afbbf143
ci: conformance suite with Garage S3 image cache (7lf)
Two new srht.bigb.es manifests:
.builds/conformance.yml — auto-submits on push to master/tags. Pulls
the conformance Docker image from s3://docker-cache/ keyed by
sha256(docker/conformance.Dockerfile); on cache miss, builds it and
uploads. Runs both 'just conformance' and the C-runtime variant
against the cached image.
.builds/conformance-image-rebuild.yml — manual-submit only
(allow-refs: []). Force-rebuilds with --no-cache --pull and replaces
the S3 object. Use when the cached image needs refresh without a
Dockerfile change (base-image CVE, host docker upgrade, corrupted
upload).
Garage S3 specifics:
- addressing_style = path (Garage doesn't do virtual-host)
- signature_version = s3v4 (Garage rejects SigV2)
- region = garage (matches phoebe-lab/garage/config/garage.toml.tmpl)
- head-object for cache-hit check (s3 ls returns exit 0 on missing
keys; head-object 404s cleanly)
- Endpoint https://s3.bigb.es works from the build worker because
srht-build-1 (192.168.88.128) is in Authelia's *.bigb.es LAN-bypass
range (192.168.88.0/24)
Credentials come from two file secrets registered at
https://builds.srht.bigb.es/secrets, mounted as ~/.s3-cache-key-id and
~/.s3-cache-key-secret. Loaded under 'set +x' and persisted to
~/.buildenv via printf %q so subsequent tasks pick them up without
re-tracing.
The bucket 'docker-cache' and its bound key must exist on Garage with
read+write permission for the supplied access key — first push will
fail at the smoke-test 'aws s3 ls' line otherwise. (7lf)
Eugene Blikh <bigbes@gmail.com> — 2026-05-25 06:32:59 UTC
Commit afbbf143a7da90873ddcc53abaf6f424023c0705 —
view raw patch
Parent(s):
af993bfc
| File | Status | + | − |
|---|---|---|---|
.beads/issues.jsonl
|
M | +1 | -1 |
.builds/conformance-image-rebuild.yml
|
A | +68 | |
.builds/conformance.yml
|
A | +114 |