mrhid6/vantage
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 29 Wiki Activity

refactor: consume vantage-shared as an external private module
Chart Release / chart (push) Successful in 19s
Details
Server Deploy / deploy (push) Failing after 1m11s
Details

Browse Source 
shared/ is extracted to gitea.hostxtra.co.uk/vantage/vantage-shared and
pinned at v0.1.0 by server, agent, admin, sitesvc and vantagectl. The
replace directives and the ./shared entry in go.work are gone.

Every Go build now needs a credential for the private module: CI writes a
netrc per job from REGISTRY_USER + RELEASE_TOKEN and sets GOPRIVATE, and
the four Go Dockerfiles take it as a BuildKit secret rather than a build
arg, which would survive in the builder layer's history. RELEASE_TOKEN
needs read access to the vantage org.

admin, sitesvc and vantagectl now build from their own directory; only
server still needs the repository root, for default_steps/. The rebuild
triggers in server-deploy.yml lose their shared/ patterns, since a
service now moves when its own go.mod pin does.
This commit is contained in:
mrhid6
2026-09-08 07:42:58 +00:00
parent 5326639918
commit ee1f9f3b32
91 changed files with 251 additions and 5751 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/Dockerfile
+14 -8
View File
@@ -1,21 +1,27 @@
# Build stage
#
# Context is the repository root, not server/, because server depends on the
# shared module through a replace directive.
# Context is still the repository root, not server/, because the runtime stage
# copies default_steps/ from it.
#
# vantage-shared is a private module, so every step that resolves it needs a
# credential. It arrives as a BuildKit secret rather than a build arg: an arg
# is baked into the builder layer's history, and this one is a Gitea token.
FROM golang:1.26 AS builder
WORKDIR /src
# Manifests first so the dependency layer caches independently of source edits.
COPY shared/go.mod shared/go.sum ./shared/
COPY server/go.mod server/go.sum ./server/
RUN cd server && go mod download
ENV GOPRIVATE=gitea.hostxtra.co.uk/*
# Manifests first so the dependency layer caches independently of source edits.
COPY server/go.mod server/go.sum ./server/
RUN --mount=type=secret,id=netrc,target=/root/.netrc \
cd server && go mod download
COPY shared/ ./shared/
COPY server/ ./server/
ARG VERSION=dev
RUN cd server && CGO_ENABLED=0 GOOS=linux go build \
RUN --mount=type=secret,id=netrc,target=/root/.netrc \
cd server && CGO_ENABLED=0 GOOS=linux go build \
-ldflags="-s -w -X main.Version=${VERSION}" -o /vantage-server ./cmd
# Staged so the scratch image below can have a /tmp. It cannot mkdir one
server/go.mod
+1 -3
View File
@@ -37,7 +37,7 @@ require (
)
require (
gitea.hostxtra.co.uk/vantage/vantage-shared v0.0.0
gitea.hostxtra.co.uk/vantage/vantage-shared v0.1.0
github.com/bytedance/sonic v1.11.6 // indirect
github.com/bytedance/sonic/loader v0.1.1 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
@@ -77,5 +77,3 @@ require (
google.golang.org/protobuf v1.34.2 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
)
replace gitea.hostxtra.co.uk/vantage/vantage-shared => ../shared
server/go.sum
+2
View File
@@ -1,3 +1,5 @@
gitea.hostxtra.co.uk/vantage/vantage-shared v0.1.0 h1:H6PCb8JHucrRiqPe9kGOhXUjBD66tKFHCP3qz5TjdZc=
gitea.hostxtra.co.uk/vantage/vantage-shared v0.1.0/go.mod h1:dWjeOFLltQ8sv9Pnn1xRxGfWGgqa2fkG0esuaJLoPXQ=
github.com/aquasecurity/bolt-fixtures v0.0.0-20200903104109-d34e7f983986 h1:2a30xLN2sUZcMXl50hg+PJCIDdJgIvIbVcKqLJ/ZrtM=
github.com/aquasecurity/bolt-fixtures v0.0.0-20200903104109-d34e7f983986/go.mod h1:NT+jyeCzXk6vXR5MTkdn4z64TgGfE5HMLC8qfj5unl8=
github.com/aquasecurity/trivy-db v0.0.0-20260713131703-4be526083c54 h1:4CZNoDkNfcuACevZeDraACGmP1+L0nKkRY52+jV8k1M=