feat: add minimal golang image to verify tag_ranges' json source

.github/workflows/main.yml

@@ -1,6 +1,6 @@
 # Auto-generated by ContainerHive
 # Do not edit - regenerate with: ch --project github template ci --provider github --output .github/workflows/main.yml --image-name ghcr.io/containerhive/containerhive
-# tag_ranges resolved to 9 shard unit(s) - regenerate if this changes.
+# tag_ranges resolved to 10 shard unit(s) - regenerate if this changes.
 
 name: Build Images
 
@@ -370,6 +370,113 @@ jobs:
           comment: 'true'
           updateComment: 'true'
           include_passed: 'true'
+  # === GOLANG ===
+
+  build-golang-amd64:
+    runs-on: ubuntu-24.04
+    needs:
+      - generate
+      - lint
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7.0.1
+        with:
+          lfs: true
+      - name: Download generated files
+        uses: actions/download-artifact@v8.0.1
+        with:
+          name: generated
+          path: github/dist/
+      - name: Prepare temp directory
+        run: mkdir -p "$RUNNER_TEMP/ch"
+      - name: Create Docker network
+        run: docker network create ch-net
+      - name: Start BuildKit daemon
+        run: docker run -d --name buildkitd --privileged --network ch-net moby/buildkit:v0.31.0 --addr tcp://0.0.0.0:8372
+      - name: Login to registry
+        run: echo "${{ secrets.CONTAINER_HIVE_REGISTRY_PASSWORD }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github login -u "${{ secrets.CONTAINER_HIVE_REGISTRY_USERNAME }}" --password-stdin "ghcr.io"
+      - name: Login to GHCR
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github login -u "${{ github.actor }}" --password-stdin ghcr.io
+      - name: Wait for BuildKit
+        run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github wait --buildkitd
+      - name: Build image
+        run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github build golang --platform amd64 --build-id "$SNAPSHOT_ID"
+      - name: Generate SBOM
+        run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github sbom golang --platform amd64 --build-id "$SNAPSHOT_ID"
+      - name: Upload SBOM
+        uses: actions/upload-artifact@v7.0.1
+        with:
+          name: golang-amd64-sbom
+          path: github/dist/*/*/*/cyclonedx.json
+          retention-days: 30
+
+
+  manifest-golang:
+    runs-on: ubuntu-latest
+    needs:
+      - test-golang
+      - build-golang-amd64
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7.0.1
+        with:
+          lfs: true
+      - name: Download generated files
+        uses: actions/download-artifact@v8.0.1
+        with:
+          name: generated
+          path: github/dist/
+      - name: Prepare temp directory
+        run: mkdir -p "$RUNNER_TEMP/ch"
+      - name: Login to registry
+        run: echo "${{ secrets.CONTAINER_HIVE_REGISTRY_PASSWORD }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" $CH_IMAGE ch -p github login -u "${{ secrets.CONTAINER_HIVE_REGISTRY_USERNAME }}" --password-stdin "ghcr.io"
+      - name: Login to GHCR
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" $CH_IMAGE ch -p github login -u "${{ github.actor }}" --password-stdin ghcr.io
+      - name: Finalize manifest
+        run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" $CH_IMAGE ch -p github finalize golang --build-id "$SNAPSHOT_ID"
+
+  test-golang:
+    runs-on: ubuntu-latest
+    needs:
+      - build-golang-amd64
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7.0.1
+        with:
+          lfs: true
+      - name: Download generated files
+        uses: actions/download-artifact@v8.0.1
+        with:
+          name: generated
+          path: github/dist/
+      - name: Prepare temp directory
+        run: mkdir -p "$RUNNER_TEMP/ch"
+      - name: Setup QEMU
+        run: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
+      - name: Create Docker network
+        run: docker network create ch-net
+      - name: Start Docker-in-Docker
+        run: docker run -d --name dind --privileged --network ch-net -e DOCKER_TLS_CERTDIR="" docker:dind
+      - name: Login to registry
+        run: echo "${{ secrets.CONTAINER_HIVE_REGISTRY_PASSWORD }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e DOCKER_HOST=tcp://dind:2375 $CH_IMAGE ch -p github login -u "${{ secrets.CONTAINER_HIVE_REGISTRY_USERNAME }}" --password-stdin "ghcr.io"
+      - name: Login to GHCR
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e DOCKER_HOST=tcp://dind:2375 $CH_IMAGE ch -p github login -u "${{ github.actor }}" --password-stdin ghcr.io
+      - name: Wait for Docker socket
+        run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e DOCKER_HOST=tcp://dind:2375 $CH_IMAGE ch -p github wait --docker-socket
+      - name: Run container tests
+        run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e DOCKER_HOST=tcp://dind:2375 $CH_IMAGE ch -p github test golang --build-id "$SNAPSHOT_ID"
+      - name: Publish Test Report
+        id: test-report
+        uses: mikepenz/action-junit-report@v6.5.0
+        if: success() || failure()
+        with:
+          check_name: "Container Structure Tests - golang"
+          report_paths: 'github/dist/**/*-cst-report.xml'
+          require_tests: 'false'
+          detailed_summary: 'true'
+          comment: 'true'
+          updateComment: 'true'
+          include_passed: 'true'
   # === NODE ===
 
