHE_KEY_PREFIX: ci-sshsignhost + GOCACHE_METRICS: "true" + GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache + AWS_ACCESS_KEY_ID: + from_secret: GOCACHE_AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY: + from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY commands: - uvx pre-commit run --all-files backend_options: diff --git a/.woodpecker/release.yaml b/.woodpecker/release.yaml index d0d6672..fa05ea2 100644 --- a/.woodpecker/release.yaml +++ b/.woodpecker/release.yaml @@ -12,7 +12,19 @@ clone: steps: - name: test - image: golang:1.25 + image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9 + environment: + GOCACHE_S3_BUCKET: gocache + GOCACHE_S3_REGION: us-east-1 + GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net + GOCACHE_S3_PATH_STYLE: "true" + GOCACHE_KEY_PREFIX: ci-sshsignhost + GOCACHE_METRICS: "true" + GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache + AWS_ACCESS_KEY_ID: + from_secret: GOCACHE_AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY: + from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY commands: - go test -race ./... backend_options: @@ -29,11 +41,22 @@ steps: # One driver for both artifact types: the RPM Puppet installs via dnf and the # raw binaries the puppetserver-compiler initContainer fetches by URL. - name: goreleaser - image: golang:1.26 + image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9 environment: GORELEASER_VERSION: v2.17.0 GITEA_TOKEN: from_secret: RELEASER_TOKEN + GOCACHE_S3_BUCKET: gocache + GOCACHE_S3_REGION: us-east-1 + GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net + GOCACHE_S3_PATH_STYLE: "true" + GOCACHE_KEY_PREFIX: ci-sshsignhost + GOCACHE_METRICS: "true" + GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache + AWS_ACCESS_KEY_ID: + from_secret: GOCACHE_AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY: + from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY commands: - go install github.com/goreleaser/goreleaser/v2@$${GORELEASER_VERSION} - goreleaser release --clean diff --git a/.woodpecker/test.yaml b/.woodpecker/test.yaml index 5e179a7..d5d78e8 100644 --- a/.woodpecker/test.yaml +++ b/.woodpecker/test.yaml @@ -18,7 +18,19 @@ steps: cpu: 2 - name: test - image: golang:1.25 + image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9 + environment: + GOCACHE_S3_BUCKET: gocache + GOCACHE_S3_REGION: us-east-1 + GOCACHE_S3_ENDPOINT_URL: https://s3.ceph.unkin.net + GOCACHE_S3_PATH_STYLE: "true" + GOCACHE_KEY_PREFIX: ci-sshsignhost + GOCACHE_METRICS: "true" + GOCACHEPROG: go-cache-plugin --cache-dir=/tmp/gocache + AWS_ACCESS_KEY_ID: + from_secret: GOCACHE_AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY: + from_secret: GOCACHE_AWS_SECRET_ACCESS_KEY commands: - go test -v -race ./... backend_options: -- 2.47.3 From 08dd51fc4458550a0bbb75545c1700feafccd12d Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 3 Oct 2026 00:18:16 +1000 Subject: [PATCH 2/2] ci: bump gobuilder to 0.1.3-alma9 0.1.2-alma9 left $GOPATH/bin off PATH, so release.yaml's goreleaser step would have exited 127 after `go install` on the next tag. 0.1.3-alma9 sets GOPATH=/go and PATH=/go/bin:$PATH. --- .woodpecker/build.yaml | 2 +- .woodpecker/integration.yaml | 2 +- .woodpecker/pre-commit.yaml | 2 +- .woodpecker/release.yaml | 4 ++-- .woodpecker/test.yaml | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.woodpecker/build.yaml b/.woodpecker/build.yaml index 8448f17..0219a4a 100644 --- a/.woodpecker/build.yaml +++ b/.woodpecker/build.yaml @@ -3,7 +3,7 @@ when: steps: - name: build - image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9 + image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.3-alma9 environment: GOCACHE_S3_BUCKET: gocache GOCACHE_S3_REGION: us-east-1 diff --git a/.woodpecker/integration.yaml b/.woodpecker/integration.yaml index 0fa47d2..12a06e3 100644 --- a/.woodpecker/integration.yaml +++ b/.woodpecker/integration.yaml @@ -5,7 +5,7 @@ when: # stay exactly what they were; this one needs a Vault next to it. steps: - name: integration - image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9 + image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.3-alma9 environment: GOCACHE_S3_BUCKET: gocache GOCACHE_S3_REGION: us-east-1 diff --git a/.woodpecker/pre-commit.yaml b/.woodpecker/pre-commit.yaml index 710c327..b368ae9 100644 --- a/.woodpecker/pre-commit.yaml +++ b/.woodpecker/pre-commit.yaml @@ -3,7 +3,7 @@ when: steps: - name: pre-commit - image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9 + image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.3-alma9 environment: GOCACHE_S3_BUCKET: gocache GOCACHE_S3_REGION: us-east-1 diff --git a/.woodpecker/release.yaml b/.woodpecker/release.yaml index fa05ea2..7389316 100644 --- a/.woodpecker/release.yaml +++ b/.woodpecker/release.yaml @@ -12,7 +12,7 @@ clone: steps: - name: test - image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9 + image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.3-alma9 environment: GOCACHE_S3_BUCKET: gocache GOCACHE_S3_REGION: us-east-1 @@ -41,7 +41,7 @@ steps: # One driver for both artifact types: the RPM Puppet installs via dnf and the # raw binaries the puppetserver-compiler initContainer fetches by URL. - name: goreleaser - image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9 + image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.3-alma9 environment: GORELEASER_VERSION: v2.17.0 GITEA_TOKEN: diff --git a/.woodpecker/test.yaml b/.woodpecker/test.yaml index d5d78e8..8b365dd 100644 --- a/.woodpecker/test.yaml +++ b/.woodpecker/test.yaml @@ -18,7 +18,7 @@ steps: cpu: 2 - name: test - image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.2-alma9 + image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:0.1.3-alma9 environment: GOCACHE_S3_BUCKET: gocache GOCACHE_S3_REGION: us-east-1 -- 2.47.3