Commit dc907cad9f
dc907cad9f1035d69eabd1cbcd8c9c68493bf128
parent: 53f2b88075
Verified · cmc ci/build: success ci/quality: success ci/test: success
cmc <hello@cleberg.net> · 2026-10-22 18:21 UTC
ci: gitbay-ci:3 with go 1.27.3
go.mod requires 1.27.3 and the image sets GOTOOLCHAIN=local, so builds
on gitbay-ci:2 (go 1.27.2) fail. gitbay-ci:3 is built on the runner host.
The runner's default image stays gitbay-ci:2.
Layout: unified · split
.gitbay/ci.yml
+6 −6
| @@ -2,7 +2,7 @@ jobs: |
| 2 | 2 | # Fast feedback: this finishes in seconds, so it is not held behind the |
| 3 | 3 | # suite. |
| 4 | 4 | build: |
| 5 | | image: localhost/gitbay-ci:2 |
| 5 | image: localhost/gitbay-ci:3 |
| 6 | 6 | steps: |
| 7 | 7 | - go build ./... |
| 8 | 8 | - go vet ./... |
| @@ -13,7 +13,7 @@ jobs: |
| 13 | 13 | # The 20m is under the runner's own 30m limit, so go times out first and |
| 14 | 14 | # says which test hung instead of the runner killing it blind. |
| 15 | 15 | test: |
| 16 | | image: localhost/gitbay-ci:2 |
| 16 | image: localhost/gitbay-ci:3 |
| 17 | 17 | steps: |
| 18 | 18 | - missing=""; for t in git git-lfs gpg; do command -v "$t" >/dev/null || missing="$missing $t"; done; test -x /usr/sbin/sshd || missing="$missing sshd"; test -z "$missing" || { echo "runner is missing:$missing"; exit 1; } |
| 19 | 19 | - go test ./... -count=1 -timeout 20m |
| @@ -24,9 +24,9 @@ jobs: |
| 24 | 24 | # printed without failing it. The CLI is pinned, and unpacked with Python |
| 25 | 25 | # because this image has no xz. |
| 26 | 26 | quality: |
| 27 | | image: localhost/gitbay-ci:2 |
| 27 | image: localhost/gitbay-ci:3 |
| 28 | 28 | steps: |
| 29 | | - curl -fsSL -o /tmp/qlty.tar.xz https://qlty-releases.s3.amazonaws.com/qlty/v0.661.0/qlty-x86_64-unknown-linux-gnu.tar.xz && python3 -c "import tarfile; tarfile.open('/tmp/qlty.tar.xz').extractall('/tmp')" |
| 29 | - curl -fsSL -o /tmp/qlty.tar.xz https://qlty-releases.s3.amazonaws.com/qlty/v0.661.0/qlty-x86_64-unknown-linux-gnu.tar.xz && python3 -c "import tarfile; tarfile.open('/tmp/qlty.tar.xz').extractall('/tmp', filter='data')" |
| 30 | 30 | - QLTY_TELEMETRY=off /tmp/qlty-x86_64-unknown-linux-gnu/qlty check --all --no-progress --filter trufflehog,gofmt |
| 31 | 31 | - QLTY_TELEMETRY=off /tmp/qlty-x86_64-unknown-linux-gnu/qlty check --all --no-progress --no-fail |
| 32 | 32 | paths-ignore: |
| @@ -45,11 +45,11 @@ jobs: |
| 45 | 45 | # `build trigger krz/gitbay vuln` runs it on demand before a release |
| 46 | 46 | # (#177). |
| 47 | 47 | vuln: |
| 48 | | image: localhost/gitbay-ci:2 |
| 48 | image: localhost/gitbay-ci:3 |
| 49 | 49 | schedule: "0 3 * * *" |
| 50 | 50 | steps: |
| 51 | 51 | - go run golang.org/x/vuln/cmd/govulncheck@latest ./... |
| 52 | 52 | # osv-scanner also reports advisories in dependencies the code does not |
| 53 | 53 | # call, which govulncheck skips. |
