mathias/cad-atlas
Archived
1
0
Fork 0
generated from mathias/template-go-web
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): authenticate go mod download against the private cad module
CD / Deploy via GitOps (push) Successful in 1s
Details
CD / Detect unsubstituted template (push) Successful in 1s
Details
CD / Lint / Test / Vet (push) Successful in 6s
Details
CD / var-go/oath (push) Skipped
Details
CD / Build & Import (push) Successful in 7s
Details

Browse Source 
Build & Import (run #68) failed: mathias/cad is PRIVATE (unlike
mcp-chassis, the only other internal module a cad-* Dockerfile has fetched
so far, which is public) — 'go mod download' inside the Docker build had
no credential and died on 'terminal prompts disabled'.

Fix mirrors this repo's own existing GIT_ASKPASS pattern (cd.yml's
oathcandidate step, for the private swedsl dependency): a BuildKit secret
mount feeds a GIT_ASKPASS helper for the one RUN that needs it. The token
is never written to a persisted layer — the askpass script and its
reference to /run/secrets/gitea_token are created and removed within the
same RUN instruction. cd.yml writes the token to a file only for
build-image.sh's subprocess and passes it via BUILD_SECRETS (the script's
existing mechanism — 'the caller writes the secret to PATH itself').

Verified by running build-image.sh's actual buildctl invocation locally
against the real koala buildkitd (same daemon CI uses) with a real token —
'go mod download' completes in 1.9s, full build succeeds. Reproduced the
CI failure log before writing this fix, per house discipline.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
mathias
2026-08-28 13:31:59 +02:00
co-authored by Claude Sonnet 5
parent 97d0f56383
commit 62955c998d
2 changed files with 36 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+17 -1
View File
@@ -6,6 +6,18 @@ WORKDIR /src
# proxy.golang.org. Gitea returns http:// in its go-import meta tag, so
# rewrite to https and bypass the module proxy + sumdb (mirrors mathias/cad's
# own Dockerfile — same trick, same reason).
#
# UNLIKE mcp-chassis (public, what cad's own Dockerfile fetches this way),
# mathias/cad is a PRIVATE repo, so the plain insteadOf rewrite above is not
# enough — `go mod download` needs to authenticate. Use a GIT_ASKPASS helper
# reading a BuildKit secret mount (mirrors the GIT_ASKPASS pattern this
# repo's own cd.yml already uses for the oathcandidate module's private
# swedsl dependency): the token is never written to a persisted layer — the
# askpass script and its reference to /run/secrets/gitea_token are created
# and removed within the same RUN instruction, and the secret mount itself
# is never part of any layer diff. Caller passes it via
# `BUILD_SECRETS="id=gitea_token,src=<path>"` (build-image.sh's existing
# mechanism) — see cd.yml.
RUN apk add --no-cache git && \
git config --global url."https://git.d-ma.be/".insteadOf "http://git.d-ma.be/"
ENV GOPRIVATE=git.d-ma.be
@@ -13,7 +25,11 @@ ENV GOPROXY=direct
ENV GOSUMDB=off
RUN go install github.com/a-h/templ/cmd/templ@latest
COPY go.mod go.sum ./
RUN go mod download
RUN --mount=type=secret,id=gitea_token \
printf '#!/bin/sh\ncase "$1" in *sername*) echo oauth2 ;; *) cat /run/secrets/gitea_token ;; esac\n' > /tmp/askpass.sh && \
chmod 700 /tmp/askpass.sh && \
GIT_ASKPASS=/tmp/askpass.sh GIT_TERMINAL_PROMPT=0 go mod download && \
rm -f /tmp/askpass.sh
COPY . .
ARG VERSION=dev
RUN templ generate && CGO_ENABLED=0 go build -trimpath \