mrhid6
ee1f9f3b32
shared/ is extracted to gitea.hostxtra.co.uk/vantage/vantage-shared and pinned at v0.1.0 by server, agent, admin, sitesvc and vantagectl. The replace directives and the ./shared entry in go.work are gone. Every Go build now needs a credential for the private module: CI writes a netrc per job from REGISTRY_USER + RELEASE_TOKEN and sets GOPRIVATE, and the four Go Dockerfiles take it as a BuildKit secret rather than a build arg, which would survive in the builder layer's history. RELEASE_TOKEN needs read access to the vantage org. admin, sitesvc and vantagectl now build from their own directory; only server still needs the repository root, for default_steps/. The rebuild triggers in server-deploy.yml lose their shared/ patterns, since a service now moves when its own go.mod pin does.
42 lines
1.4 KiB
Docker
42 lines
1.4 KiB
Docker
# Build stage
|
|
#
|
|
# Context is vantagectl/ itself. It used to be the repository root, so that
|
|
# shared/ could be copied in beside it; shared is now the private module
|
|
# gitea.hostxtra.co.uk/vantage/vantage-shared, fetched like any other
|
|
# dependency. The credential for it arrives as a BuildKit secret rather than a
|
|
# build arg, which would be baked into this stage's layer history.
|
|
FROM golang:1.26 AS builder
|
|
|
|
WORKDIR /src
|
|
|
|
ENV GOPRIVATE=gitea.hostxtra.co.uk/*
|
|
|
|
# Manifests first so the dependency layer caches independently of source edits.
|
|
COPY go.mod go.sum ./
|
|
RUN --mount=type=secret,id=netrc,target=/root/.netrc \
|
|
go mod download
|
|
|
|
COPY . .
|
|
|
|
ARG VERSION=dev
|
|
RUN --mount=type=secret,id=netrc,target=/root/.netrc \
|
|
CGO_ENABLED=0 GOOS=linux go build \
|
|
-ldflags="-s -w -X main.Version=${VERSION}" -o /vantagectl .
|
|
|
|
# Staged so the scratch image below can have a /tmp. It cannot mkdir one
|
|
# itself — scratch has no shell.
|
|
RUN mkdir -p /staging/tmp && chmod 1777 /staging/tmp
|
|
|
|
# Runtime stage
|
|
FROM scratch
|
|
|
|
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
|
|
|
|
# restore extracts an archive here before verifying its checksums, and backup
|
|
# stages nothing but still inherits os.MkdirTemp's requirements. Without this
|
|
# every restore stops at "temp dir: stat /tmp: no such file or directory".
|
|
COPY --from=builder /staging/tmp /tmp
|
|
COPY --from=builder /vantagectl /vantagectl
|
|
|
|
ENTRYPOINT ["/vantagectl"]
|