From d16a829287d17706d5e4895d1b74023c83ec4406 Mon Sep 17 00:00:00 2001 From: kbrennan-oai Date: Mon, 19 Oct 2026 16:04:05 -0400 Subject: [PATCH 1/4] Pin development images to Go 1.26.9 and golangci-lint v2.15.0 Install the linter in a dedicated directory with PATH precedence. Allow manual workflow dispatches to disable Leeway caching for both development-image and component builds. --- .devcontainer/Dockerfile | 7 +++++-- .github/workflows/branch-build.yml | 11 +++++++++-- .github/workflows/build.yml | 11 +++++++++-- dev/image/Dockerfile | 11 +++++++---- 4 files changed, 30 insertions(+), 10 deletions(-) diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index ca85a28aa12ff8..80adfa9060a8f3 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -196,7 +196,7 @@ RUN curl -sSL "https://awscli.amazonaws.com/awscli-exe-linux-$(arch).zip" -o aws ./aws/install --bin-dir /usr/local/bin --install-dir /usr/local/aws-cli --update && \ rm -rf awscliv2.zip ./aws -ENV GO_VERSION=1.25.9 +ENV GO_VERSION=1.26.9 ENV GOPATH=/root/go-packages ENV GOROOT=/root/go ENV PATH=$GOROOT/bin:$GOPATH/bin:$PATH @@ -255,7 +255,7 @@ RUN curl -fsSL https://github.com/csweichel/oci-tool/releases/download/v0.2.0/oc && chmod +x /usr/local/bin/oci-tool # Install golangci-lint -RUN go install -v github.com/golangci/golangci-lint/cmd/golangci-lint@latest +RUN GOBIN=/opt/golangci-lint/bin go install -v github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.15.0 ENV USE_GKE_GCLOUD_AUTH_PLUGIN=True @@ -376,3 +376,6 @@ ENV PRE_COMMIT_HOME=/workspace/.pre-commit # terminal sessions in Gitpod workspaces. ENV PREVIEW_ENV_DEV_SA_KEY_PATH=/root/.config/gcloud/sa.json ENV GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES=1 + +# Prefer the pinned linter over tools installed elsewhere in the image. +ENV PATH=/opt/golangci-lint/bin:$PATH diff --git a/.github/workflows/branch-build.yml b/.github/workflows/branch-build.yml index b09b3b7c80b3ca..a87d3bf62e90ac 100644 --- a/.github/workflows/branch-build.yml +++ b/.github/workflows/branch-build.yml @@ -24,6 +24,11 @@ on: type: boolean description: "Simulate a scheduled run" default: false + leeway_no_cache: + required: false + type: boolean + description: "Disable Leeway caching for toolchain validation" + default: false jobs: configuration: @@ -39,7 +44,7 @@ jobs: version: ${{ steps.branches.outputs.sanitized-branch-name }}-gha.${{github.run_number}} preview_enable: ${{ contains( steps.pr-details.outputs.pr_body, '[x] /werft with-preview') || (steps.output.outputs.with_integration_tests != '') }} preview_name: ${{ github.head_ref || github.ref_name }} - build_no_cache: ${{ contains( steps.pr-details.outputs.pr_body, '[x] leeway-no-cache') }} + build_no_cache: ${{ inputs.leeway_no_cache == true || contains( steps.pr-details.outputs.pr_body, '[x] leeway-no-cache') }} build_no_test: ${{ contains( steps.pr-details.outputs.pr_body, '[x] /werft no-test') }} with_large_vm: ${{ contains( steps.pr-details.outputs.pr_body, '[X] /werft with-large-vm') || (steps.output.outputs.with_integration_tests != '') }} publish_to_npm: ${{ contains( steps.pr-details.outputs.pr_body, '[X] /werft publish-to-npm') }} @@ -223,14 +228,16 @@ jobs: LEEWAY_REMOTE_CACHE_BUCKET: ${{needs.configuration.outputs.leeway_cache_bucket}} LEEWAY_CACHE_UPLOAD_IMMEDIATE: true IMAGE_REPO_BASE: ${{needs.configuration.outputs.image_repo_base}}/dev + PR_NO_CACHE: ${{needs.configuration.outputs.build_no_cache}} shell: bash run: | + [[ "$PR_NO_CACHE" = "true" ]] && CACHE="none" || CACHE="remote" RESULT=0 set -x leeway build dev:all \ --docker-build-options network=host \ - --cache remote \ + --cache "$CACHE" \ -Dversion=$VERSION \ -DlocalAppVersion=$VERSION \ -DimageRepoBase=$IMAGE_REPO_BASE \ diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 276991baa5713b..5e8a95b8161dbd 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -21,6 +21,11 @@ on: type: boolean description: "Simulate a scheduled run" default: false + leeway_no_cache: + required: false + type: boolean + description: "Disable Leeway caching for toolchain validation" + default: false schedule: # Run at midnight UTC every day # Purpose: This scheduled run performs regular vulnerability scans of the codebase @@ -42,7 +47,7 @@ jobs: version: ${{ steps.branches.outputs.sanitized-branch-name }}-gha.