63 lines
5.2 KiB
Markdown
63 lines
5.2 KiB
Markdown
# Task: Diagnose Go module download timeout during Docker build
|
|
|
|
## Identity
|
|
|
|
- Task ID: 20260815-go-mod-download-timeout-5b8e2c
|
|
- Mode: Feature
|
|
- Branch: main
|
|
- Worktree: D:\Datas\OthersProjects\NianAIGC
|
|
- Base commit: 9f40162c6be33797792a447fbda3843faf4621e5
|
|
- Owner: codex
|
|
- Status: Ready for Integration
|
|
|
|
## Scope
|
|
|
|
- Diagnose the Jenkins Docker build failure at `backend/Dockerfile:20` without changing application or deployment code.
|
|
- Verify whether `github.com/jackc/pgpassfile@v1.0.0` is invalid or whether the failure is limited to dependency-network access.
|
|
- Identify the repository-supported build path for China-hosted CI and provide a target-environment verification command.
|
|
- Make the standard Go Docker build use a China-reachable, integrity-checked module source by default while allowing CI to override it.
|
|
- Diagnose and fix the root Next.js image's `npm ci` registry timeout using a free mirror without changing dependency versions.
|
|
|
|
## Intent And Constraints
|
|
|
|
- Treat the supplied Jenkins log as the production-environment failure artifact and keep confirmed repository facts separate from target-network assumptions.
|
|
- Keep the implementation surgical: change only the standard Go Docker build configuration and its task record; Jenkins configuration is outside this repository.
|
|
- Do not weaken module integrity checks (`go.sum`/`GOSUMDB`) to work around a transport timeout.
|
|
- Keep the package lockfile authoritative; do not regenerate dependency versions merely to change registry routing.
|
|
|
|
## Outcome
|
|
|
|
- The failure occurs before compilation while the standard `backend/Dockerfile` runs `go mod download`; its build stage has no `GOPROXY` override and therefore attempted `https://proxy.golang.org`.
|
|
- The failing module is a valid indirect dependency of `github.com/jackc/pgx/v5@v5.5.5`, and both its module and checksum entries are present.
|
|
- A cold download of the failing module and then the complete module set succeeded through `https://goproxy.cn,direct`; the individual fetch completed in 0.18 seconds and the complete set in 1 second in the diagnostic environment.
|
|
- The repository already supplies `backend/Dockerfile.alpine` as the recommended China-CI build. It uses the Aliyun Alpine package mirror, `GOPROXY=https://goproxy.cn,direct`, and `GOSUMDB=sum.golang.google.cn`.
|
|
- Updated the standard `backend/Dockerfile` to use the same integrity-checked Go module endpoints by default and expose `GOPROXY`/`GOSUMDB` as build arguments for internal or global proxy overrides.
|
|
- The later Jenkins failure was a separate root-image issue: `npm ci` used the default npm registry and ran for 1769 seconds before npm reported `Exit handler never called`.
|
|
- Updated the root `Dockerfile` deps stage to use the free `https://registry.npmmirror.com` mirror by default, expose `NPM_REGISTRY` as a build argument, add bounded retries/timeouts, and skip audit/fund network calls. The package lockfile and dependency versions were not changed.
|
|
- An initial `--replace-registry-host=always` experiment was rejected because 16 lockfile entries point to Tencent's `/npm/...` tarball paths, which do not map to the npmmirror path layout; the retained command only sets `--registry` and leaves those explicit URLs intact.
|
|
- No application, deployment manifest, dependency, checksum, or CI file was changed.
|
|
|
|
## Verification
|
|
|
|
- Confirmed that the supplied `Dockerfile:20` location matches `backend/Dockerfile` and that `backend/Dockerfile.alpine` places its module download at line 17.
|
|
- Ran a fresh-cache `go mod download -x github.com/jackc/pgpassfile@v1.0.0` through `goproxy.cn`: exit 0.
|
|
- Ran a fresh-cache full `go mod download` through `goproxy.cn`: exit 0.
|
|
- Confirmed with `go mod graph` that `pgx/v5@v5.5.5` depends on `pgpassfile@v1.0.0`.
|
|
- Static Dockerfile contract check passed: both proxy arguments and their environment bindings precede `RUN go mod download`.
|
|
- `go test ./...` passed for all 19 Go packages, and `go vet ./...` passed.
|
|
- Re-ran a fresh-cache full module download using the new defaults: exit 0.
|
|
- Ran `go mod verify`: all downloaded modules verified.
|
|
- Ran a fresh-cache root `npm ci` with the Dockerfile's registry, retry, timeout, `--no-audit`, and `--no-fund` options: exit 0 in 15.29 seconds.
|
|
- Confirmed the root lockfile contains 241 `registry.npmjs.org` entries and 16 explicit Tencent mirror entries; no lockfile rewrite was performed.
|
|
- Could not run a full Docker image build because the local Docker Desktop Linux daemon is unavailable; the Jenkins-node rerun remains the authoritative end-to-end check.
|
|
|
|
## Follow-ups
|
|
|
|
- Re-run the existing standard Docker build on the Jenkins agent; `backend/Dockerfile.alpine` remains the more self-contained fallback when Alpine package downloads also need an Aliyun mirror.
|
|
- If that command still times out, test HTTPS egress/DNS from the Jenkins Docker build network to `mirrors.aliyun.com`, `goproxy.cn`, and `sum.golang.google.cn`, or use the organization's internal Go module proxy.
|
|
- Re-run the root image build on Jenkins with `docker build --progress=plain --no-cache -t <image> .`; if it still fails, capture the first failing package URL because the lockfile has explicit Tencent mirror URLs for a small subset of packages.
|
|
|
|
## Promotion Candidates
|
|
|
|
- None recorded.
|