kiln/internal/test/Dockerfile at 2e8ab04f872416190e28993a8664bf772972eeb6 · pivotal-cf/kiln · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
# Base images: host must match DockerVirtualRegistryHost in internal/test/container.go (AuthConfigs).
FROM tas-rel-eng-docker-virtual.usw1.packages.broadcom.com/golang AS go-image
FROM tas-rel-eng-docker-virtual.usw1.packages.broadcom.com/pivotalcfreleng/kiln:v0.110.0-rc2 AS kiln

FROM tas-rel-eng-docker-virtual.usw1.packages.broadcom.com/ruby:3.4.8 AS builder
RUN mkdir -p -m 0700 ~/.ssh && ssh-keyscan github.com >> ~/.ssh/known_hosts

FROM tas-rel-eng-docker-virtual.usw1.packages.broadcom.com/ruby:3.4.8

# ── Stable tools — no credentials; these layers cache across credential rotation ──

# Go runtime
COPY --from=go-image /usr/local/go/ /usr/local/go/
ENV GOROOT=/usr/local/go/
ENV PATH="$GOROOT/bin:/root/go/bin:$PATH"

# Kiln binary (used by ops-manifest during manifest tests)
COPY --from=kiln /kiln /usr/local/bin/kiln

# System packages (consolidated to one layer; before credentials so they stay cached)
RUN apt-get update \
 && apt-get install --no-install-recommends -y jq nodejs npm \
 && rm -rf /var/lib/apt/lists/*

# Go toolchain settings — must appear before any `go install`
# CGO_ENABLED=0: pure-Go build avoids gcc issues on arm64 (e.g. Podman on Apple Silicon).
ENV GOTOOLCHAIN=local
ENV CGO_ENABLED=0

# ── Ginkgo — credentials scoped to this RUN only so layers above stay cached ──
# Pinned to v1.16.5 for reproducibility (last stable v1; tiles using ginkgo v2 use their own binary).

ARG ARTIFACTORY_USERNAME
ARG ARTIFACTORY_PASSWORD

RUN GOPROXY=https://${ARTIFACTORY_USERNAME}:${ARTIFACTORY_PASSWORD}@usw1.packages.broadcom.com/artifactory/api/go/tas-rel-eng-go-virtual \
    GOSUMDB=off \
    go install github.com/onsi/ginkgo/ginkgo@v1.16.5

# ── ops-manifest gem — credentials exported for gem source registration at build time ──

ENV ARTIFACTORY_USERNAME=${ARTIFACTORY_USERNAME}
ENV ARTIFACTORY_PASSWORD=${ARTIFACTORY_PASSWORD}

RUN gem source -a https://${ARTIFACTORY_USERNAME}:${ARTIFACTORY_PASSWORD}@usw1.packages.broadcom.com/artifactory/api/gems/tas-rel-eng-gem-dev-local/
RUN gem install --verbose ops-manifest -v 0.0.4.pre

RUN which ops-manifest

RUN printf '%s\n%s\n' \
    'registry=https://${ARTIFACTORY_USERNAME}:${ARTIFACTORY_PASSWORD}@usw1.packages.broadcom.com/artifactory/api/npm/tis-npm-virtual/' \
    'always-auth=true' > /root/.npmrc