${{github.run_number}} preview_enable: ${{ contains( steps.pr-details.outputs.pr_body, '[x] /werft with-preview') || (steps.output.outputs.with_integration_tests != '') }} preview_name: ${{ github.head_ref || github.ref_name }} - build_no_cache: ${{ contains( steps.pr-details.outputs.pr_body, '[x] leeway-no-cache') }} + build_no_cache: ${{ inputs.leeway_no_cache == true || contains( steps.pr-details.outputs.pr_body, '[x] leeway-no-cache') }} build_no_test: ${{ contains( steps.pr-details.outputs.pr_body, '[x] /werft no-test') }} with_large_vm: ${{ contains( steps.pr-details.outputs.pr_body, '[X] /werft with-large-vm') || (steps.output.outputs.with_integration_tests != '') }} publish_to_npm: ${{ contains( steps.pr-details.outputs.pr_body, '[X] /werft publish-to-npm') }} @@ -226,14 +231,16 @@ jobs: LEEWAY_REMOTE_CACHE_BUCKET: ${{needs.configuration.outputs.leeway_cache_bucket}} LEEWAY_CACHE_UPLOAD_IMMEDIATE: true IMAGE_REPO_BASE: ${{needs.configuration.outputs.image_repo_base}}/dev + PR_NO_CACHE: ${{needs.configuration.outputs.build_no_cache}} shell: bash run: | + [[ "$PR_NO_CACHE" = "true" ]] && CACHE="none" || CACHE="remote" RESULT=0 set -x leeway build dev:all \ --docker-build-options network=host \ - --cache remote \ + --cache "$CACHE" \ -Dversion=$VERSION \ -DlocalAppVersion=$VERSION \ -DimageRepoBase=$IMAGE_REPO_BASE \ diff --git a/dev/image/Dockerfile b/dev/image/Dockerfile index 4b4fc76e61d46c..d8d31a06bdb6c1 100644 --- a/dev/image/Dockerfile +++ b/dev/image/Dockerfile @@ -11,7 +11,7 @@ USER root ### Go ### # Pin Go version explicitly to ensure all CI-built binaries use a # non-vulnerable toolchain (CVE-2026-27143 requires >= 1.25.9). -ENV GO_VERSION=1.25.9 +ENV GO_VERSION=1.26.9 RUN rm -rf /usr/local/go /home/gitpod/go /home/gitpod/.cache/go-build \ && curl -fsSL "https://dl.google.com/go/go${GO_VERSION}.linux-amd64.tar.gz" | tar -C /usr/local -xz \ && ln -sf /usr/local/go/bin/go /usr/bin/go \ @@ -19,6 +19,9 @@ RUN rm -rf /usr/local/go /home/gitpod/go /home/gitpod/.cache/go-build \ ENV GOROOT=/usr/local/go ENV PATH=/usr/local/go/bin:$PATH +# Install golangci-lint separately from tools inherited from the base image. +RUN GOBIN=/opt/golangci-lint/bin go install -v github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.15.0 + ### cloud_sql_proxy ### ARG CLOUD_SQL_PROXY=/usr/local/bin/cloud_sql_proxy RUN curl -fsSL https://dl.google.com/cloudsql/cloud_sql_proxy.linux.amd64 > $CLOUD_SQL_PROXY \ @@ -289,10 +292,10 @@ RUN curl -fsSL https://github.com/ericchiang/pup/releases/download/v0.4.0/pup_v0 RUN curl -fsSL https://github.com/csweichel/oci-tool/releases/download/v0.2.0/oci-tool_0.2.0_linux_amd64.tar.gz | sudo tar xz -C /usr/local/bin \ && sudo chmod +x /usr/local/bin/oci-tool -# Install golangci-lint -RUN go install -v github.com/golangci/golangci-lint/cmd/golangci-lint@latest - RUN sudo install-packages pigz # Install pre-commit hooks under /workspace during prebuilds ENV PRE_COMMIT_HOME=/workspace/.pre-commit + +# Prefer the pinned linter over any copy inherited from the base image. +ENV PATH=/opt/golangci-lint/bin:$PATH From b659bcb3e291c765d19d93d76832c93797473a25 Mon Sep 17 00:00:00 2001 From: Kyle Brennan Date: Mon, 19 Oct 2026 20:12:22 +0000 Subject: [PATCH 2/4] Add staged image validation to the existing validation branch Co-authored-by: Codex --- .github/workflows/branch-build.yml | 35 +++++++++++++++++++++++++++++- dev/image/README.md | 27 +++++++++++++++++++++++ 2 files changed, 61 insertions(+), 1 deletion(-) diff --git a/.github/workflows/branch-build.yml b/.github/workflows/branch-build.yml index a87d3bf62e90ac..8ef3feb55f795a 100644 --- a/.github/workflows/branch-build.yml +++ b/.github/workflows/branch-build.yml @@ -24,6 +24,16 @@ on: type: boolean description: "Simulate a scheduled run" default: false + validation_stage: + required: false + type: choice + description: "Standard build, baseline with current image, image publication, or candidate validation" + options: + - standard + - baseline + - candidate-image + - candidate + default: standard leeway_no_cache: required: false type: boolean @@ -207,6 +217,21 @@ jobs: identity_provider: ${{ github.ref == 'refs/heads/main' && secrets.CORE_DEV_PROVIDER || secrets.DEV_PREVIEW_PROVIDER }} service_account: ${{ github.ref == 'refs/heads/main' && secrets.CORE_DEV_SA || secrets.DEV_PREVIEW_SA }} leeway_segment_key: ${{ secrets.LEEWAY_SEGMENT_KEY }} + - name: Verify validation toolchain + if: github.event_name == 'workflow_dispatch' && inputs.validation_stage != 'standard' + shell: bash + run: | + test "$(uname -s)" = Linux + test "$(uname -m)" = x86_64 + go version + leeway version + command -v golangci-lint + golangci-lint version + if [[ "${{ inputs.validation_stage }}" = "candidate" ]]; then + test "$(go env GOVERSION)" = go1.26.9 + test "$(command -v golangci-lint)" = /opt/golangci-lint/bin/golangci-lint + golangci-lint version | grep -E 'version (v)?2\.15\.0 ' + fi - name: