Skip to content

Add skupper-source OCI image for downstream build contexts #2560

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AryanP123 wants to merge 5 commits into
base: main
Choose a base branch
from
+57 −0
Open

Add skupper-source OCI image for downstream build contexts #2560

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8756cee
Add skupper-source OCI image for downstream build contexts
AryanP123 Aug 14, 2026
a64f312
Exclude .git from source image and publish on release tags
AryanP123 Aug 14, 2026
1c89803
Only run docker-push-source in release CI
AryanP123 Aug 14, 2026
235fabf
Vendor Go modules in skupper-source image
AryanP123 Sep 2, 2026
4c69b99
Fix COPY destination in Dockerfile.source
AryanP123 Sep 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions .circleci/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,6 +173,13 @@ workflows:
- publish-oci-images
context:
- skupper-org
- publish-source-image:
<<: *run_for_numeric_tags
image_tag: << pipeline.git.tag >>
requires:
- publish-oci-images
context:
- skupper-org
build:
jobs:
- build-all:
Expand Down Expand Up @@ -376,6 +383,19 @@ jobs:
command: docker login quay.io -u ${QUAY_LOGIN} -p ${QUAY_PASSWORD}
- run: make docker-build-must-gather IMAGE_TAG="<< parameters.image_tag >>"
- run: make docker-push-must-gather IMAGE_TAG="<< parameters.image_tag >>"
publish-source-image:
executor:
name: go_cimg
parameters:
image_tag:
type: string
steps:
- checkout
- setup_remote_docker
- run:
name: Docker login
command: docker login quay.io -u ${QUAY_LOGIN} -p ${QUAY_PASSWORD}
Comment on lines +395 to +397

@coderabbitai coderabbitai Bot Aug 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu
sed -n '370,410p' .circleci/config.yml
printf '\nDocker login references:\n'
rg -n -C 3 'docker login|QUAY_(LOGIN|PASSWORD)|docker-push-source' .circleci/config.yml Makefile 2>/dev/null || true
printf '\nShell expansion probe:\n'
bash -c 'set -- docker login quay.io -u ${QUAY_LOGIN} -p ${QUAY_PASSWORD}; printf "%s\n" "$@"' \
  2>/dev/null || true

Repository: skupperproject/skupper

Length of output: 4284

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' 'Argument expansion with whitespace:'
QUAY_LOGIN='build user' QUAY_PASSWORD='secret with spaces' bash -c '
  set -- docker login quay.io -u ${QUAY_LOGIN} -p ${QUAY_PASSWORD}
  printf "argc=%s\n" "$#"
  i=1
  for arg in "$@"; do printf "arg%s=%q\n" "$i" "$arg"; i=$((i+1)); done
'
printf '\nRelevant job context and all matching commands:\n'
sed -n '160,190p' .circleci/config.yml
sed -n '370,405p' .circleci/config.yml
sed -n '415,455p' .circleci/config.yml
sed -n '495,520p' .circleci/config.yml
printf '\nMatching line numbers:\n'
rg -n 'docker login|helm registry login|skopeo login' .circleci/config.yml

Repository: skupperproject/skupper

Length of output: 4903

Use --password-stdin for registry authentication.

Line 397 exposes ${QUAY_PASSWORD} as a command-line argument and splits secrets containing whitespace. Apply the same change to the other registry login commands in .circleci/config.yml.

- run: make docker-push-source IMAGE_TAG="<< parameters.image_tag >>"
generate-operator-bundle:
executor:
name: go_cimg
Expand Down
2 changes: 2 additions & 0 deletions .dockerignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@
.circleci
.github
.codespellrc
.git/
vendor/

# Documentation
README.md
Expand Down
21 changes: 21 additions & 0 deletions Dockerfile.source
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
# OCI image that packages the Skupper source tree for reproducible downstream builds.
# Not intended to be run; publish to quay.io/skupper/skupper-source:<version> and
# consume via build context / additional build contexts instead of git clone.
ARG GO_IMAGE_BASE_TAG=1.25
FROM golang:${GO_IMAGE_BASE_TAG} AS vendor

WORKDIR /go/src/app
COPY go.mod go.sum ./
RUN --mount=type=cache,target=/go/pkg/mod \
go mod download
COPY . .
RUN go mod vendor

FROM scratch

LABEL \
org.opencontainers.image.title="Skupper source" \
org.opencontainers.image.description="Skupper source tree at a fixed release for downstream container builds"

# Match upstream Dockerfile.* builder layout (WORKDIR /go/src/app).
COPY --from=vendor /go/src/app /go/src/app
14 changes: 14 additions & 0 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ GOARCH ?= amd64

