generated from mathias/template-go-web
mathiasandClaude Sonnet 5
62955c998d
Build & Import (run #68) failed: mathias/cad is PRIVATE (unlike mcp-chassis, the only other internal module a cad-* Dockerfile has fetched so far, which is public) — 'go mod download' inside the Docker build had no credential and died on 'terminal prompts disabled'. Fix mirrors this repo's own existing GIT_ASKPASS pattern (cd.yml's oathcandidate step, for the private swedsl dependency): a BuildKit secret mount feeds a GIT_ASKPASS helper for the one RUN that needs it. The token is never written to a persisted layer — the askpass script and its reference to /run/secrets/gitea_token are created and removed within the same RUN instruction. cd.yml writes the token to a file only for build-image.sh's subprocess and passes it via BUILD_SECRETS (the script's existing mechanism — 'the caller writes the secret to PATH itself'). Verified by running build-image.sh's actual buildctl invocation locally against the real koala buildkitd (same daemon CI uses) with a real token — 'go mod download' completes in 1.9s, full build succeeds. Reproduced the CI failure log before writing this fix, per house discipline. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
44 lines
2.1 KiB
Docker
44 lines
2.1 KiB
Docker
FROM golang:1.26-alpine AS build
|
|
WORKDIR /src
|
|
# Fetch internal git-hosted Go modules (cad-atlas now depends on
|
|
# git.d-ma.be/mathias/cad — cad-atlas#11, reusing cad#14's cad-stuck query
|
|
# logic rather than duplicating the taxonomy) without going through
|
|
# proxy.golang.org. Gitea returns http:// in its go-import meta tag, so
|
|
# rewrite to https and bypass the module proxy + sumdb (mirrors mathias/cad's
|
|
# own Dockerfile — same trick, same reason).
|
|
#
|
|
# UNLIKE mcp-chassis (public, what cad's own Dockerfile fetches this way),
|
|
# mathias/cad is a PRIVATE repo, so the plain insteadOf rewrite above is not
|
|
# enough — `go mod download` needs to authenticate. Use a GIT_ASKPASS helper
|
|
# reading a BuildKit secret mount (mirrors the GIT_ASKPASS pattern this
|
|
# repo's own cd.yml already uses for the oathcandidate module's private
|
|
# swedsl dependency): the token is never written to a persisted layer — the
|
|
# askpass script and its reference to /run/secrets/gitea_token are created
|
|
# and removed within the same RUN instruction, and the secret mount itself
|
|
# is never part of any layer diff. Caller passes it via
|
|
# `BUILD_SECRETS="id=gitea_token,src=<path>"` (build-image.sh's existing
|
|
# mechanism) — see cd.yml.
|
|
RUN apk add --no-cache git && \
|
|
git config --global url."https://git.d-ma.be/".insteadOf "http://git.d-ma.be/"
|
|
ENV GOPRIVATE=git.d-ma.be
|
|
ENV GOPROXY=direct
|
|
ENV GOSUMDB=off
|
|
RUN go install github.com/a-h/templ/cmd/templ@latest
|
|
COPY go.mod go.sum ./
|
|
RUN --mount=type=secret,id=gitea_token \
|
|
printf '#!/bin/sh\ncase "$1" in *sername*) echo oauth2 ;; *) cat /run/secrets/gitea_token ;; esac\n' > /tmp/askpass.sh && \
|
|
chmod 700 /tmp/askpass.sh && \
|
|
GIT_ASKPASS=/tmp/askpass.sh GIT_TERMINAL_PROMPT=0 go mod download && \
|
|
rm -f /tmp/askpass.sh
|
|
COPY . .
|
|
ARG VERSION=dev
|
|
RUN templ generate && CGO_ENABLED=0 go build -trimpath \
|
|
-ldflags="-s -w -X git.d-ma.be/mathias/cad-atlas/internal/version.Value=${VERSION}" \
|
|
-o /out/app ./cmd/cad-atlas
|
|
|
|
FROM gcr.io/distroless/static-debian12:nonroot
|
|
COPY --from=build /out/app /app
|
|
USER nonroot:nonroot
|
|
EXPOSE 8080
|
|
ENTRYPOINT ["/app"]
|