Add new Containerfile.tools to be used by openshift.release #15
Conversation
Description: - this new Containerfile.tests will be used by the CI/CD system to run all the needed unit tests - it will be used as a build_root so that we are able to use the latest golang since there is no OCP builder image for go 1.21 yet
irinamihai
force-pushed
the
add_tests_containerfile
branch
from
adb782a to
d2b1607
Compare
Containerfile.tests
Outdated
| # the License. | ||
| # | ||
|
|
||
| FROM docker.io/golang:1.21 AS builder |
There was a problem hiding this comment.
Can we use RHEL as the base image, like we do in Containerfile?
There was a problem hiding this comment.
We can, for sure. I wanted to get away from having to install the Go 1.21 compiler and I saw that other operators in openshift-kni are also using this image. The preferred one would be the Go 1.21 version of registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.20-openshift-4.15, but there isn't one yet.
Containerfile.tests
Outdated
|
|
||
| # Install golangci-lint. | ||
| RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.55.2 && \ | ||
| golangci-lint --version |
There was a problem hiding this comment.
This way to install golangci-lint is a bit scary: it runs a shell script downloaded from GitHub that we don't really know what will do. Can we instead download the release artifact, verify that it hasn't changed since we checked the content and install it? For example:
RUN \
curl -Lo tarball https://github.com/golangci/golangci-lint/releases/download/v1.55.2/golangci-lint-1.55.2-linux-amd64.tar.gz && \
echo ca21c961a33be3bc15e4292dc40c98c8dcc5463a7b6768a3afc123761630c09c tarball | sha256sum -c && \
tar -C /usr/local/bin --strip-components=1 -xf tarball golangci-lint-1.55.2-linux-amd64/golangci-lint && \
rm tarball
The point there is that you are supposed to manually download the file, check that it is correct and then recalculate the sha256sum yourself. That way, if the file were to change (intentionally or by accident) the build will fail.
There was a problem hiding this comment.
Still marked as draft, but looks good to me anyhow. Thanks @irinamihai !
irinamihai
force-pushed
the
add_tests_containerfile
branch
from
94096f4 to
6e6260c
Compare
irinamihai
force-pushed
the
add_tests_containerfile
branch
from
6e6260c to
508bb6e
Compare
@jhernand, thanks for taking a look. I wanted to have the openshift/release part in a more stable format before merging this. |
No problem, whatever you prefer. |
irinamihai
changed the title
Description: