From 5427ccbad2b292409bd4a9f54534e19f3192f332 Mon Sep 17 00:00:00 2001 From: agent Date: Thu, 20 Aug 2026 15:53:23 +0200 Subject: [PATCH] fix: restore gcc, musl-dev, python3 and py3-yaml to the image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit REGRESSION, mine. The committed Dockerfile had drifted from the image actually in service: the running ci3 image contained these four packages, the Dockerfile did not, and I rebuilt ci4 from the Dockerfile. The rollout therefore removed tools zegit's CI depends on. Proof the deployed ci3 had them: its Gitea runs got PAST `make credentials-check` — which shells out to python3 — and failed later at cover-check. The ci4 run fails earlier, at `credentials-coverage: need python3`. What each is for, so the next rebuild does not drop them again: python3, py3-yaml the repo's own gates are Python — credentials-coverage.sh, validate-admission.sh and feature-lint.sh all shell out to it, and credentials-coverage parses manifests with yaml gcc, musl-dev cgo, which `go test -race` in the Makefile test target requires: a C compiler plus libc headers (musl on Alpine) Verified on the real base image rather than assumed — on code.forgejo.org/forgejo/runner:12.11.1, `apk add git git-daemon gcc musl-dev python3 py3-yaml` yields Python 3.12.14, a working `import yaml`, gcc 15.2.0, and git-http-backend on the git exec path. The deeper lesson is that a hand-built image can drift from its Dockerfile silently, and nothing notices until someone rebuilds. Publishing via CI (#2) is what stops that recurring, since every future image comes from the committed file. --- Dockerfile | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 1579b2d..d5cc9ef 100644 --- a/Dockerfile +++ b/Dockerfile @@ -33,6 +33,12 @@ USER root # curl,tar -> setup-go / gitleaks download + extract their own arch-specific binaries # make -> zegit Makefile targets # ca-certificates -> trusted roots for HTTPS to gitea/github/goproxy +# gcc,musl-dev -> C toolchain for cgo; `go test -race` (the Makefile test +# target) requires cgo, which needs a C compiler + libc headers +# (musl on Alpine) +# python3,py3-yaml -> the repo's own gates are Python: credentials-coverage.sh, +# validate-admission.sh and feature-lint.sh all shell out to +# python3, and credentials-coverage parses manifests with yaml # # Go is intentionally NOT baked in: actions/setup-go fetches the pinned version # per-run (node + tar are present), so the image needs no rebuild on Go bumps. @@ -45,7 +51,11 @@ RUN apk add --no-cache \ curl \ tar \ make \ - ca-certificates + ca-certificates \ + gcc \ + musl-dev \ + python3 \ + py3-yaml # Match the runner pod's runAsUser (1000); keep the image non-root by default. USER 1000 -- 2.54.0