konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

fix(mosquitto): drop runtime apk add from the 7 bootstrap Jobs #449

Closed
claude-bot wants to merge 2 commits from mosquitto-drop-apk into main
pull from: mosquitto-drop-apk
merge into: :main
Conversation 4 Commits 2 Files Changed 3
+93 -14
2 Commits
Author SHA1 Message Date
claude-botandClaude Opus 5 fe6de18048 fix(mosquitto): propagate the alpine-jq base tag instead of hardcoding it
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/push/build-ci-images Pipeline was successful
Details
ci/woodpecker/pr/pr-review Pipeline was successful
Details 
Review point on #449, and a real flaw rather than a nit.

The Containerfile pinned `FROM alpine-jq:2026-07-30`. The pipeline step
already retriggers on changes to ci/images/alpine-jq/**, so a base rebuild
— a CVE patch, say — WOULD rebuild this image, but against the old pinned
tag. That is worse than not rebuilding: the step goes green while shipping
a stale base, so the fix looks applied and is not.

Now ARG BASE_TAG, passed by the pipeline as the same date value used for
this image own tags, with depends_on: [build-alpine-jq] guaranteeing the
base for that date is pushed first. The two images therefore always move
together. The `latest` default applies only to a manual docker build
outside CI.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-07-30 14:55:23 +02:00
claude-botandClaude Opus 5 3f5387979c fix(mosquitto): drop runtime apk add from the 7 bootstrap Jobs 
Last of the runtime `apk add` cleanups. Each of the seven credential
bootstrap Jobs ran `apk add --no-cache curl jq` on every execution, making
them depend on package-index availability at run time.

Adds ci/images/alpine-curl-jq, LAYERED `FROM alpine-jq` rather than
repeating that image's build. jq is therefore installed in exactly one
Containerfile, the shared layers are pulled once, and the relationship
between the two images is explicit instead of implied by duplicated
instructions. The pipeline step uses depends_on: [build-alpine-jq] and also
triggers on changes to the base's path, so the base is built before
anything is layered onto it.

Kept curl rather than switching to busybox wget, deliberately. wget has
--header and --post-data but NO --ca-certificate, so reaching the
Kubernetes API with the ServiceAccount CA needs the CA appended to the
system trust bundle first. That does work — verified in-cluster: TLS
validated and the request reached RBAC, returning 403 rather than a
certificate error — but it changes error semantics versus `curl -f` and
busybox sets its own Content-Type for --post-data. These Jobs mint
credentials, and the existence check they branch on decides whether a
Secret gets created at all, so their logic was left untouched: the diff is
one deleted line and one image change per Job.

Rationale recorded once at the top of the file rather than repeated seven
times.

Verified all seven Jobs render with the new image and no apk add:

  mosquitto-admin-credentials-bootstrap      -> alpine-curl-jq:2026-07-30
  mosquitto-credentials-bootstrap            -> alpine-curl-jq:2026-07-30
  mosquitto-health-credentials-bootstrap     -> alpine-curl-jq:2026-07-30
  mosquitto-open3e-credentials-bootstrap     -> alpine-curl-jq:2026-07-30
  mosquitto-shellies-credentials-bootstrap   -> alpine-curl-jq:2026-07-30
  mosquitto-sml2mqtt-credentials-bootstrap   -> alpine-curl-jq:2026-07-30
  mosquitto-zigbee2mqtt-credentials-bootstrap-> alpine-curl-jq:2026-07-30

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-07-30 14:55:23 +02:00