   build-node-amd64:
@@ -699,6 +806,7 @@ jobs:
       - build-base-ci-arm64
       - build-base-deployment-amd64
       - build-base-deployment-arm64
+      - build-golang-amd64
       - build-node-amd64
       - build-dotnet-runtime-amd64
       - build-go-ci-amd64
@@ -733,6 +841,11 @@ jobs:
         with:
           name: base-deployment-arm64-sbom
           path: github/dist/
+      - name: Download golang-amd64 SBOM
+        uses: actions/download-artifact@v8.0.1
+        with:
+          name: golang-amd64-sbom
+          path: github/dist/
       - name: Download node-amd64 SBOM
         uses: actions/download-artifact@v8.0.1
         with:

_base/images/golang/Dockerfile

@@ -0,0 +1,3 @@
+FROM scratch
+ARG GOLANG_VERSION
+LABEL golang.version="${GOLANG_VERSION}"

_base/images/golang/README.md

@@ -0,0 +1,11 @@
+# Golang
+
+Demo image with no install steps, existing purely to verify that `tag_ranges` resolves
+the latest Go version from [go.dev's release feed](https://go.dev/dl/?mode=json) at
+discovery time and threads it through as the `GOLANG_VERSION` build arg.
+
+## Usage
+
+```dockerfile
+FROM __hive__/golang:<resolved-version>
+```

_base/images/golang/image.yml

@@ -0,0 +1,23 @@
+description: "Minimal image proving tag_ranges resolves the latest Go version straight from go.dev's release feed."
+
+tag_ranges:
+  - tag_name: "{{.full}}"
+    source:
+      type: json
+      url: "https://go.dev/dl/?mode=json"
+      transform: |
+        $[stable = true].{
+          "version": $substring(version, 2)
+        }
+    select:
+      major: { last: 1 }
+      minor: { last: 1 }
+      patch: { last: 1 }
+    versions:
+      golang: "{{.full}}"
+
+report:
+  icon: "devicon-go-original-wordmark"
+
+platforms:
+  - linux/amd64

gitlab/pipeline.gitlab-ci.yml

@@ -1,6 +1,6 @@
 # Auto-generated by ContainerHive
 # Do not edit - regenerate with: ch --project gitlab template ci --provider gitlab --output gitlab/pipeline.gitlab-ci.yml --image-name ghcr.io/containerhive/containerhive
-# tag_ranges resolved to 9 shard unit(s) - regenerate if this changes.
+# tag_ranges resolved to 10 shard unit(s) - regenerate if this changes.
 
 workflow:
   auto_cancel:
@@ -18,6 +18,9 @@ stages:
   - build-base-deployment
   - test-base-deployment
   - manifest-base-deployment
+  - build-golang
+  - test-golang
+  - manifest-golang
   - build-node
   - test-node
   - manifest-node
@@ -236,6 +239,47 @@ test-base-deployment:
       - gitlab/dist/**/*-cst-report.xml
     reports:
       junit: gitlab/dist/**/*-cst-report.xml
+# === GOLANG ===
+
+build-golang-amd64:
+  extends: .build-amd64
+  stage: build-golang
+  variables:
+    IMAGE_NAME: golang
+    PLATFORM: amd64
+  needs:
+    - generate
+  artifacts:
+    paths:
+      - gitlab/dist/golang/*/*/cyclonedx.json
+    reports:
+      cyclonedx: gitlab/dist/golang/*/*/cyclonedx.json
+
+
+manifest-golang:
+  extends: .manifest
+  stage: manifest-golang
+  variables:
+    IMAGE_NAME: golang
+  needs:
+    - generate
+    - test-golang
+    - build-golang-amd64
+
+test-golang:
+  extends: .test
+  stage: test-golang
+  variables:
+    IMAGE_NAME: golang
+  needs:
+    - generate
+    - build-golang-amd64
+  artifacts:
+    when: always
+    paths:
+      - gitlab/dist/**/*-cst-report.xml
+    reports:
+      junit: gitlab/dist/**/*-cst-report.xml
 # === NODE ===
 
 build-node-amd64:
@@ -377,6 +421,7 @@ report:
     - build-base-ci-arm64
     - build-base-deployment-amd64
     - build-base-deployment-arm64
+    - build-golang-amd64
     - build-node-amd64
     - build-dotnet-runtime-amd64
     - build-go-ci-amd64