mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-01 14:34:42 +01:00
Garry Tan
5885157a90
* fix(cso): unblock native runtime qualification (v1.91.28.0) Fixes the qualify-native failures from main run 37345275258: - re-bind promotion evidence for staged runtimes in cold-start tests - give npm a distinct empty global config (npm 11 refuses double-loading) - export /archives and /work through tmpfs-backed local volumes (docker cp cannot read tmpfs), with exec on /work - keep the offline seed process alive - end broker/forwarder tunnels explicitly under Bun - batch gem fetch per platform - wait for run-app's source copy before Rails db:prepare and tests - fix the Python cold fixture and add bin/rails to the Rails cold fixture * fix(cso): bounded 900 s ceiling for preparation dependency commands - PREPARATION_COMMAND_TIMEOUT_MS (900 s) applies only to acquisition and offline dependency commands; everything else keeps COMMAND_TIMEOUT_MS (300 s), and both are cut to the journey deadline - prepared-tree export refusals fail with PREPARED_EXPORT_REJECTED and the helper's fixed reason or errno, never target paths, with no retry - free tests pin the ceiling, its callers, and the rejection parser * Take v1.91.29.0 (1.91.28.0 is claimed by #3032 and #3033) * cso-diff-mode accepts every correct name for the unauthenticated webhook finding
13 lines
575 B
Docker
13 lines
575 B
Docker
# BASE_IMAGE must be a reviewed, provenance-verified node image@sha256 digest.
|
|
ARG BASE_IMAGE
|
|
FROM ${BASE_IMAGE}
|
|
RUN mkdir -p /opt/cso /work /metadata /archives /source /policy /fixtures && touch /opt/cso/empty-config /opt/cso/empty-globalconfig \
|
|
&& chown 10001:10001 /work /metadata /archives
|
|
COPY --chmod=0555 entrypoint /opt/cso/entrypoint
|
|
COPY --chmod=0555 run-app /opt/cso/run-app
|
|
COPY --chmod=0555 gstack-cso-verifier /opt/cso/verifier
|
|
COPY --chmod=0555 gstack-cso-preparation /opt/cso/preparation
|
|
USER 10001:10001
|
|
WORKDIR /work
|
|
ENTRYPOINT ["/opt/cso/entrypoint"]
|