krz/gitbay

deploy, ci: gitbay-ci:2 carries python3-venv !361

merged merged by cmc on 2026-09-10 02:48 UTC · krz/gitbay:ci-image-2 into main

5 files changed, +18 −11

Layout: unified · split

.gitbay/ci.yml +4 −4
@@ -2,7 +2,7 @@ jobs:
22 # Fast feedback: this finishes in seconds, so it is not held behind the
33 # suite.
44 build:
5 image: localhost/gitbay-ci:1
5 image: localhost/gitbay-ci:2
66 steps:
77 - go build ./...
88 - go vet ./...
@@ -13,7 +13,7 @@ jobs:
1313 # The 20m is under the runner's own 30m limit, so go times out first and
1414 # says which test hung instead of the runner killing it blind.
1515 test:
16 image: localhost/gitbay-ci:1
16 image: localhost/gitbay-ci:2
1717 steps:
1818 - missing=""; for t in git git-lfs gpg; do command -v "$t" >/dev/null || missing="$missing $t"; done; test -x /usr/sbin/sshd || missing="$missing sshd"; test -z "$missing" || { echo "runner is missing:$missing"; exit 1; }
1919 - go test ./... -count=1 -timeout 20m
@@ -33,7 +33,7 @@ jobs:
3333 # `build trigger krz/gitbay vuln` runs it on demand before a release
3434 # (#177).
3535 vuln:
36 image: localhost/gitbay-ci:1
36 image: localhost/gitbay-ci:2
3737 schedule: "0 3 * * *"
3838 steps:
3939 - go run golang.org/x/vuln/cmd/govulncheck@latest ./...
@@ -56,7 +56,7 @@ jobs:
5656 # linux-x64 bundle carries its own JRE, which is why the host needs no
5757 # Java.
5858 sonar:
59 image: localhost/gitbay-ci:1
59 image: localhost/gitbay-ci:2
6060 schedule: "30 3 * * *"
6161 steps:
6262 - |
.gitbay/wiki/Admin.org +2 −2
@@ -458,7 +458,7 @@ where every repository is trusted. There is no automatic fallback: a
458458runner started with =-isolation podman= that cannot find a working
459459podman exits rather than running a build unsandboxed.
460460
461gitbay's own jobs name =localhost/gitbay-ci:1=, built from
461gitbay's own jobs name =localhost/gitbay-ci:2=, built from
462462=deploy/Containerfile.ci= on the runner host. A job's image must carry
463463what its steps need: the suite drives real git, git-lfs, gpg and sshd and
464464asserts they exist before running, so the stock runner default would fail
@@ -467,7 +467,7 @@ it immediately. Build or rebuild it with:
467467#+begin_src sh
468468ssh -p 2222 root@<host> 'cat > /tmp/Containerfile.ci' < deploy/Containerfile.ci
469469ssh -p 2222 root@<host> 'su - ci-runner -s /bin/sh -c \
470 "podman build -t localhost/gitbay-ci:1 -f /tmp/Containerfile.ci /tmp"'
470 "podman build -t localhost/gitbay-ci:2 -f /tmp/Containerfile.ci /tmp"'
471471#+end_src
472472
473473The tag is deliberate rather than =:latest=: changing the file means
deploy/Containerfile.ci +8 −1
@@ -5,7 +5,7 @@
55# Build it on the runner host, where podman keeps it:
66#
77# ssh -p 2222 root@bay1 'su - ci-runner -s /bin/sh -c \
8# "podman build -t localhost/gitbay-ci:1 -f - ." ' < deploy/Containerfile.ci
8# "podman build -t localhost/gitbay-ci:2 -f - ." ' < deploy/Containerfile.ci
99#
1010# Tagged, not :latest, so a change to this file is a deliberate bump in
1111# .gitbay/ci.yml rather than a silent change under a running branch.
@@ -14,6 +14,10 @@ FROM docker.io/library/golang:1.27-trixie
1414# The suite drives real git, ssh, sshd and gpg rather than mocking them,
1515# and asserts they are present before running. git-lfs has its own tests;
1616# sshd must be the binary at /usr/sbin/sshd that the tests exec.
17# python3-venv: this is also the default image for every repository the
18# bay1 runner is attached to, and a lint job that makes a venv for ruff
19# fails without ensurepip (gitbay-ci:2). sqlite3: the same reason, for
20# a job that maintains an archive database.
1721RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
1822 git-lfs \
1923 gnupg \
@@ -22,6 +26,9 @@ RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-ins
2226 ca-certificates \
2327 curl \
2428 unzip \
29 python3 \
30 python3-venv \
31 sqlite3 \
2532 && rm -rf /var/lib/apt/lists/*
2633
2734# A build runs as this image's root inside its own user namespace, mapped
deploy/gitbay-runner.override.conf +1 −1
@@ -75,7 +75,7 @@ KillMode=mixed
7575# -untrusted: this runner isolates in podman, so it takes merge request
7676# heads from forks; a runner without a container must not.
7777ExecStart=
78ExecStart=/usr/local/bin/gitbay-runner -remote git@127.0.0.1 -workdir /var/lib/gitbay-runner/work -poll 5s -timeout 45m -isolation podman -image localhost/gitbay-ci:1 -cpus 3 -memory 6g -untrusted
78ExecStart=/usr/local/bin/gitbay-runner -remote git@127.0.0.1 -workdir /var/lib/gitbay-runner/work -poll 5s -timeout 45m -isolation podman -image localhost/gitbay-ci:2 -cpus 3 -memory 6g -untrusted
7979Nice=10
8080CPUWeight=30
8181IOWeight=30
e2e/isolation_podman_test.go +3 −3
@@ -17,13 +17,13 @@ import (
1717// same rule builds follow.
1818func provisionedImage(t *testing.T) string {
1919 t.Helper()
20 for _, img := range []string{"localhost/gitbay-ci:1", "docker.io/library/debian:stable-slim", "docker.io/library/alpine:latest"} {
20 for _, img := range []string{"localhost/gitbay-ci:2", "docker.io/library/debian:stable-slim", "docker.io/library/alpine:latest"} {
2121 if err := exec.Command("podman", "image", "exists", img).Run(); err == nil {
2222 return img
2323 }
2424 }
2525 t.Log("SKIPPING ISOLATION TEST: podman has no image this test can use. " +
26 "Provision one (podman build -t localhost/gitbay-ci:1 -f deploy/Containerfile.ci). " +
26 "Provision one (podman build -t localhost/gitbay-ci:2 -f deploy/Containerfile.ci). " +
2727 "The container path is NOT covered by this run.")
2828 return ""
2929}
@@ -179,7 +179,7 @@ func runnerPodmanOnce(t *testing.T, inst *instance, key string) {
179179 "-remote", "git@127.0.0.1",
180180 "-ssh-opts", opts,
181181 "-isolation", "podman",
182 "-image", "localhost/gitbay-ci:1",
182 "-image", "localhost/gitbay-ci:2",
183183 "-clone-base", fmt.Sprintf("ssh://git@127.0.0.1:%d", inst.port),
184184 "-workdir", t.TempDir())
185185 cmd.Env = append(os.Environ(), "XDG_CONFIG_HOME="+t.TempDir(), "GIT_CONFIG_NOSYSTEM=1", "GIT_CONFIG_GLOBAL=/dev/null")