VulCode

Concourse: our changes to an open source project

A container-based CI/CD system written in Go.

All contributions
Language
Go
GitHub stars
7,915
Project site
concourse-ci.org
1merged change
Merged on 5 October 2026.
Number 21 of the 64 GitHub projects with our changes, by stars. First is Zed (91,587).

The change merged into Concourse

Variables in a task file are interpolated before the file is parsed, so they also work in fields the parser checks first.

How we tested it

New tests feed a task file with cpu: ((container_cpu_limit)) and memory: ((container_mem_limit)) and the vars 512 and 5gb, then check that the limits end up as 512 and 5 GiB. A second case checks that a file that is still invalid after interpolation fails with an error naming it.

Go

Our projects in this technology, their screens and when we choose it.

The bug, the fix and the lesson

A summary of our Tech news write-up: what was broken, what we changed and what it means for our own work.

What was broken

A var in a numeric field broke the task

The task file was parsed before its vars were resolved. With memory: ((container_mem_limit)) the parser saw text where it expected a number, and the issue had been open since June 2020.

What we changed

Resolve first, parse after

Vars are resolved in the raw file contents and the result is parsed once. The error message also names the file.

What it taught us

Step order matters.

Variables must be substituted before the parser checks the file, or it rejects a valid configuration.

Other projects with our changes: Go

21 projects in this technology have our merged changes. The bar is the repository's stars, next to it the number of our changes. Each row leads to the project's page.

Questions about our changes to Concourse

Where these changes come from, who merged them and whether we can fix something in your library.

Using Concourse in your project?

If something in it does not work, we fix it at the source and leave a workaround until the release. We reply within an hour.