Leeway Vet shell: bash run: | @@ -221,6 +246,7 @@ jobs: fi exit "$RESULT" - name: Dev Build + if: inputs.validation_stage != 'baseline' && inputs.validation_stage != 'candidate' id: dev-build env: JAVA_HOME: /home/gitpod/.sdkman/candidates/java/current @@ -228,6 +254,7 @@ jobs: LEEWAY_REMOTE_CACHE_BUCKET: ${{needs.configuration.outputs.leeway_cache_bucket}} LEEWAY_CACHE_UPLOAD_IMMEDIATE: true IMAGE_REPO_BASE: ${{needs.configuration.outputs.image_repo_base}}/dev + VALIDATION_STAGE: ${{ inputs.validation_stage }} PR_NO_CACHE: ${{needs.configuration.outputs.build_no_cache}} shell: bash run: | @@ -235,7 +262,11 @@ jobs: RESULT=0 set -x - leeway build dev:all \ + TARGET=dev:all + if [[ "$VALIDATION_STAGE" = "candidate-image" ]]; then + TARGET=dev/image:docker + fi + leeway build "$TARGET" \ --docker-build-options network=host \ --cache "$CACHE" \ -Dversion=$VERSION \ @@ -261,6 +292,7 @@ jobs: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Leeway Build + if: inputs.validation_stage != 'candidate-image' id: leeway shell: bash env: @@ -334,6 +366,7 @@ jobs: GITHUB_EMAIL: roboquat@gitpod.io VERSION: ${{ needs.configuration.outputs.version }} - name: Scan for Vulnerabilities + if: inputs.validation_stage != 'candidate-image' id: scan shell: bash env: diff --git a/dev/image/README.md b/dev/image/README.md index 15d982b42be732..45dfa74daedadb 100644 --- a/dev/image/README.md +++ b/dev/image/README.md @@ -35,3 +35,30 @@ Use `--check` to verify that every active reference already points at an image: scripts/update-dev-environment-image.sh --check \ eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha. ``` + +## Validating an image before a PR + +For toolchain upgrades, use a validation branch and manually dispatch +`branch-build.yml`. No PR or merge is needed: + +1. Run `validation_stage=baseline` with `leeway_no_cache=true` before changing image + references. This skips image publication and tests the current CI image. +2. Update both Dockerfiles and run `validation_stage=candidate-image` to build + and publish `dev/image:docker` with the current CI image. Use the published + branch image tag from this run; do not infer that publication succeeded from + the workflow's overall status alone. +3. Update active consumers using the full candidate image reference: + + ```shell + scripts/update-dev-environment-image.sh \ + eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:-gha. + ``` + +4. Run `validation_stage=candidate` with `leeway_no_cache=true`. This skips rebuilding + the image and runs the normal Leeway build using the candidate image. The + validation step checks native Linux amd64 and the pinned tool versions. + Tests and lint remain enabled. + +Compare baseline and candidate failures and investigate upgrade-related +failures. Require the uncached Leeway build to pass before opening a PR. +The default `validation_stage=standard` retains the usual branch build. From c8fc72b680753670ef64b178b5836f77d0c069b0 Mon Sep 17 00:00:00 2001 From: Kyle Brennan Date: Mon, 19 Oct 2026 20:28:04 +0000 Subject: [PATCH 3/4] Validate CI with the Go 1.26.9 and golangci-lint v2.15.0 image Co-authored-by: Codex --- .github/workflows/branch-build.yml | 12 ++++++------ .github/workflows/build.yml | 12 ++++++------ .github/workflows/code-nightly.yml | 2 +- .github/workflows/ide-integration-tests.yml | 8 ++++---- .github/workflows/jetbrains-auto-update-template.yml | 2 +- .github/workflows/jetbrains-integration-test.yml | 2 +- .github/workflows/preview-env-check-regressions.yml | 6 +++--- .github/workflows/preview-env-delete.yml | 2 +- .github/workflows/preview-env-gc.yml | 4 ++-- .github/workflows/workspace-integration-tests.yml | 8 ++++---- .gitpod.yml | 2 +- 11 files changed, 30 insertions(+), 30 deletions(-) diff --git a/.github/workflows/branch-build.yml b/.github/workflows/branch-build.yml index 8ef3feb55f795a..e3990b9f23d576 100644 --- a/.github/workflows/branch-build.yml +++ b/.github/workflows/branch-build.yml @@ -127,7 +127,7 @@ jobs: cancel-in-progress: ${{ needs.configuration.outputs.is_main_branch == 'false' }} runs-on: ubuntu-latest-16-cores container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 @@ -155,7 +155,7 @@ jobs: (needs.configuration.outputs.is_scheduled_run != 'true') runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root concurrency: group: ${{ github.ref == 'refs/heads/main' && github.run_id || github.sha }}-infrastructure @@ -202,7 +202,7 @@ jobs: ports: - 6379:6379 container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root env: DB_HOST: "mysql" @@ -511,7 +511,7 @@ jobs: if: needs.configuration.outputs.is_scheduled_run != 'true' runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root concurrency: group: ${{ github.ref == 'refs/heads/main' && github.run_id || github.sha }}-install @@ -564,7 +564,7 @@ jobs: environment: branch-build runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root if: needs.configuration.outputs.with_monitoring == 'true' && needs.configuration.outputs.is_scheduled_run != 'true' concurrency: @@ -593,7 +593,7 @@ jobs: environment: branch-build runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root if: needs.configuration.outputs.with_integration_tests != '' && needs.configuration.outputs.is_scheduled_run != 'true' concurrency: diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 5e8a95b8161dbd..9ac733882632fb 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -120,7 +120,7 @@ jobs: cancel-in-progress: ${{ needs.configuration.outputs.is_main_branch == 'false' }} runs-on: ubuntu-latest-16-cores container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 @@ -148,7 +148,7 @@ jobs: (needs.configuration.outputs.is_scheduled_run != 'true') runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root concurrency: group: ${{ github.ref == 'refs/heads/main' && github.run_id || github.sha }}-infrastructure @@ -195,7 +195,7 @@ jobs: ports: - 6379:6379 container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root env: DB_HOST: "mysql" @@ -516,7 +516,7 @@ jobs: if: needs.configuration.outputs.is_scheduled_run != 'true' runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root concurrency: group: ${{ github.ref == 'refs/heads/main' && github.run_id || github.sha }}-install @@ -569,7 +569,7 @@ jobs: environment: main-build runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root if: needs.configuration.outputs.with_monitoring == 'true' && needs.configuration.outputs.is_scheduled_run != 'true' concurrency: @@ -598,7 +598,7 @@ jobs: environment: main-build runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root if: needs.configuration.outputs.with_integration_tests != '' && needs.configuration.outputs.is_scheduled_run != 'true' concurrency: diff --git a/.github/workflows/code-nightly.yml b/.github/workflows/code-nightly.yml index a729b22890135a..fcc56e24b8887d 100644 --- a/.github/workflows/code-nightly.yml +++ b/.github/workflows/code-nightly.yml @@ -11,7 +11,7 @@ jobs: build: runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 diff --git a/.github/workflows/ide-integration-tests.yml b/.github/workflows/ide-integration-tests.yml index 2f72dcbe95b0e8..2ce31b25dd91bb 100644 --- a/.github/workflows/ide-integration-tests.yml +++ b/.github/workflows/ide-integration-tests.yml @@ -36,7 +36,7 @@ jobs: name: Configuration runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root outputs: name: ${{ steps.configuration.outputs.name }} @@ -93,7 +93,7 @@ jobs: needs: [configuration] runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root concurrency: group: ${{ needs.configuration.outputs.name }}-infrastructure @@ -126,7 +126,7 @@ jobs: needs: [configuration, infrastructure] runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root volumes: - /var/tmp:/var/tmp @@ -218,7 +218,7 @@ jobs: if: github.event.inputs.skip_delete != 'true' && always() runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 diff --git a/.github/workflows/jetbrains-auto-update-template.yml b/.github/workflows/jetbrains-auto-update-template.yml index b5a8cf0f110f56..69f7df94ae02f5 100644 --- a/.github/workflows/jetbrains-auto-update-template.yml +++ b/.github/workflows/jetbrains-auto-update-template.yml @@ -15,7 +15,7 @@ jobs: update-jetbrains: runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root steps: - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # pin@v2 diff --git a/.github/workflows/jetbrains-integration-test.yml b/.github/workflows/jetbrains-integration-test.yml index 51c50c74c19c94..2f9ada696ac819 100644 --- a/.github/workflows/jetbrains-integration-test.yml +++ b/.github/workflows/jetbrains-integration-test.yml @@ -34,7 +34,7 @@ on: jobs: jetbrains-smoke-test-linux: container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root runs-on: ubuntu-latest steps: diff --git a/.github/workflows/preview-env-check-regressions.yml b/.github/workflows/preview-env-check-regressions.yml index 52dfafedfea41a..e34ffeb0036832 100644 --- a/.github/workflows/preview-env-check-regressions.yml +++ b/.github/workflows/preview-env-check-regressions.yml @@ -60,7 +60,7 @@ jobs: needs: [configuration] runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root concurrency: group: ${{ needs.configuration.outputs.name }}-infrastructure @@ -93,7 +93,7 @@ jobs: if: ${{ needs.configuration.outputs.skip == 'false' }} runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root volumes: - /var/tmp:/var/tmp @@ -173,7 +173,7 @@ jobs: if: always() runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 diff --git a/.github/workflows/preview-env-delete.yml b/.github/workflows/preview-env-delete.yml index 52df37f50bd639..dccd2867ee24b8 100644 --- a/.github/workflows/preview-env-delete.yml +++ b/.github/workflows/preview-env-delete.yml @@ -15,7 +15,7 @@ jobs: if: github.event.ref_type == 'branch' || github.event.inputs.name != '' runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 diff --git a/.github/workflows/preview-env-gc.yml b/.github/workflows/preview-env-gc.yml index 6f277cdd3fa80d..1c0f67e0e9c016 100644 --- a/.github/workflows/preview-env-gc.yml +++ b/.github/workflows/preview-env-gc.yml @@ -11,7 +11,7 @@ jobs: name: "Find stale preview environments" runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root outputs: names: ${{ steps.set-matrix.outputs.names }} @@ -43,7 +43,7 @@ jobs: needs: [stale] runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root if: ${{ needs.stale.outputs.count > 0 }} strategy: diff --git a/.github/workflows/workspace-integration-tests.yml b/.github/workflows/workspace-integration-tests.yml index 5415b1869bf389..b659cd6ff40b14 100644 --- a/.github/workflows/workspace-integration-tests.yml +++ b/.github/workflows/workspace-integration-tests.yml @@ -52,7 +52,7 @@ jobs: name: Configuration runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root outputs: name: ${{ steps.configuration.outputs.name }} @@ -126,7 +126,7 @@ jobs: needs: [configuration] runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root concurrency: group: ${{ needs.configuration.outputs.name }}-infrastructure @@ -159,7 +159,7 @@ jobs: needs: [configuration, infrastructure] runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 @@ -181,7 +181,7 @@ jobs: if: inputs.skip_delete != 'true' && always() runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 + image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 diff --git a/.gitpod.yml b/.gitpod.yml index 2c1b2f8a3492ca..69a5f47ac7cc16 100644 --- a/.gitpod.yml +++ b/.gitpod.yml @@ -1,4 +1,4 @@ -image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 +image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 workspaceLocation: gitpod/gitpod-ws.code-workspace checkoutLocation: gitpod ports: From 3029efbccc370b786973b85b7b06314123b326de Mon Sep 17 00:00:00 2001 From: Kyle Brennan Date: Tue, 20 Oct 2026 14:40:38 +0000 Subject: [PATCH 4/4] Keep image rollout PR focused on Dockerfile toolchain pins Co-authored-by: Codex --- .github/workflows/branch-build.yml | 58 +++---------------- .github/workflows/build.yml | 23 +++----- .github/workflows/code-nightly.yml | 2 +- .github/workflows/ide-integration-tests.yml | 8 +-- .../jetbrains-auto-update-template.yml | 2 +- .../workflows/jetbrains-integration-test.yml | 2 +- .../preview-env-check-regressions.yml | 6 +- .github/workflows/preview-env-delete.yml | 2 +- .github/workflows/preview-env-gc.yml | 4 +- .../workflows/workspace-integration-tests.yml | 8 +-- .gitpod.yml | 2 +- dev/image/README.md | 27 --------- 12 files changed, 35 insertions(+), 109 deletions(-) diff --git a/.github/workflows/branch-build.yml b/.github/workflows/branch-build.yml index e3990b9f23d576..b09b3b7c80b3ca 100644 --- a/.github/workflows/branch-build.yml +++ b/.github/workflows/branch-build.yml @@ -24,21 +24,6 @@ on: type: boolean description: "Simulate a scheduled run" default: false - validation_stage: - required: false - type: choice - description: "Standard build, baseline with current image, image publication, or candidate validation" - options: - - standard - - baseline - - candidate-image - - candidate - default: standard - leeway_no_cache: - required: false - type: boolean - description: "Disable Leeway caching for toolchain validation" - default: false jobs: configuration: @@ -54,7 +39,7 @@ jobs: version: ${{ steps.branches.outputs.sanitized-branch-name }}-gha.