| 54 | | - curl -fsSL -o /tmp/qlty.tar.xz https://qlty-releases.s3.amazonaws.com/qlty/v0.661.0/qlty-x86_64-unknown-linux-gnu.tar.xz && python3 -c "import tarfile; tarfile.open('/tmp/qlty.tar.xz').extractall('/tmp')" |
| 54 | - curl -fsSL -o /tmp/qlty.tar.xz https://qlty-releases.s3.amazonaws.com/qlty/v0.661.0/qlty-x86_64-unknown-linux-gnu.tar.xz && python3 -c "import tarfile; tarfile.open('/tmp/qlty.tar.xz').extractall('/tmp', filter='data')" |
| 55 | 55 | - QLTY_TELEMETRY=off /tmp/qlty-x86_64-unknown-linux-gnu/qlty check --all --no-progress --filter osv-scanner |
.gitbay/wiki/Admin.org
+2 −2
| @@ -1090,7 +1090,7 @@ where every repository is trusted. There is no automatic fallback: a |
| 1090 | 1090 | runner started with =-isolation podman= that cannot find a working |
| 1091 | 1091 | podman exits rather than running a build unsandboxed. |
| 1092 | 1092 | |
| 1093 | | gitbay's own jobs name =localhost/gitbay-ci:2=, built from |
| 1093 | gitbay's own jobs name =localhost/gitbay-ci:3=, built from |
| 1094 | 1094 | =deploy/Containerfile.ci= on the runner host. A job's image must carry |
| 1095 | 1095 | what its steps need: the suite drives real git, git-lfs, gpg and sshd and |
| 1096 | 1096 | asserts they exist before running, so the stock runner default would fail |
| @@ -1099,7 +1099,7 @@ it immediately. Build or rebuild it with: |
| 1099 | 1099 | #+begin_src sh |
| 1100 | 1100 | ssh -p 2222 root@<host> 'cat > /tmp/Containerfile.ci' < deploy/Containerfile.ci |
| 1101 | 1101 | ssh -p 2222 root@<host> 'su - ci-runner -s /bin/sh -c \ |
| 1102 | | "podman build -t localhost/gitbay-ci:2 -f /tmp/Containerfile.ci /tmp"' |
| 1102 | "podman build -t localhost/gitbay-ci:3 -f /tmp/Containerfile.ci /tmp"' |
| 1103 | 1103 | #+end_src |
| 1104 | 1104 | |
| 1105 | 1105 | The tag is deliberate rather than =:latest=: changing the file means |
deploy/Containerfile.ci
+2 −2
| @@ -8,12 +8,12 @@ |
| 8 | 8 | # |
| 9 | 9 | # scp -P 2222 deploy/Containerfile.ci root@gitbay.org:/var/lib/gitbay-runner/gitbay-ci.Containerfile |
| 10 | 10 | # ssh -p 2222 root@gitbay.org 'chown ci-runner /var/lib/gitbay-runner/gitbay-ci.Containerfile \ |
| 11 | | # && su - ci-runner -s /bin/sh -c "podman build -t localhost/gitbay-ci:2 -f gitbay-ci.Containerfile ." \ |
| 11 | # && su - ci-runner -s /bin/sh -c "podman build -t localhost/gitbay-ci:3 -f gitbay-ci.Containerfile ." \ |
| 12 | 12 | # && rm /var/lib/gitbay-runner/gitbay-ci.Containerfile' |
| 13 | 13 | # |
| 14 | 14 | # Tagged, not :latest, so a change to this file is a deliberate bump in |
| 15 | 15 | # .gitbay/ci.yml rather than a silent change under a running branch. |
| 16 | | FROM docker.io/library/golang:1.27-trixie |
| 16 | FROM docker.io/library/golang:1.27.3-trixie |
| 17 | 17 | |
| 18 | 18 | # gitbay-runner-prune.service skips images carrying this label. A localhost/ |
| 19 | 19 | # image cannot be pulled back, so pruning it fails every job that names it. |