From f8a0300854f36ec6ea98af01008b313dd920cf07 Mon Sep 17 00:00:00 2001 From: Chai Bot Date: Fri, 21 Aug 2026 13:32:48 +0000 Subject: [PATCH] build: enable hermetic builds with Yarn and Go prefetch --- .tekton/faas-console-plugin-pull-request.yaml | 4 ++++ .tekton/faas-console-plugin-push.yaml | 4 ++++ .yarnrc.yml | 4 ++++ Dockerfile | 12 ++++++------ 4 files changed, 18 insertions(+), 6 deletions(-) diff --git a/.tekton/faas-console-plugin-pull-request.yaml b/.tekton/faas-console-plugin-pull-request.yaml index c6348e74..4b056f5d 100644 --- a/.tekton/faas-console-plugin-pull-request.yaml +++ b/.tekton/faas-console-plugin-pull-request.yaml @@ -34,6 +34,10 @@ spec: - linux/ppc64le - name: dockerfile value: Dockerfile + - name: hermetic + value: "true" + - name: prefetch-input + value: '[{"type": "yarn", "path": "."}, {"type": "gomod", "path": "backend"}]' pipelineSpec: description: | This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization. diff --git a/.tekton/faas-console-plugin-push.yaml b/.tekton/faas-console-plugin-push.yaml index 05ed0aa6..a463eed4 100644 --- a/.tekton/faas-console-plugin-push.yaml +++ b/.tekton/faas-console-plugin-push.yaml @@ -31,6 +31,10 @@ spec: - linux/ppc64le - name: dockerfile value: Dockerfile + - name: hermetic + value: "true" + - name: prefetch-input + value: '[{"type": "yarn", "path": "."}, {"type": "gomod", "path": "backend"}]' pipelineSpec: description: | This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization. diff --git a/.yarnrc.yml b/.yarnrc.yml index e2cc6b29..8f968d42 100644 --- a/.yarnrc.yml +++ b/.yarnrc.yml @@ -1,3 +1,7 @@ nodeLinker: node-modules +supportedArchitectures: + os: ["linux"] + cpu: ["x64", "arm64", "s390x", "ppc64"] + yarnPath: .yarn/releases/yarn-4.18.0.cjs diff --git a/Dockerfile b/Dockerfile index 5d6f27fb..a1f03ba9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,20 +1,18 @@ FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/nodejs-24:latest@sha256:89f5b13beb2b4b0e97e55434eb56a18a5939d373ef466445f46f98f85f107b57 AS nodebuilder USER root -ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0 -RUN npm i -g corepack && corepack enable WORKDIR /usr/src/app COPY package.json yarn.lock .yarnrc.yml ./ COPY .yarn/ .yarn/ -RUN yarn install --immutable +RUN if [ -f /cachi2/cachi2.env ]; then . /cachi2/cachi2.env; fi && CYPRESS_INSTALL_BINARY=0 node ./.yarn/releases/yarn-4.18.0.cjs install --immutable COPY console-extensions.json tsconfig.json webpack.config.mts ./ COPY src/ src/ COPY locales/ locales/ COPY config/ config/ COPY testing/ testing/ -RUN yarn build +RUN if [ -f /cachi2/cachi2.env ]; then . /cachi2/cachi2.env; fi && node ./.yarn/releases/yarn-4.18.0.cjs build FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:1.26.5-1786971605@sha256:1a9bbbfa854931a97dbff276bd69dc0e32b36cb2fbce3b9813b2cf9892aa8d43 AS gobuilder ARG TARGETOS TARGETARCH @@ -22,11 +20,13 @@ ENV GOOS=$TARGETOS GOARCH=$TARGETARCH WORKDIR /opt/app-root/src COPY --chown=1001:0 backend/go.mod backend/go.sum backend/ -RUN go -C backend mod download +RUN if [ -f /cachi2/cachi2.env ]; then . /cachi2/cachi2.env; fi && \ + go -C backend mod download COPY --chown=1001:0 --from=nodebuilder /usr/src/app/dist backend/static COPY --chown=1001:0 backend/ backend/ -RUN mkdir -p bin && CGO_ENABLED=0 go -C backend build -ldflags="-s -w" -o ../bin/plugin-backend . +RUN if [ -f /cachi2/cachi2.env ]; then . /cachi2/cachi2.env; fi && \ + mkdir -p bin && CGO_ENABLED=0 go -C backend build -ldflags="-s -w" -o ../bin/plugin-backend . FROM registry.access.redhat.com/ubi9-micro:latest@sha256:7e7f79ab747bf2b452e3043dd89f388e92be4c7fdcc8b815b58adf6c99c39c95 COPY --from=gobuilder /opt/app-root/src/bin/plugin-backend /usr/bin/plugin-backend