openso/postgres
Watch
1
0
Fork
You've already forked postgres
 0
Code Issues Pull requests Packages 1 Activity Actions

Rebuild gosu with Go 1.26.10 and add CI actionlint config #1

Merged
MHE merged 1 commit from fix-actions-complete-readme into main 2026-11-01 13:13:29 +01:00
Conversation 0 Commits 1 Files changed 6 +98 -13
MHE commented 2026-11-01 13:07:36 +01:00
Owner
Copy link

What changed

  • Dockerfile: new gosu build stage on golang:1.26.10-alpine3.24 that rebuilds the 1.19 tag from source, pins golang.org/x/sys to v0.49.0, and verifies the source tarball by SHA-256. The final image copies the rebuilt binary over /usr/local/bin/gosu and asserts gosu --version reports go1.26.10 and that gosu nobody true works.
  • AGENTS.md: documents the gosu pin and the rebuilt stage, and adds GOSU_VERSION and GOLANG_X_SYS_VERSION to the list of version-bump inputs.
  • README.md: rewritten to describe the current image: pins table, build and tag behavior, startup sequence of entrypoint.postgresql.sh, and the environment switches.
  • entrypoint.postgresql.sh: replaces the [ ... ] && [ ... ] || { ... } guard blocks with explicit if statements so that set -e and the error path behave predictably.
  • .forgejo/actionlint.yaml: declares the docker self-hosted runner label so actionlint stops flagging workflow jobs that use it.
  • .openso/scripts/ci/pycache/policy.cpython-313.pyc: committed compiled bytecode. This is an accidental artifact and should not be tracked.

Why

The postgres:18.6 base image ships gosu built with Go 1.24.6, which carries fixed HIGH and CRITICAL standard-library findings in the image scan. Rebuilding the same gosu tag with a patched Go toolchain clears those findings without changing the base tag. The shell guard rewrite removes a fragile &&/|| pattern in the entrypoint.

Review notes

  • The .pyc file should be removed from the commit and __pycache__ added to .gitignore.
  • Verify the gosu SHA-256 against the upstream release before merging.
  • The build fails if the rebuilt binary does not report go1.26.10.
## What changed - **Dockerfile**: new `gosu` build stage on `golang:1.26.10-alpine3.24` that rebuilds the `1.19` tag from source, pins `golang.org/x/sys` to `v0.49.0`, and verifies the source tarball by SHA-256. The final image copies the rebuilt binary over `/usr/local/bin/gosu` and asserts `gosu --version` reports `go1.26.10` and that `gosu nobody true` works. - **AGENTS.md**: documents the `gosu` pin and the rebuilt stage, and adds `GOSU_VERSION` and `GOLANG_X_SYS_VERSION` to the list of version-bump inputs. - **README.md**: rewritten to describe the current image: pins table, build and tag behavior, startup sequence of `entrypoint.postgresql.sh`, and the environment switches. - **entrypoint.postgresql.sh**: replaces the `[ ... ] && [ ... ] || { ... }` guard blocks with explicit `if` statements so that `set -e` and the error path behave predictably. - **.forgejo/actionlint.yaml**: declares the `docker` self-hosted runner label so actionlint stops flagging workflow jobs that use it. - **.openso/scripts/ci/__pycache__/policy.cpython-313.pyc**: committed compiled bytecode. This is an accidental artifact and should not be tracked. ## Why The `postgres:18.6` base image ships `gosu` built with Go 1.24.6, which carries fixed HIGH and CRITICAL standard-library findings in the image scan. Rebuilding the same `gosu` tag with a patched Go toolchain clears those findings without changing the base tag. The shell guard rewrite removes a fragile `&&`/`||` pattern in the entrypoint. ## Review notes - The `.pyc` file should be removed from the commit and `__pycache__` added to `.gitignore`. - Verify the `gosu` SHA-256 against the upstream release before merging. - The build fails if the rebuilt binary does not report `go1.26.10`.
Rebuild gosu with Go 1.26.10 and update entrypoint docs
All checks were successful
ci / compose (pull_request) Successful in 13s
Details
ci / shellcheck (pull_request) Successful in 2s
Details
ci / conventions (pull_request) Successful in 2s
Details
ci / image (pull_request) Successful in 45s
Details
7e12d20730
MHE merged commit 25dcac7d54 into main 2026-11-01 13:13:29 +01:00
MHE deleted branch fix-actions-complete-readme 2026-11-01 13:13:41 +01:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
openso/postgres!1
No description provided.