From f5ff2b635c9546c4031dd76ffe5176679a326f65 Mon Sep 17 00:00:00 2001 From: Timo Reymann Date: Wed, 9 Sep 2026 22:35:10 +0200 Subject: [PATCH] feat: add minimal golang image to verify tag_ranges' json source MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds _base/images/golang, the same deliberately trivial pattern as _base/images/node (FROM scratch, one ARG, one LABEL) but exercising the generic json source + JSONata transform instead of dockerhub, to cover both source types added by ContainerHive/ContainerHive#241: tag_ranges: - tag_name: "{{.full}}" source: type: json url: "https://go.dev/dl/?mode=json" transform: | $[stable = true].{ "version": $substring(version, 2) } select: major: { last: 1 } minor: { last: 1 } patch: { last: 1 } versions: golang: "{{.full}}" go.dev's feed strips to the last two stable releases by default (a tiny payload, unlike node's/nodejs.org's full history), and each entry's "version" field carries a "go" prefix that $substring(version, 2) removes - mirroring the issue's own "v" -> $substring(version, 1) example for Node.js. Verified locally against a tag_ranges-capable ch build: resolved to 1.27.1 (go.dev's current stable at the time) and GOLANG_VERSION=1.27.1 came out the other end of buildconfig_resolver, alongside node's own NODEJS_VERSION resolving independently and correctly in the same run. Regenerated both CI pipelines to add the resulting golang build/test/ manifest jobs. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- .github/workflows/main.yml | 115 ++++++++++++++++++++++++++++++++- _base/images/golang/Dockerfile | 3 + _base/images/golang/README.md | 11 ++++ _base/images/golang/image.yml | 23 +++++++ gitlab/pipeline.gitlab-ci.yml | 47 +++++++++++++- 5 files changed, 197 insertions(+), 2 deletions(-) create mode 100644 _base/images/golang/Dockerfile create mode 100644 _base/images/golang/README.md create mode 100644 _base/images/golang/image.yml diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 80ec7b4..b1a612f 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -1,6 +1,6 @@ # Auto-generated by ContainerHive # Do not edit - regenerate with: ch --project github template ci --provider github --output .github/workflows/main.yml --image-name ghcr.io/containerhive/containerhive -# tag_ranges resolved to 9 shard unit(s) - regenerate if this changes. +# tag_ranges resolved to 10 shard unit(s) - regenerate if this changes. name: Build Images @@ -370,6 +370,113 @@ jobs: comment: 'true' updateComment: 'true' include_passed: 'true' + # === GOLANG === + + build-golang-amd64: + runs-on: ubuntu-24.04 + needs: + - generate + - lint + steps: + - name: Checkout code + uses: actions/checkout@v7.0.1 + with: + lfs: true + - name: Download generated files + uses: actions/download-artifact@v8.0.1 + with: + name: generated + path: github/dist/ + - name: Prepare temp directory + run: mkdir -p "$RUNNER_TEMP/ch" + - name: Create Docker network + run: docker network create ch-net + - name: Start BuildKit daemon + run: docker run -d --name buildkitd --privileged --network ch-net moby/buildkit:v0.31.0 --addr tcp://0.0.0.0:8372 + - name: Login to registry + run: echo "${{ secrets.CONTAINER_HIVE_REGISTRY_PASSWORD }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github login -u "${{ secrets.CONTAINER_HIVE_REGISTRY_USERNAME }}" --password-stdin "ghcr.io" + - name: Login to GHCR + run: echo "${{ secrets.GITHUB_TOKEN }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github login -u "${{ github.actor }}" --password-stdin ghcr.io + - name: Wait for BuildKit + run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github wait --buildkitd + - name: Build image + run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github build golang --platform amd64 --build-id "$SNAPSHOT_ID" + - name: Generate SBOM + run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github sbom golang --platform amd64 --build-id "$SNAPSHOT_ID" + - name: Upload SBOM + uses: actions/upload-artifact@v7.0.1 + with: + name: golang-amd64-sbom + path: github/dist/*/*/*/cyclonedx.json + retention-days: 30 + + + manifest-golang: + runs-on: ubuntu-latest + needs: + - test-golang + - build-golang-amd64 + steps: + - name: Checkout code + uses: actions/checkout@v7.0.1 + with: + lfs: true + - name: Download generated files + uses: actions/download-artifact@v8.0.1 + with: + name: generated + path: github/dist/ + - name: Prepare temp directory + run: mkdir -p "$RUNNER_TEMP/ch" + - name: Login to registry + run: echo "${{ secrets.CONTAINER_HIVE_REGISTRY_PASSWORD }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" $CH_IMAGE ch -p github login -u "${{ secrets.CONTAINER_HIVE_REGISTRY_USERNAME }}" --password-stdin "ghcr.io" + - name: Login to GHCR + run: echo "${{ secrets.GITHUB_TOKEN }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" $CH_IMAGE ch -p github login -u "${{ github.actor }}" --password-stdin ghcr.io + - name: Finalize manifest + run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" $CH_IMAGE ch -p github finalize golang --build-id "$SNAPSHOT_ID" + + test-golang: + runs-on: ubuntu-latest + needs: + - build-golang-amd64 + steps: + - name: Checkout code + uses: actions/checkout@v7.0.1 + with: + lfs: true + - name: Download generated files + uses: actions/download-artifact@v8.0.1 + with: + name: generated + path: github/dist/ + - name: Prepare temp directory + run: mkdir -p "$RUNNER_TEMP/ch" + - name: Setup QEMU + run: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes + - name: Create Docker network + run: docker network create ch-net + - name: Start Docker-in-Docker + run: docker run -d --name dind --privileged --network ch-net -e DOCKER_TLS_CERTDIR="" docker:dind + - name: Login to registry + run: echo "${{ secrets.CONTAINER_HIVE_REGISTRY_PASSWORD }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e DOCKER_HOST=tcp://dind:2375 $CH_IMAGE ch -p github login -u "${{ secrets.CONTAINER_HIVE_REGISTRY_USERNAME }}" --password-stdin "ghcr.io" + - name: Login to GHCR + run: echo "${{ secrets.GITHUB_TOKEN }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e DOCKER_HOST=tcp://dind:2375 $CH_IMAGE ch -p github login -u "${{ github.actor }}" --password-stdin ghcr.io + - name: Wait for Docker socket + run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e DOCKER_HOST=tcp://dind:2375 $CH_IMAGE ch -p github wait --docker-socket + - name: Run container tests + run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e DOCKER_HOST=tcp://dind:2375 $CH_IMAGE ch -p github test golang --build-id "$SNAPSHOT_ID" + - name: Publish Test Report + id: test-report + uses: mikepenz/action-junit-report@v6.5.0 + if: success() || failure() + with: + check_name: "Container Structure Tests - golang" + report_paths: 'github/dist/**/*-cst-report.xml' + require_tests: 'false' + detailed_summary: 'true' + comment: 'true' + updateComment: 'true' + include_passed: 'true' # === NODE === build-node-amd64: @@ -699,6 +806,7 @@ jobs: - build-base-ci-arm64 - build-base-deployment-amd64 - build-base-deployment-arm64 + - build-golang-amd64 - build-node-amd64 - build-dotnet-runtime-amd64 - build-go-ci-amd64 @@ -733,6 +841,11 @@ jobs: with: name: base-deployment-arm64-sbom path: github/dist/ + - name: Download golang-amd64 SBOM + uses: actions/download-artifact@v8.0.1 + with: + name: golang-amd64-sbom + path: github/dist/ - name: Download node-amd64 SBOM uses: actions/download-artifact@v8.0.1 with: diff --git a/_base/images/golang/Dockerfile b/_base/images/golang/Dockerfile new file mode 100644 index 0000000..05a7fa4 --- /dev/null +++ b/_base/images/golang/Dockerfile @@ -0,0 +1,3 @@ +FROM scratch +ARG GOLANG_VERSION +LABEL golang.version="${GOLANG_VERSION}" diff --git a/_base/images/golang/README.md b/_base/images/golang/README.md new file mode 100644 index 0000000..fa42b7f --- /dev/null +++ b/_base/images/golang/README.md @@ -0,0 +1,11 @@ +# Golang + +Demo image with no install steps, existing purely to verify that `tag_ranges` resolves +the latest Go version from [go.dev's release feed](https://go.dev/dl/?mode=json) at +discovery time and threads it through as the `GOLANG_VERSION` build arg. + +## Usage + +```dockerfile +FROM __hive__/golang: +``` diff --git a/_base/images/golang/image.yml b/_base/images/golang/image.yml new file mode 100644 index 0000000..11d38a3 --- /dev/null +++ b/_base/images/golang/image.yml @@ -0,0 +1,23 @@ +description: "Minimal image proving tag_ranges resolves the latest Go version straight from go.dev's release feed." + +tag_ranges: + - tag_name: "{{.full}}" + source: + type: json + url: "https://go.dev/dl/?mode=json" + transform: | + $[stable = true].{ + "version": $substring(version, 2) + } + select: + major: { last: 1 } + minor: { last: 1 } + patch: { last: 1 } + versions: + golang: "{{.full}}" + +report: + icon: "devicon-go-original-wordmark" + +platforms: + - linux/amd64 diff --git a/gitlab/pipeline.gitlab-ci.yml b/gitlab/pipeline.gitlab-ci.yml index d4cfceb..dbe61be 100644 --- a/gitlab/pipeline.gitlab-ci.yml +++ b/gitlab/pipeline.gitlab-ci.yml @@ -1,6 +1,6 @@ # Auto-generated by ContainerHive # Do not edit - regenerate with: ch --project gitlab template ci --provider gitlab --output gitlab/pipeline.gitlab-ci.yml --image-name ghcr.io/containerhive/containerhive -# tag_ranges resolved to 9 shard unit(s) - regenerate if this changes. +# tag_ranges resolved to 10 shard unit(s) - regenerate if this changes. workflow: auto_cancel: @@ -18,6 +18,9 @@ stages: - build-base-deployment - test-base-deployment - manifest-base-deployment + - build-golang + - test-golang + - manifest-golang - build-node - test-node - manifest-node @@ -236,6 +239,47 @@ test-base-deployment: - gitlab/dist/**/*-cst-report.xml reports: junit: gitlab/dist/**/*-cst-report.xml +# === GOLANG === + +build-golang-amd64: + extends: .build-amd64 + stage: build-golang + variables: + IMAGE_NAME: golang + PLATFORM: amd64 + needs: + - generate + artifacts: + paths: + - gitlab/dist/golang/*/*/cyclonedx.json + reports: + cyclonedx: gitlab/dist/golang/*/*/cyclonedx.json + + +manifest-golang: + extends: .manifest + stage: manifest-golang + variables: + IMAGE_NAME: golang + needs: + - generate + - test-golang + - build-golang-amd64 + +test-golang: + extends: .test + stage: test-golang + variables: + IMAGE_NAME: golang + needs: + - generate + - build-golang-amd64 + artifacts: + when: always + paths: + - gitlab/dist/**/*-cst-report.xml + reports: + junit: gitlab/dist/**/*-cst-report.xml # === NODE === build-node-amd64: @@ -377,6 +421,7 @@ report: - build-base-ci-arm64 - build-base-deployment-amd64 - build-base-deployment-arm64 + - build-golang-amd64 - build-node-amd64 - build-dotnet-runtime-amd64 - build-go-ci-amd64