From e34b5b3904abd2e0f48de551599741c3c7bb8788 Mon Sep 17 00:00:00 2001
From: Yiming Luo <10097700+lym953@users.noreply.github.com>
Date: Mon, 10 Aug 2026 16:00:38 -0400
Subject: [PATCH 1/2] chore(ci): allow rebuilding and re-signing the CI image
 on demand

---
 .gitlab-ci.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 2fe746831..4618e27a7 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -8,6 +8,9 @@ variables:
   PIPELINE_LAYER_SUFFIX:
     description: "Suffix to be appended to the layer name (default empty)."
     value: ""
+  REBUILD_CI_IMAGE:
+    description: "Set to 'true' to rebuild and re-sign the CI image without a .gitlab/Dockerfile change."
+    value: ""
 
 stages:
   - prepare
@@ -19,6 +22,10 @@ ci image:
   image: registry.ddbuild.io/images/docker:20.10
   tags: ["arch:arm64"]
   rules:
+    # Signatures live on the image digest, so re-signing means rebuilding and
+    # pushing. Without this knob that requires a no-op Dockerfile commit.
+    - if: '$REBUILD_CI_IMAGE == "true"'
+      when: on_success
     - if: '$CI_COMMIT_BRANCH == "main" && $CI_PIPELINE_SOURCE == "push"'
       changes:
         - .gitlab/Dockerfile

From caede8b396bad032fb61181e15334db62a204799 Mon Sep 17 00:00:00 2001
From: Yiming Luo <10097700+lym953@users.noreply.github.com>
Date: Mon, 10 Aug 2026 21:25:05 -0400
Subject: [PATCH 2/2] chore(ci): trigger a rebuild and re-sign of the CI image

The ci image job only runs when a main push changes .gitlab/Dockerfile.
Removing the trailing blank lines is a no-op change that makes that rule
match, so the image is rebuilt, signed with ddsign, and pushed as :latest.
---
 .gitlab-ci.yml     | 7 -------
 .gitlab/Dockerfile | 2 --
 2 files changed, 9 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 4618e27a7..2fe746831 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -8,9 +8,6 @@ variables:
   PIPELINE_LAYER_SUFFIX:
     description: "Suffix to be appended to the layer name (default empty)."
     value: ""
-  REBUILD_CI_IMAGE:
-    description: "Set to 'true' to rebuild and re-sign the CI image without a .gitlab/Dockerfile change."
-    value: ""
 
 stages:
   - prepare
@@ -22,10 +19,6 @@ ci image:
   image: registry.ddbuild.io/images/docker:20.10
   tags: ["arch:arm64"]
   rules:
-    # Signatures live on the image digest, so re-signing means rebuilding and
-    # pushing. Without this knob that requires a no-op Dockerfile commit.
-    - if: '$REBUILD_CI_IMAGE == "true"'
-      when: on_success
     - if: '$CI_COMMIT_BRANCH == "main" && $CI_PIPELINE_SOURCE == "push"'
       changes:
         - .gitlab/Dockerfile
diff --git a/.gitlab/Dockerfile b/.gitlab/Dockerfile
index 8003831f9..3daa4a5fb 100644
--- a/.gitlab/Dockerfile
+++ b/.gitlab/Dockerfile
@@ -26,5 +26,3 @@ ENV PATH=$PATH:/root/.cargo/bin/
 ENV LIBCLANG_PATH=/usr/lib/x86_64-linux-gnu
 
 RUN rustup component add rust-src --toolchain stable
-
-