Skip to content

SRVOCF-1049: Enable hermetic builds with Yarn and Go prefetch #150

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
maschmid wants to merge 1 commit into
base: master
Choose a base branch
from
+18 −6
Open

SRVOCF-1049: Enable hermetic builds with Yarn and Go prefetch #150

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .tekton/faas-console-plugin-pull-request.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,10 @@ spec:
- linux/ppc64le
- name: dockerfile
value: Dockerfile
- name: hermetic
value: "true"
- name: prefetch-input
value: '[{"type": "yarn", "path": "."}, {"type": "gomod", "path": "backend"}]'
pipelineSpec:
description: |
This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization.
Expand Down
4 changes: 4 additions & 0 deletions .tekton/faas-console-plugin-push.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,10 @@ spec:
- linux/ppc64le
- name: dockerfile
value: Dockerfile
- name: hermetic
value: "true"
- name: prefetch-input
value: '[{"type": "yarn", "path": "."}, {"type": "gomod", "path": "backend"}]'
pipelineSpec:
description: |
This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization.
Expand Down
4 changes: 4 additions & 0 deletions .yarnrc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
nodeLinker: node-modules

supportedArchitectures:
os: ["linux"]
cpu: ["x64", "arm64", "s390x", "ppc64"]

yarnPath: .yarn/releases/yarn-4.18.0.cjs
12 changes: 6 additions & 6 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,32 +1,32 @@
FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/nodejs-24:latest@sha256:89f5b13beb2b4b0e97e55434eb56a18a5939d373ef466445f46f98f85f107b57 AS nodebuilder
USER root
ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
RUN npm i -g corepack && corepack enable

@twoGiants twoGiants Aug 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are you sure this can be removed?

@matejvasek matejvasek Aug 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure but Claude claims we never really needed this, and other plugins do not do this either.

@matejvasek matejvasek Aug 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It originates from the plugin template.

@maschmid maschmid Aug 24, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In a hermetic build in Konflux, we cannot access the internet, so if we do need corepack, we'd probably need to generate a cache and put it in the git repo (the konflux prefetch only supports npm, pnpm and yarn, so anything else we'd probably need to just put in the git repo)


WORKDIR /usr/src/app

COPY package.json yarn.lock .yarnrc.yml ./
COPY .yarn/ .yarn/
RUN yarn install --immutable
RUN if [ -f /cachi2/cachi2.env ]; then . /cachi2/cachi2.env; fi && CYPRESS_INSTALL_BINARY=0 node ./.yarn/releases/yarn-4.18.0.cjs install --immutable

COPY console-extensions.json tsconfig.json webpack.config.mts ./
COPY src/ src/
COPY locales/ locales/
COPY config/ config/
COPY testing/ testing/
RUN yarn build
RUN if [ -f /cachi2/cachi2.env ]; then . /cachi2/cachi2.env; fi && node ./.yarn/releases/yarn-4.18.0.cjs build

FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:1.26.5-1786971605@sha256:1a9bbbfa854931a97dbff276bd69dc0e32b36cb2fbce3b9813b2cf9892aa8d43 AS gobuilder
ARG TARGETOS TARGETARCH
ENV GOOS=$TARGETOS GOARCH=$TARGETARCH
WORKDIR /opt/app-root/src

COPY --chown=1001:0 backend/go.mod backend/go.sum backend/
RUN go -C backend mod download
Comment thread
maschmid marked this conversation as resolved.
RUN if [ -f /cachi2/cachi2.env ]; then . /cachi2/cachi2.env; fi && \
go -C backend mod download

COPY --chown=1001:0 --from=nodebuilder /usr/src/app/dist backend/static
COPY --chown=1001:0 backend/ backend/
RUN mkdir -p bin && CGO_ENABLED=0 go -C backend build -ldflags="-s -w" -o ../bin/plugin-backend .
RUN if [ -f /cachi2/cachi2.env ]; then . /cachi2/cachi2.env; fi && \
mkdir -p bin && CGO_ENABLED=0 go -C backend build -ldflags="-s -w" -o ../bin/plugin-backend .

FROM registry.access.redhat.com/ubi9-micro:latest@sha256:7e7f79ab747bf2b452e3043dd89f388e92be4c7fdcc8b815b58adf6c99c39c95
COPY --from=gobuilder /opt/app-root/src/bin/plugin-backend /usr/bin/plugin-backend
Expand Down