REGISTRY := quay.io/skupper
IMAGE_TAG := v2-dev
SOURCE_IMAGE := skupper-source
ROUTER_IMAGE_TAG := main
PLATFORMS ?= linux/amd64,linux/arm64
CONTAINERFILES := Dockerfile.cli Dockerfile.kube-adaptor Dockerfile.controller Dockerfile.network-observer Dockerfile.system-controller
Expand Down Expand Up @@ -120,6 +121,19 @@ podman-build-must-gather:
podman-push-must-gather:
${PODMAN} push "${REGISTRY}/skupper-must-gather:${IMAGE_TAG}"

## Source tree OCI image for downstream build contexts (see Dockerfile.source).
docker-build-source:
${DOCKER} build --build-arg GO_IMAGE_BASE_TAG=$(GO_IMAGE_BASE_TAG) $(SHARED_IMAGE_LABELS) -t "${REGISTRY}/${SOURCE_IMAGE}:${IMAGE_TAG}" -f Dockerfile.source .

docker-push-source: docker-build-source
${DOCKER} push "${REGISTRY}/${SOURCE_IMAGE}:${IMAGE_TAG}"

podman-build-source:
${PODMAN} build --build-arg GO_IMAGE_BASE_TAG=$(GO_IMAGE_BASE_TAG) $(SHARED_IMAGE_LABELS) -t "${REGISTRY}/${SOURCE_IMAGE}:${IMAGE_TAG}" -f Dockerfile.source .

podman-push-source: podman-build-source
${PODMAN} push "${REGISTRY}/${SOURCE_IMAGE}:${IMAGE_TAG}"
Comment on lines +128 to +135

@coderabbitai coderabbitai Bot Aug 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg --glob '!.git/**' -n -C 8 \
  'docker-push-source|podman-push-source|make[[:space:]].*(docker|podman)-push' . || true

Repository: skupperproject/skupper

Length of output: 1292

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- relevant files ---'
git ls-files | rg '(^|/)(Makefile|\.github/workflows/|scripts/|release|ci)' || true

printf '%s\n' '--- push targets and release invocations ---'
rg --glob '!.git/**' -n -C 5 \
  '(^|[[:space:]])(docker|podman)-push(-source)?([:space:]|$)|make[[:space:]]+[^#\n]*(push|release)|make[[:space:]]+-C[^#\n]*(push|release)' \
  . || true

printf '%s\n' '--- Makefile target definitions ---'
rg -n '^[A-Za-z0-9_.-]+:.*(push|release)|^[A-Za-z0-9_.-]+:' Makefile

Repository: skupperproject/skupper

Length of output: 5420

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- relevant files ---'
git ls-files | rg '(^|/)(Makefile|\.github/workflows/|scripts/|release|ci)' || true

printf '%s\n' '--- push targets and release invocations ---'
rg --glob '!.git/**' -n -C 5 \
  '(^|[[:space:]])(docker|podman)-push(-source)?([[:space:]$])|make[[:space:]]+[^#\n]*(push|release)|make[[:space:]]+-C[^#\n]*(push|release)' \
  . || true

printf '%s\n' '--- Makefile target definitions ---'
rg -n '^[A-Za-z0-9_.-]+:.*(push|release)|^[A-Za-z0-9_.-]+:' Makefile

Repository: skupperproject/skupper

Length of output: 3837

🏁 Script executed:

#!/bin/bash
set -euo pipefail

cat -n Makefile | sed -n '1,105p'
printf '%s\n' '--- source image and containerfile declarations ---'
rg -n -C 3 'CONTAINERFILES|SOURCE_IMAGE|Dockerfile\.source|docker-push|podman-push' Makefile .github scripts tests Dockerfile* 2>/dev/null || true

Repository: skupperproject/skupper

Length of output: 9595

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
import re

text = Path("Makefile").read_text()

containerfiles = re.search(r"^CONTAINERFILES\s*:=\s*(.+)$", text, re.MULTILINE).group(1).split()
source_target = "podman-push-source"
aggregate_targets = [f"podman-push-{Path(name).name.removeprefix('Dockerfile.')}" for name in containerfiles]

print("CONTAINERFILES:", containerfiles)
print("podman-push prerequisites:", aggregate_targets)
print("source target included:", source_target in aggregate_targets)
print("source target definition:", bool(re.search(r"^podman-push-source:\s+podman-build-source$", text, re.MULTILINE)))
PY

Repository: skupperproject/skupper

Length of output: 537

Invoke a source push target in the release job.

CONTAINERFILES excludes Dockerfile.source, so aggregate podman-push does not invoke podman-push-source. If release automation uses only that aggregate target, skupper-source is not published. Invoke podman-push-source or docker-push-source explicitly.


## Print fully qualified image names by arch
describe-multiarch-oci:
@scripts/oci-index-archive-info.sh amd64 arm64
Expand Down
Loading