krz/gitbay

A CLI-first git forge. cli forge git self-hosted https://gitbay.org

Commit dc907cad9f

dc907cad9f1035d69eabd1cbcd8c9c68493bf128

parent: 53f2b88075

Verified · cmc ci/build: success ci/quality: success ci/test: success

cmc <hello@cleberg.net> · 2026-10-22 18:21 UTC 

ci: gitbay-ci:3 with go 1.27.3

go.mod requires 1.27.3 and the image sets GOTOOLCHAIN=local, so builds
on gitbay-ci:2 (go 1.27.2) fail. gitbay-ci:3 is built on the runner host.
The runner's default image stays gitbay-ci:2.

Layout: unified · split

.gitbay/ci.yml +6 −6
@@ -2,7 +2,7 @@ jobs:
2 # Fast feedback: this finishes in seconds, so it is not held behind the 2 # Fast feedback: this finishes in seconds, so it is not held behind the
3 # suite. 3 # suite.
4 build: 4 build:
5 image: localhost/gitbay-ci:2 5 image: localhost/gitbay-ci:3
6 steps: 6 steps:
7 - go build ./... 7 - go build ./...
8 - go vet ./... 8 - go vet ./...
@@ -13,7 +13,7 @@ jobs:
13 # The 20m is under the runner's own 30m limit, so go times out first and 13 # The 20m is under the runner's own 30m limit, so go times out first and
14 # says which test hung instead of the runner killing it blind. 14 # says which test hung instead of the runner killing it blind.
15 test: 15 test:
16 image: localhost/gitbay-ci:2 16 image: localhost/gitbay-ci:3
17 steps: 17 steps:
18 - missing=""; for t in git git-lfs gpg; do command -v "$t" >/dev/null || missing="$missing $t"; done; test -x /usr/sbin/sshd || missing="$missing sshd"; test -z "$missing" || { echo "runner is missing:$missing"; exit 1; } 18 - missing=""; for t in git git-lfs gpg; do command -v "$t" >/dev/null || missing="$missing $t"; done; test -x /usr/sbin/sshd || missing="$missing sshd"; test -z "$missing" || { echo "runner is missing:$missing"; exit 1; }
19 - go test ./... -count=1 -timeout 20m 19 - go test ./... -count=1 -timeout 20m
@@ -24,9 +24,9 @@ jobs:
24 # printed without failing it. The CLI is pinned, and unpacked with Python 24 # printed without failing it. The CLI is pinned, and unpacked with Python
25 # because this image has no xz. 25 # because this image has no xz.
26 quality: 26 quality:
27 image: localhost/gitbay-ci:2 27 image: localhost/gitbay-ci:3
28 steps: 28 steps:
29 - curl -fsSL -o /tmp/qlty.tar.xz https://qlty-releases.s3.amazonaws.com/qlty/v0.661.0/qlty-x86_64-unknown-linux-gnu.tar.xz && python3 -c "import tarfile; tarfile.open('/tmp/qlty.tar.xz').extractall('/tmp')" 29 - curl -fsSL -o /tmp/qlty.tar.xz https://qlty-releases.s3.amazonaws.com/qlty/v0.661.0/qlty-x86_64-unknown-linux-gnu.tar.xz && python3 -c "import tarfile; tarfile.open('/tmp/qlty.tar.xz').extractall('/tmp', filter='data')"
30 - QLTY_TELEMETRY=off /tmp/qlty-x86_64-unknown-linux-gnu/qlty check --all --no-progress --filter trufflehog,gofmt 30 - QLTY_TELEMETRY=off /tmp/qlty-x86_64-unknown-linux-gnu/qlty check --all --no-progress --filter trufflehog,gofmt
31 - QLTY_TELEMETRY=off /tmp/qlty-x86_64-unknown-linux-gnu/qlty check --all --no-progress --no-fail 31 - QLTY_TELEMETRY=off /tmp/qlty-x86_64-unknown-linux-gnu/qlty check --all --no-progress --no-fail
32 paths-ignore: 32 paths-ignore:
@@ -45,11 +45,11 @@ jobs:
45 # `build trigger krz/gitbay vuln` runs it on demand before a release 45 # `build trigger krz/gitbay vuln` runs it on demand before a release
46 # (#177). 46 # (#177).
47 vuln: 47 vuln:
48 image: localhost/gitbay-ci:2 48 image: localhost/gitbay-ci:3
49 schedule: "0 3 * * *" 49 schedule: "0 3 * * *"
50 steps: 50 steps:
51 - go run golang.org/x/vuln/cmd/govulncheck@latest ./... 51 - go run golang.org/x/vuln/cmd/govulncheck@latest ./...
52 # osv-scanner also reports advisories in dependencies the code does not 52 # osv-scanner also reports advisories in dependencies the code does not
53 # call, which govulncheck skips. 53 # call, which govulncheck skips.