${{github.run_number}} preview_enable: ${{ contains( steps.pr-details.outputs.pr_body, '[x] /werft with-preview') || (steps.output.outputs.with_integration_tests != '') }} preview_name: ${{ github.head_ref || github.ref_name }} - build_no_cache: ${{ inputs.leeway_no_cache == true || contains( steps.pr-details.outputs.pr_body, '[x] leeway-no-cache') }} + build_no_cache: ${{ contains( steps.pr-details.outputs.pr_body, '[x] leeway-no-cache') }} build_no_test: ${{ contains( steps.pr-details.outputs.pr_body, '[x] /werft no-test') }} with_large_vm: ${{ contains( steps.pr-details.outputs.pr_body, '[X] /werft with-large-vm') || (steps.output.outputs.with_integration_tests != '') }} publish_to_npm: ${{ contains( steps.pr-details.outputs.pr_body, '[X] /werft publish-to-npm') }} @@ -127,7 +112,7 @@ jobs: cancel-in-progress: ${{ needs.configuration.outputs.is_main_branch == 'false' }} runs-on: ubuntu-latest-16-cores container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 @@ -155,7 +140,7 @@ jobs: (needs.configuration.outputs.is_scheduled_run != 'true') runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root concurrency: group: ${{ github.ref == 'refs/heads/main' && github.run_id || github.sha }}-infrastructure @@ -202,7 +187,7 @@ jobs: ports: - 6379:6379 container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root env: DB_HOST: "mysql" @@ -217,21 +202,6 @@ jobs: identity_provider: ${{ github.ref == 'refs/heads/main' && secrets.CORE_DEV_PROVIDER || secrets.DEV_PREVIEW_PROVIDER }} service_account: ${{ github.ref == 'refs/heads/main' && secrets.CORE_DEV_SA || secrets.DEV_PREVIEW_SA }} leeway_segment_key: ${{ secrets.LEEWAY_SEGMENT_KEY }} - - name: Verify validation toolchain - if: github.event_name == 'workflow_dispatch' && inputs.validation_stage != 'standard' - shell: bash - run: | - test "$(uname -s)" = Linux - test "$(uname -m)" = x86_64 - go version - leeway version - command -v golangci-lint - golangci-lint version - if [[ "${{ inputs.validation_stage }}" = "candidate" ]]; then - test "$(go env GOVERSION)" = go1.26.9 - test "$(command -v golangci-lint)" = /opt/golangci-lint/bin/golangci-lint - golangci-lint version | grep -E 'version (v)?2\.15\.0 ' - fi - name: Leeway Vet shell: bash run: | @@ -246,7 +216,6 @@ jobs: fi exit "$RESULT" - name: Dev Build - if: inputs.validation_stage != 'baseline' && inputs.validation_stage != 'candidate' id: dev-build env: JAVA_HOME: /home/gitpod/.sdkman/candidates/java/current @@ -254,21 +223,14 @@ jobs: LEEWAY_REMOTE_CACHE_BUCKET: ${{needs.configuration.outputs.leeway_cache_bucket}} LEEWAY_CACHE_UPLOAD_IMMEDIATE: true IMAGE_REPO_BASE: ${{needs.configuration.outputs.image_repo_base}}/dev - VALIDATION_STAGE: ${{ inputs.validation_stage }} - PR_NO_CACHE: ${{needs.configuration.outputs.build_no_cache}} shell: bash run: | - [[ "$PR_NO_CACHE" = "true" ]] && CACHE="none" || CACHE="remote" RESULT=0 set -x - TARGET=dev:all - if [[ "$VALIDATION_STAGE" = "candidate-image" ]]; then - TARGET=dev/image:docker - fi - leeway build "$TARGET" \ + leeway build dev:all \ --docker-build-options network=host \ - --cache "$CACHE" \ + --cache remote \ -Dversion=$VERSION \ -DlocalAppVersion=$VERSION \ -DimageRepoBase=$IMAGE_REPO_BASE \ @@ -292,7 +254,6 @@ jobs: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Leeway Build - if: inputs.validation_stage != 'candidate-image' id: leeway shell: bash env: @@ -366,7 +327,6 @@ jobs: GITHUB_EMAIL: roboquat@gitpod.io VERSION: ${{ needs.configuration.outputs.version }} - name: Scan for Vulnerabilities - if: inputs.validation_stage != 'candidate-image' id: scan shell: bash env: @@ -511,7 +471,7 @@ jobs: if: needs.configuration.outputs.is_scheduled_run != 'true' runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root concurrency: group: ${{ github.ref == 'refs/heads/main' && github.run_id || github.sha }}-install @@ -564,7 +524,7 @@ jobs: environment: branch-build runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root if: needs.configuration.outputs.with_monitoring == 'true' && needs.configuration.outputs.is_scheduled_run != 'true' concurrency: @@ -593,7 +553,7 @@ jobs: environment: branch-build runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root if: needs.configuration.outputs.with_integration_tests != '' && needs.configuration.outputs.is_scheduled_run != 'true' concurrency: diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 9ac733882632fb..276991baa5713b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -21,11 +21,6 @@ on: type: boolean description: "Simulate a scheduled run" default: false - leeway_no_cache: - required: false - type: boolean - description: "Disable Leeway caching for toolchain validation" - default: false schedule: # Run at midnight UTC every day # Purpose: This scheduled run performs regular vulnerability scans of the codebase @@ -47,7 +42,7 @@ jobs: version: ${{ steps.branches.outputs.sanitized-branch-name }}-gha.