From dead7f721d8844f92b30c5a65031bf4bf5dc98fa Mon Sep 17 00:00:00 2001
From: "octo-sts[bot]" <157150467+octo-sts@users.noreply.github.com>
Date: Sat, 23 Aug 2025 07:32:55 +0000
Subject: [PATCH 1/2] gitaly-18.3: updated

---
 gitaly-18.3.yaml | 121 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 121 insertions(+)
 create mode 100644 gitaly-18.3.yaml

diff --git a/gitaly-18.3.yaml b/gitaly-18.3.yaml
new file mode 100644
index 000000000000..1de01f0a77e7
--- /dev/null
+++ b/gitaly-18.3.yaml
@@ -0,0 +1,121 @@
+package:
+  name: gitaly-18.3
+  version: "18.3.0"
+  epoch: 0 # CVE-2025-47907
+  description:
+  copyright:
+    - license: MIT
+  dependencies:
+    provides:
+      - gitaly=${{package.full-version}}
+    runtime:
+      - gitaly-backup-${{vars.major-minor-version}}
+
+var-transforms:
+  - from: ${{package.version}}
+    match: ^(\d+\.\d+)\.\d+$
+    replace: "$1"
+    to: major-minor-version
+
+environment:
+  contents:
+    packages:
+      - build-base
+      - busybox
+      - curl-dev
+      - expat-dev
+      - openssl-dev
+      - pcre2-dev
+      - wolfi-base
+      - zlib-dev
+  environment:
+    WITH_BUNDLED_GIT: YesPlease
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://gitlab.com/gitlab-org/gitaly.git
+      tag: v${{package.version}}
+      expected-commit: 3e6926ff6ed2dd5ee8a11b9bd42174f29a71cea3
+
+  - runs: |
+      make install DESTDIR="${{targets.destdir}}" PREFIX=/usr
+
+  - uses: strip
+
+subpackages:
+  # Leave at the top so that links are created for all binaries in package
+  - name: gitaly-compat-${{vars.major-minor-version}}
+    description: "Compatibility package to place binaries in the location expected by upstream Dockerfile"
+    dependencies:
+      provides:
+        - gitaly-compat=${{package.full-version}}
+    pipeline:
+      - runs: |
+          mkdir -p "${{targets.contextdir}}"/usr/local/bin
+          cd ${{targets.destdir}}/usr/bin
+          for binary in *; do
+            ln -sf /usr/bin/$binary ${{targets.contextdir}}/usr/local/bin/$binary
+          done
+
+  - name: gitaly-git-${{vars.major-minor-version}}
+    description: Bundled Git for Gitaly
+    dependencies:
+      provides:
+        - gitaly-git=${{vars.major-minor-version}}
+    pipeline:
+      - runs: |
+          mkdir -p ${{targets.contextdir}}/usr/bin
+          mv ${{targets.destdir}}/usr/bin/gitaly-git-* ${{targets.contextdir}}/usr/bin
+
+  - name: gitaly-backup-${{vars.major-minor-version}}
+    description: Git repository backup tool
+    dependencies:
+      provides:
+        - gitaly-backup=${{vars.major-minor-version}}
+    pipeline:
+      - runs: |
+          mkdir -p ${{targets.contextdir}}/usr/bin
+          mv ${{targets.destdir}}/usr/bin/gitaly-backup ${{targets.contextdir}}/usr/bin/
+
+  - name: gitaly-init-cgroups-${{vars.major-minor-version}}
+    # https://gitlab.com/gitlab-org/build/CNG/-/blob/master/gitaly-init-cgroups/Dockerfile
+    description: gitaly-init-cgroups
+    dependencies:
+      provides:
+        - gitaly-init-cgroups=${{package.full-version}}
+    pipeline:
+      - uses: go/build
+        with:
+          packages: .
+          modroot: ./tools/gitaly-init-cgroups/
+          output: setup_cgroups
+
+  - name: gitaly-init-cgroups-compat-${{vars.major-minor-version}}
+    description: "Compatibility package to place binaries in the location expected by upstream Dockerfile"
+    dependencies:
+      provides:
+        - gitaly-init-cgroups-compat=${{package.full-version}}
+    pipeline:
+      - runs: |
+          mkdir -p "${{targets.contextdir}}"/
+          ln -sf /usr/bin/setup_cgroups "${{targets.contextdir}}"/setup_cgroups
+
+update:
+  enabled: true
+  git:
+    strip-prefix: v
+    tag-filter-prefix: v18.3
+
+test:
+  pipeline:
+    - runs: |
+        gitaly -v | grep "${{package.version}}"
+        gitaly-blackbox -version | grep "${{package.version}}"
+        gitaly-backup -v | grep "${{package.version}}"
+        gitaly --version
+        gitaly --help
+        gitaly-blackbox --version
+        gitaly-blackbox --help
+        praefect --version
+        praefect --help

From 1bb32e591f31db163dbae2b2364ac8d1d2c44973 Mon Sep 17 00:00:00 2001
From: Daniel Watkins <daniel.watkins@chainguard.dev>
Date: Mon, 25 Aug 2025 08:26:48 -0400
Subject: [PATCH 2/2] gitaly-18.3: update expected-commit

---
 gitaly-18.3.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gitaly-18.3.yaml b/gitaly-18.3.yaml
index 1de01f0a77e7..abb9a3dcd35e 100644
--- a/gitaly-18.3.yaml
+++ b/gitaly-18.3.yaml
@@ -36,7 +36,7 @@ pipeline:
     with:
       repository: https://gitlab.com/gitlab-org/gitaly.git
       tag: v${{package.version}}
-      expected-commit: 3e6926ff6ed2dd5ee8a11b9bd42174f29a71cea3
+      expected-commit: cf69fd6c2c8e0af90cfa010cacd12f00f61e1cf6
 
   - runs: |
       make install DESTDIR="${{targets.destdir}}" PREFIX=/usr