54 - curl -fsSL -o /tmp/qlty.tar.xz https://qlty-releases.s3.amazonaws.com/qlty/v0.661.0/qlty-x86_64-unknown-linux-gnu.tar.xz && python3 -c "import tarfile; tarfile.open('/tmp/qlty.tar.xz').extractall('/tmp')" 54 - curl -fsSL -o /tmp/qlty.tar.xz https://qlty-releases.s3.amazonaws.com/qlty/v0.661.0/qlty-x86_64-unknown-linux-gnu.tar.xz && python3 -c "import tarfile; tarfile.open('/tmp/qlty.tar.xz').extractall('/tmp', filter='data')"
55 - QLTY_TELEMETRY=off /tmp/qlty-x86_64-unknown-linux-gnu/qlty check --all --no-progress --filter osv-scanner 55 - QLTY_TELEMETRY=off /tmp/qlty-x86_64-unknown-linux-gnu/qlty check --all --no-progress --filter osv-scanner
.gitbay/wiki/Admin.org +2 −2
@@ -1090,7 +1090,7 @@ where every repository is trusted. There is no automatic fallback: a
1090runner started with =-isolation podman= that cannot find a working 1090runner started with =-isolation podman= that cannot find a working
1091podman exits rather than running a build unsandboxed. 1091podman exits rather than running a build unsandboxed.
1092 1092
1093gitbay's own jobs name =localhost/gitbay-ci:2=, built from 1093gitbay's own jobs name =localhost/gitbay-ci:3=, built from
1094=deploy/Containerfile.ci= on the runner host. A job's image must carry 1094=deploy/Containerfile.ci= on the runner host. A job's image must carry
1095what its steps need: the suite drives real git, git-lfs, gpg and sshd and 1095what its steps need: the suite drives real git, git-lfs, gpg and sshd and
1096asserts they exist before running, so the stock runner default would fail 1096asserts they exist before running, so the stock runner default would fail
@@ -1099,7 +1099,7 @@ it immediately. Build or rebuild it with:
1099#+begin_src sh 1099#+begin_src sh
1100ssh -p 2222 root@<host> 'cat > /tmp/Containerfile.ci' < deploy/Containerfile.ci 1100ssh -p 2222 root@<host> 'cat > /tmp/Containerfile.ci' < deploy/Containerfile.ci
1101ssh -p 2222 root@<host> 'su - ci-runner -s /bin/sh -c \ 1101ssh -p 2222 root@<host> 'su - ci-runner -s /bin/sh -c \
1102 "podman build -t localhost/gitbay-ci:2 -f /tmp/Containerfile.ci /tmp"' 1102 "podman build -t localhost/gitbay-ci:3 -f /tmp/Containerfile.ci /tmp"'
1103#+end_src 1103#+end_src
1104 1104
1105The tag is deliberate rather than =:latest=: changing the file means 1105The tag is deliberate rather than =:latest=: changing the file means
deploy/Containerfile.ci +2 −2
@@ -8,12 +8,12 @@
8# 8#
9# scp -P 2222 deploy/Containerfile.ci root@gitbay.org:/var/lib/gitbay-runner/gitbay-ci.Containerfile 9# scp -P 2222 deploy/Containerfile.ci root@gitbay.org:/var/lib/gitbay-runner/gitbay-ci.Containerfile
10# ssh -p 2222 root@gitbay.org 'chown ci-runner /var/lib/gitbay-runner/gitbay-ci.Containerfile \ 10# ssh -p 2222 root@gitbay.org 'chown ci-runner /var/lib/gitbay-runner/gitbay-ci.Containerfile \
11# && su - ci-runner -s /bin/sh -c "podman build -t localhost/gitbay-ci:2 -f gitbay-ci.Containerfile ." \ 11# && su - ci-runner -s /bin/sh -c "podman build -t localhost/gitbay-ci:3 -f gitbay-ci.Containerfile ." \
12# && rm /var/lib/gitbay-runner/gitbay-ci.Containerfile' 12# && rm /var/lib/gitbay-runner/gitbay-ci.Containerfile'
13# 13#
14# Tagged, not :latest, so a change to this file is a deliberate bump in 14# Tagged, not :latest, so a change to this file is a deliberate bump in
15# .gitbay/ci.yml rather than a silent change under a running branch. 15# .gitbay/ci.yml rather than a silent change under a running branch.
16FROM docker.io/library/golang:1.27-trixie 16FROM docker.io/library/golang:1.27.3-trixie
17 17
18# gitbay-runner-prune.service skips images carrying this label. A localhost/ 18# gitbay-runner-prune.service skips images carrying this label. A localhost/
19# image cannot be pulled back, so pruning it fails every job that names it. 19# image cannot be pulled back, so pruning it fails every job that names it.