fix(docker): ship git in the image and document the GitLab entrypoint override (#1109)

Author: BryanFRD

Dockerfile

@@ -25,7 +25,10 @@ RUN mkdir -p benches && echo 'fn main() {}' > benches/ferrflow_benchmarks.rs \
 
 # Runtime stage
 FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
-RUN apk add --no-cache ca-certificates
+RUN apk add --no-cache ca-certificates git \
+    && git config --system --add safe.directory '*' \
+    && git config --system user.name FerrFlow \
+    && git config --system user.email bot@ferrflow.com
 RUN adduser -D -u 1000 ferrflow
 COPY --from=builder /app/target/release/ferrflow /usr/local/bin/ferrflow
 USER ferrflow

Dockerfile.release

@@ -1,5 +1,8 @@
 FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
-RUN apk upgrade --no-cache && apk add --no-cache ca-certificates
+RUN apk upgrade --no-cache && apk add --no-cache ca-certificates git \
+    && git config --system --add safe.directory '*' \
+    && git config --system user.name FerrFlow \
+    && git config --system user.email bot@ferrflow.com
 RUN adduser -D -u 1000 ferrflow
 ARG TARGETARCH
 COPY ferrflow-${TARGETARCH} /usr/local/bin/ferrflow

README.md

@@ -73,8 +73,11 @@ npm install -D ferrflow
 docker run --rm -v "$PWD:/repo" ghcr.io/ferrlabs/ferrflow:latest check
 ```
 
-The image runs as a non-root user (`ferrflow`, uid 1000) and works on `/repo`.
-If your checkout is owned by a different uid, pass your own:
+The image runs as a non-root user (`ferrflow`, uid 1000) and works on `/repo`. It ships `git`,
+trusts the checkout whoever owns it, and signs release commits as `FerrFlow <bot@ferrflow.com>`
+unless `GIT_AUTHOR_NAME` / `GIT_AUTHOR_EMAIL` or the repository's own `user.*` config say otherwise.
+FerrFlow still needs write access to the files it bumps, so if your checkout is owned by a different
+uid, pass your own:
 
 ```bash
 docker run --rm -u "$(id -u):$(id -g)" -v "$PWD:/repo" ghcr.io/ferrlabs/ferrflow:latest check

docs/site/docs-en/ci/gitlab-ci.md

@@ -9,7 +9,9 @@ The official FerrFlow Docker image ships the binary and can be used directly as
 
 ```yaml title=".gitlab-ci.yml"
 release:
-  image: ghcr.io/ferrlabs/ferrflow:latest
+  image:
+    name: ghcr.io/ferrlabs/ferrflow:latest
+    entrypoint: [""]
   stage: release
   script:
     - ferrflow release
@@ -20,14 +22,20 @@ release:
       when: on_success
 ```
 
+The image's entrypoint is `ferrflow`, so `docker run ghcr.io/ferrlabs/ferrflow:latest check` works as is. GitLab runs a job's `script` through a shell instead, which is why every example here resets it with `entrypoint: [""]`. Without that line the job fails with `unrecognized subcommand 'sh'`.
+
+The image ships `git`, trusts the checkout whatever user cloned it, and signs release commits as `FerrFlow <bot@ferrflow.com>`. To sign them as the person who triggered the pipeline instead, set `GIT_AUTHOR_NAME: $GITLAB_USER_NAME` and `GIT_AUTHOR_EMAIL: $GITLAB_USER_EMAIL` in the job variables.
+
 <aside class="ferr-aside ferr-aside--warning"><div class="ferr-aside__body"><p>Make sure your CI runner clones with full history. Add <code>GIT_DEPTH: 0</code> to the job variables to disable shallow cloning.</p>
 </div></aside>
 
 ## Full history
 
 ```yaml title=".gitlab-ci.yml"
 release:
-  image: ghcr.io/ferrlabs/ferrflow:latest
+  image:
+    name: ghcr.io/ferrlabs/ferrflow:latest
+    entrypoint: [""]
   variables:
     GIT_DEPTH: 0 # full history: required for tag scanning
     GITLAB_TOKEN: $CI_JOB_TOKEN
@@ -43,7 +51,9 @@ If `CI_JOB_TOKEN` doesn't have permission to push tags, create a project deploy
 
