ci-images

Curated base images for Forgejo Actions jobs — the CodeBuild approach (inspiration: [aws/aws-codebuild-docker-images]): take an OS, install a trimmed set of runtimes at pinned versions plus a curated tool belt, bake it all into the image, and let the workflow (our equivalent of the buildspec) just use it. Fat on purpose; everything in it is there because someone said so.

ubuntu/base is the blessed image. alpine/base and fedora/base exist as minimal experimental variants — not published by default.

Why catthehacker/ubuntu is still the FROM base

This is the only repo allowed to use catthehacker/* as a base image. act-24.04 gives us the runner plumbing (sudo, locales, git, node for JS actions, sane defaults) for free; everything job-relevant is curated by us on top. UBUNTU_BASE is digest-pinned in versions.env — Renovate manages base bumps deliberately instead of by drift.

Layout

versions.env            pins — single source of truth (bump = one line)
ubuntu/base/            blessed image: Dockerfile, runtimes.yml, ci-image-info
alpine/base/            experimental minimal
fedora/base/            experimental minimal
build.sh                build (+trivy gate, +push to Harbor & ECR Public)
.forgejo/workflows/     CI: matrix build of every variant (build + scan, weekly)

Baked into ubuntu/base

Runtimes (pinned): python 3.12/3.13/3.14 all available (python3 → 3.14; 3.12 = distro, 3.13/3.14 = deadsnakes), node 24 LTS (+corepack, typescript as global fallback), go. Exact tarballs (node, go) are sha256-verified at build.

Tools: awscli v2, tofu (OpenTofu), pulumi (CLI only — plugins are per-project), ansible-core (own venv), kubectl, helm, yq, jq, docker CLI + buildx + compose (clients only — DinD sidecars live in the runner config). linux/amd64 only for now.

runtimes.yml is the human-readable "preinstalled software" table. Inside the image: ci-image-info, or read /usr/share/ci-image/MANIFEST.

Build & publish

./build.sh ubuntu                 # build + trivy CRITICAL gate (if trivy present)
./build.sh ubuntu --no-scan       # skip the gate
./build.sh ubuntu --push          # + push to HARBOR_REGISTRY / ECR_PUBLIC_REGISTRY

Tags: <os-minor>-YYYY.MM plus latest (e.g. ubuntu:24.04-2026.11), published to Harbor at oci.ews-network.net/ews-network/ci-images/{ubuntu,alpine,fedora} — CI logs in with the org-level HARBOR_USERNAME/HARBOR_PASSWORD secrets. ECR_PUBLIC_REGISTRY in versions.env remains a placeholder until an alias exists; build.sh skips it until then.

In CI, .forgejo/workflows/build.yml matrix-builds every variant (build + trivy scan only — publishing is deliberately not wired up yet).

Bumping a pin

1. edit the one line in versions.env
2. ./build.sh ubuntu — layers are ordered stable→volatile, so bumping a tool CLI only rebuilds the tail; bumping node rebuilds from the node layer down
3. push, then let Renovate bump the digest in the runner config repo

Roadmap

• OS major bumps (ubuntu 24.04, alpine 3.24, fedora 44) are deliberate digest bumps in versions.env. When fedora rebases, re-check the python pins: distro packages carry the distro's OpenSSL patches — pristine CPython may not compile (this bit 3.12 on fedora 45 / OpenSSL 3.5, which is why fedora uses distro pythons).
• arm64: deliberately deferred (amd64-only runners today); the dormant arm64 pool values live in leslie-forgejo-ci/values-arm.yaml.
• Runner labels: catthehacker is reachable only via the bootstrap label, used exclusively by this repo's build workflow. ubuntu-latest is repurposed to our ubuntu image (existing org workflows upgrade transparently); new workflows use ci-ubuntu / ci-alpine / ci-fedora.

License

Apache-2.0