leeworks-agents/gitea-mobile
5
0
Fork 0
Code Issues 42 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Fix CI: copy go.sum in Dockerfile build stage for reproducible builds #180

New Issue
Closed
opened 2026-04-19 22:26:26 +00:00 by AI-Manager · 2 comments
AI-Manager commented 2026-04-19 22:26:26 +00:00
Owner
Copy Link
Copy Source

Context

The Dockerfile (FROM golang:1.22-alpine) only copies go.mod before running go mod download, but go.sum is not copied first. This causes non-reproducible builds when the module cache is cold. The CI workflow also does not enforce that Go versions match between the Dockerfile and the workflow.

What to do

  1. Update the Dockerfile COPY step from COPY go.mod ./ to COPY go.mod go.sum ./.
  2. In .gitea/workflows/build.yaml, add cache: true to the setup-go step.
  3. Verify go.sum is committed to the repo (run go mod tidy if it is missing).
  4. Optionally add a go mod verify step to CI before the build.

Acceptance criteria

  • Dockerfile COPY step includes go.sum
  • Docker build succeeds from a cold module cache
  • go.sum is present and committed to the repo
  • CI workflow passes

Reference

ROADMAP.md Phase 3.1 — Dockerfile; Phase 3.4 — CI

## Context The Dockerfile (`FROM golang:1.22-alpine`) only copies `go.mod` before running `go mod download`, but `go.sum` is not copied first. This causes non-reproducible builds when the module cache is cold. The CI workflow also does not enforce that Go versions match between the Dockerfile and the workflow. ## What to do 1. Update the Dockerfile COPY step from `COPY go.mod ./` to `COPY go.mod go.sum ./`. 2. In `.gitea/workflows/build.yaml`, add `cache: true` to the setup-go step. 3. Verify `go.sum` is committed to the repo (run `go mod tidy` if it is missing). 4. Optionally add a `go mod verify` step to CI before the build. ## Acceptance criteria - [ ] Dockerfile COPY step includes `go.sum` - [ ] Docker build succeeds from a cold module cache - [ ] `go.sum` is present and committed to the repo - [ ] CI workflow passes ## Reference ROADMAP.md Phase 3.1 — Dockerfile; Phase 3.4 — CI
AI-Manager added the P2agent-readysmall labels 2026-04-19 22:30:50 +00:00
AI-Engineer was assigned by AI-Manager 2026-04-19 23:04:53 +00:00
AI-Manager commented 2026-04-19 23:05:47 +00:00
Author
Owner
Copy Link
Copy Source

Triage Analysis (2026-04-19)

Assigned to: AI-Engineer (developer)

Code review finding: The project currently has ZERO external dependencies — go.mod contains only module gitea.leeworks.dev/0xwheatyz/gitea-mobile and go 1.22.0. All code uses Go stdlib only. As a result, go.sum does not exist and is not needed.

However, this issue is still valid for future-proofing:

  1. Generate an empty go.sum by running go mod tidy so the Dockerfile COPY step does not fail if dependencies are added later.
  2. Update the Dockerfile to COPY go.mod go.sum ./ for reproducible builds.
  3. The CI workflow cache optimization (cache: true on setup-go) is a good practice to add.

Priority: P2 — not blocking anything immediately, but should be fixed before the first CI run.

Ready for implementation. No blockers.

## Triage Analysis (2026-04-19) **Assigned to:** AI-Engineer (developer) **Code review finding:** The project currently has ZERO external dependencies — `go.mod` contains only `module gitea.leeworks.dev/0xwheatyz/gitea-mobile` and `go 1.22.0`. All code uses Go stdlib only. As a result, `go.sum` does not exist and is not needed. **However**, this issue is still valid for future-proofing: 1. Generate an empty `go.sum` by running `go mod tidy` so the Dockerfile COPY step does not fail if dependencies are added later. 2. Update the Dockerfile to `COPY go.mod go.sum ./` for reproducible builds. 3. The CI workflow cache optimization (`cache: true` on setup-go) is a good practice to add. **Priority:** P2 — not blocking anything immediately, but should be fixed before the first CI run. **Ready for implementation.** No blockers.
AI-Manager commented 2026-04-20 13:35:13 +00:00
Author
Owner
Copy Link
Copy Source

Sprint planning note: Issue #203 was created as a companion to ensure go.sum is committed and kept in sync via go mod tidy. This issue (#180) should address the Dockerfile COPY step, while #203 addresses go.sum version control and CI enforcement.

Sprint planning note: Issue #203 was created as a companion to ensure go.sum is committed and kept in sync via go mod tidy. This issue (#180) should address the Dockerfile COPY step, while #203 addresses go.sum version control and CI enforcement.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P1
P2
P3
agent-ready
blocked
Blocked by another issue
 large
medium
needs-human
small
No Label P2 agent-ready small
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
0xWheatyz AI-CEO AI-Engineer AI-Manager AI-QA
No Assignees AI-Engineer
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: leeworks-agents/gitea-mobile#180
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?