${{github.run_number}} preview_enable: ${{ contains( steps.pr-details.outputs.pr_body, '[x] /werft with-preview') || (steps.output.outputs.with_integration_tests != '') }} preview_name: ${{ github.head_ref || github.ref_name }} - build_no_cache: ${{ inputs.leeway_no_cache == true || contains( steps.pr-details.outputs.pr_body, '[x] leeway-no-cache') }} + build_no_cache: ${{ contains( steps.pr-details.outputs.pr_body, '[x] leeway-no-cache') }} build_no_test: ${{ contains( steps.pr-details.outputs.pr_body, '[x] /werft no-test') }} with_large_vm: ${{ contains( steps.pr-details.outputs.pr_body, '[X] /werft with-large-vm') || (steps.output.outputs.with_integration_tests != '') }} publish_to_npm: ${{ contains( steps.pr-details.outputs.pr_body, '[X] /werft publish-to-npm') }} @@ -120,7 +115,7 @@ jobs: cancel-in-progress: ${{ needs.configuration.outputs.is_main_branch == 'false' }} runs-on: ubuntu-latest-16-cores container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 @@ -148,7 +143,7 @@ jobs: (needs.configuration.outputs.is_scheduled_run != 'true') runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root concurrency: group: ${{ github.ref == 'refs/heads/main' && github.run_id || github.sha }}-infrastructure @@ -195,7 +190,7 @@ jobs: ports: - 6379:6379 container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root env: DB_HOST: "mysql" @@ -231,16 +226,14 @@ jobs: LEEWAY_REMOTE_CACHE_BUCKET: ${{needs.configuration.outputs.leeway_cache_bucket}} LEEWAY_CACHE_UPLOAD_IMMEDIATE: true IMAGE_REPO_BASE: ${{needs.configuration.outputs.image_repo_base}}/dev - PR_NO_CACHE: ${{needs.configuration.outputs.build_no_cache}} shell: bash run: | - [[ "$PR_NO_CACHE" = "true" ]] && CACHE="none" || CACHE="remote" RESULT=0 set -x leeway build dev:all \ --docker-build-options network=host \ - --cache "$CACHE" \ + --cache remote \ -Dversion=$VERSION \ -DlocalAppVersion=$VERSION \ -DimageRepoBase=$IMAGE_REPO_BASE \ @@ -516,7 +509,7 @@ jobs: if: needs.configuration.outputs.is_scheduled_run != 'true' runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root concurrency: group: ${{ github.ref == 'refs/heads/main' && github.run_id || github.sha }}-install @@ -569,7 +562,7 @@ jobs: environment: main-build runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root if: needs.configuration.outputs.with_monitoring == 'true' && needs.configuration.outputs.is_scheduled_run != 'true' concurrency: @@ -598,7 +591,7 @@ jobs: environment: main-build runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root if: needs.configuration.outputs.with_integration_tests != '' && needs.configuration.outputs.is_scheduled_run != 'true' concurrency: diff --git a/.github/workflows/code-nightly.yml b/.github/workflows/code-nightly.yml index fcc56e24b8887d..a729b22890135a 100644 --- a/.github/workflows/code-nightly.yml +++ b/.github/workflows/code-nightly.yml @@ -11,7 +11,7 @@ jobs: build: runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 diff --git a/.github/workflows/ide-integration-tests.yml b/.github/workflows/ide-integration-tests.yml index 2ce31b25dd91bb..2f72dcbe95b0e8 100644 --- a/.github/workflows/ide-integration-tests.yml +++ b/.github/workflows/ide-integration-tests.yml @@ -36,7 +36,7 @@ jobs: name: Configuration runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root outputs: name: ${{ steps.configuration.outputs.name }} @@ -93,7 +93,7 @@ jobs: needs: [configuration] runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root concurrency: group: ${{ needs.configuration.outputs.name }}-infrastructure @@ -126,7 +126,7 @@ jobs: needs: [configuration, infrastructure] runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root volumes: - /var/tmp:/var/tmp @@ -218,7 +218,7 @@ jobs: if: github.event.inputs.skip_delete != 'true' && always() runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 diff --git a/.github/workflows/jetbrains-auto-update-template.yml b/.github/workflows/jetbrains-auto-update-template.yml index 69f7df94ae02f5..b5a8cf0f110f56 100644 --- a/.github/workflows/jetbrains-auto-update-template.yml +++ b/.github/workflows/jetbrains-auto-update-template.yml @@ -15,7 +15,7 @@ jobs: update-jetbrains: runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root steps: - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # pin@v2 diff --git a/.github/workflows/jetbrains-integration-test.yml b/.github/workflows/jetbrains-integration-test.yml index 2f9ada696ac819..51c50c74c19c94 100644 --- a/.github/workflows/jetbrains-integration-test.yml +++ b/.github/workflows/jetbrains-integration-test.yml @@ -34,7 +34,7 @@ on: jobs: jetbrains-smoke-test-linux: container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root runs-on: ubuntu-latest steps: diff --git a/.github/workflows/preview-env-check-regressions.yml b/.github/workflows/preview-env-check-regressions.yml index