build(gorilla-merger): containerize via BuildKit secret (unblocks #310 CI) - #312
Merged
Merged
Conversation
…odule fetch The merger imports the private github.com/ProjectASAP/asap-gorilla-go module, so a naive `go build` in Docker/CI 404s/auth-prompts on the fetch. The multi-stage Dockerfile mounts a GitHub token as a BuildKit secret (never baked into a layer) and sets a transient in-container url.insteadOf git rewrite + GOPRIVATE so `go mod download`/`go build` resolve the private dep. Verified: image builds (86MB distroless) and the binary parses all flags. The same GOPRIVATE + gh_token-secret requirement applies to ASAPQuery-backend CI before PR #310 can merge (documented in the README). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
gorilla-merger/Dockerfilethat buildscmd/gorilla-mergerand fetches the privategithub.com/ProjectASAP/asap-gorilla-gomodule cleanly.--secret id=gh_token) for the GitHub token: mounted only for the fetch/buildRUNs, never baked into an image layer. A transient in-containerurl.insteadOfgit rewrite +GOPRIVATE=github.com/ProjectASAP/*letsgo mod download/go buildresolve the private dep. The git config lives only in the build container, never on the host.gorilla-merger/README.mddocumenting the exact build invocation, ports/flags, and the CI note below.Why this targets
feat/gorilla-compactor(notmain)The
gorilla-merger/module only exists on the merger branch (PR #310); it is not onmainyet. This PR stacks on #310 and unblocks #310's CI: the sameGOPRIVATE+gh_tokensecret requirement applies to the ASAPQuery-backend CI runner before #310 can merge (a naivego build/go testofgorilla-merger/404s on the private module).Verification
GOPRIVATE=github.com/ProjectASAP/* go vet ./...— clean (exit 0).DOCKER_BUILDKIT=1 docker build --secret id=gh_token,src=<tokenfile> -t asap/gorilla-merger:dev gorilla-merger/— builds; privatego mod download+go buildsucceed; final image is 86MB distroless; the binary parses all flags.Test plan
gh_tokenBuildKit secret (orurl.insteadOftoken) sogo build/go test ./gorilla-merger/...can fetch the private module.asap/gorilla-merger:devbuilds in CI with the secret wired.🤖 Generated with Claude Code