 ```yaml title=".gitlab-ci.yml"
 release:
-  image: ghcr.io/ferrlabs/ferrflow:latest
+  image:
+    name: ghcr.io/ferrlabs/ferrflow:latest
+    entrypoint: [""]
   variables:
     GIT_DEPTH: 0
     GITLAB_TOKEN: $FERRFLOW_DEPLOY_TOKEN # CI variable with write_repository access
@@ -59,7 +69,9 @@ FerrFlow can post a comment on every merge request showing what versions will be
 
 ```yaml title=".gitlab-ci.yml"
 ferrflow-preview:
-  image: ghcr.io/ferrlabs/ferrflow:latest
+  image:
+    name: ghcr.io/ferrlabs/ferrflow:latest
+    entrypoint: [""]
   stage: test
   variables:
     GIT_DEPTH: 0

docs/site/docs-fr/ci/gitlab-ci.md

@@ -9,7 +9,9 @@ L'image Docker officielle FerrFlow embarque le binaire et peut être utilisée d
 
 ```yaml
 release:
-  image: ghcr.io/ferrlabs/ferrflow:latest
+  image:
+    name: ghcr.io/ferrlabs/ferrflow:latest
+    entrypoint: [""]
   stage: release
   script:
     - ferrflow release
@@ -20,14 +22,20 @@ release:
       when: on_success
 ```
 
+Le point d'entrée de l'image est `ferrflow`, donc `docker run ghcr.io/ferrlabs/ferrflow:latest check` fonctionne tel quel. GitLab, lui, exécute le `script` d'un job dans un shell : c'est pourquoi chaque exemple ici le réinitialise avec `entrypoint: [""]`. Sans cette ligne, le job échoue avec `unrecognized subcommand 'sh'`.
+
+L'image embarque `git`, fait confiance au dépôt quel que soit l'utilisateur qui l'a cloné, et signe les commits de release `FerrFlow <bot@ferrflow.com>`. Pour les signer au nom de la personne qui a déclenché le pipeline, définissez `GIT_AUTHOR_NAME: $GITLAB_USER_NAME` et `GIT_AUTHOR_EMAIL: $GITLAB_USER_EMAIL` dans les variables du job.
+
 <aside class="ferr-aside ferr-aside--warning"><div class="ferr-aside__body"><p>Assurez-vous que votre runner CI clone avec l&#39;historique complet. Ajoutez <code>GIT_DEPTH: 0</code> aux variables du job pour désactiver le clonage superficiel.</p>
 </div></aside>
 
 ## Historique complet
 
 ```yaml
 release:
-  image: ghcr.io/ferrlabs/ferrflow:latest
+  image:
+    name: ghcr.io/ferrlabs/ferrflow:latest
+    entrypoint: [""]
   variables:
     GIT_DEPTH: 0 # historique complet : requis pour le scan des tags
     GITLAB_TOKEN: $CI_JOB_TOKEN
@@ -43,7 +51,9 @@ Si `CI_JOB_TOKEN` n'a pas les permissions pour pousser des tags, créez un deplo
 
 ```yaml
 release:
-  image: ghcr.io/ferrlabs/ferrflow:latest
+  image:
+    name: ghcr.io/ferrlabs/ferrflow:latest
+    entrypoint: [""]
   variables:
     GIT_DEPTH: 0
     GITLAB_TOKEN: $FERRFLOW_DEPLOY_TOKEN # variable CI avec accès write_repository
@@ -59,7 +69,9 @@ FerrFlow peut poster un commentaire sur chaque merge request montrant quelles ve
 
 ```yaml title=".gitlab-ci.yml"
 ferrflow-preview:
-  image: ghcr.io/ferrlabs/ferrflow:latest
+  image:
+    name: ghcr.io/ferrlabs/ferrflow:latest
+    entrypoint: [""]
   stage: test
   variables:
     GIT_DEPTH: 0