e34ffeb0036832..52dfafedfea41a 100644 --- a/.github/workflows/preview-env-check-regressions.yml +++ b/.github/workflows/preview-env-check-regressions.yml @@ -60,7 +60,7 @@ jobs: needs: [configuration] runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root concurrency: group: ${{ needs.configuration.outputs.name }}-infrastructure @@ -93,7 +93,7 @@ jobs: if: ${{ needs.configuration.outputs.skip == 'false' }} runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root volumes: - /var/tmp:/var/tmp @@ -173,7 +173,7 @@ jobs: if: always() runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 diff --git a/.github/workflows/preview-env-delete.yml b/.github/workflows/preview-env-delete.yml index dccd2867ee24b8..52df37f50bd639 100644 --- a/.github/workflows/preview-env-delete.yml +++ b/.github/workflows/preview-env-delete.yml @@ -15,7 +15,7 @@ jobs: if: github.event.ref_type == 'branch' || github.event.inputs.name != '' runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 diff --git a/.github/workflows/preview-env-gc.yml b/.github/workflows/preview-env-gc.yml index 1c0f67e0e9c016..6f277cdd3fa80d 100644 --- a/.github/workflows/preview-env-gc.yml +++ b/.github/workflows/preview-env-gc.yml @@ -11,7 +11,7 @@ jobs: name: "Find stale preview environments" runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root outputs: names: ${{ steps.set-matrix.outputs.names }} @@ -43,7 +43,7 @@ jobs: needs: [stale] runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root if: ${{ needs.stale.outputs.count > 0 }} strategy: diff --git a/.github/workflows/workspace-integration-tests.yml b/.github/workflows/workspace-integration-tests.yml index b659cd6ff40b14..5415b1869bf389 100644 --- a/.github/workflows/workspace-integration-tests.yml +++ b/.github/workflows/workspace-integration-tests.yml @@ -52,7 +52,7 @@ jobs: name: Configuration runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root outputs: name: ${{ steps.configuration.outputs.name }} @@ -126,7 +126,7 @@ jobs: needs: [configuration] runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root concurrency: group: ${{ needs.configuration.outputs.name }}-infrastructure @@ -159,7 +159,7 @@ jobs: needs: [configuration, infrastructure] runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 @@ -181,7 +181,7 @@ jobs: if: inputs.skip_delete != 'true' && always() runs-on: ubuntu-latest container: - image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 + image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 options: --user root steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4 diff --git a/.gitpod.yml b/.gitpod.yml index 69a5f47ac7cc16..2c1b2f8a3492ca 100644 --- a/.gitpod.yml +++ b/.gitpod.yml @@ -1,4 +1,4 @@ -image: eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:codex-validate-golangci-lint-v2-15-0-gha.394 +image: eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha.34488 workspaceLocation: gitpod/gitpod-ws.code-workspace checkoutLocation: gitpod ports: diff --git a/dev/image/README.md b/dev/image/README.md index 45dfa74daedadb..15d982b42be732 100644 --- a/dev/image/README.md +++ b/dev/image/README.md @@ -35,30 +35,3 @@ Use `--check` to verify that every active reference already points at an image: scripts/update-dev-environment-image.sh --check \ eu.gcr.io/gitpod-core-dev/dev/dev-environment:main-gha. ``` - -## Validating an image before a PR - -For toolchain upgrades, use a validation branch and manually dispatch -`branch-build.yml`. No PR or merge is needed: - -1. Run `validation_stage=baseline` with `leeway_no_cache=true` before changing image - references. This skips image publication and tests the current CI image. -2. Update both Dockerfiles and run `validation_stage=candidate-image` to build - and publish `dev/image:docker` with the current CI image. Use the published - branch image tag from this run; do not infer that publication succeeded from - the workflow's overall status alone. -3. Update active consumers using the full candidate image reference: - - ```shell - scripts/update-dev-environment-image.sh \ - eu.gcr.io/gitpod-dev-artifact/dev/dev-environment:-gha. - ``` - -4. Run `validation_stage=candidate` with `leeway_no_cache=true`. This skips rebuilding - the image and runs the normal Leeway build using the candidate image. The - validation step checks native Linux amd64 and the pinned tool versions. - Tests and lint remain enabled. - -Compare baseline and candidate failures and investigate upgrade-related -failures. Require the uncached Leeway build to pass before opening a PR. -The default `validation_stage=standard` retains the usual branch build.