marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-18 04:29:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

images: shared task base, code-last layers, no per-push rebuilds [skip ci]

Browse Source 
One base (Temurin 21 JDK, node/npm/tsc, php/composer, maven, sqlite, bwrap)
built only when its Dockerfile or dependencies change, plus a browser variant;
engine/search/VM images FROM base@sha256 with the code in the last layer; the
image workflow runs on dispatch, tags, Dockerfile or pin changes, with a build
cache. Executor NPROC bound relative to the current process count.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-05 20:40:13 +02:00
co-authored by Claude Fable 5.1
parent 7fb061fb69
commit 1b9d1ca85c
12 changed files with 671 additions and 127 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_search_image.py
+8 -8
View File
@@ -4,17 +4,17 @@ import yaml
def test_image_matches_runner_and_publishes_digest():
engine = Path("plane/Dockerfile.engine-task").read_text()
base = Path("plane/Dockerfile.base").read_text()
image = Path("plane/Dockerfile.search-task").read_text()
runner = "FROM ghcr.io/norandom/ax-task-runner:v0.3.1"
assert runner in engine and runner in image
for package in ("python3", "nodejs", "node-typescript", "php-cli", "sqlite3", "bubblewrap", "util-linux", "chromium"):
assert package in image
assert "FROM ghcr.io/norandom/ax-task-runner:v0.3.1" in base
for package in ("nodejs", "node-typescript", "php-cli", "sqlite3", "bubblewrap", "util-linux", "chromium"):
assert package in base
assert "python3 -m venv /venv" in base
assert image.rsplit("USER ", 1)[1].startswith("root\n")
assert "--uid 10001 --gid 10001 search" in image
assert "setpriv --version" in image
assert "17-jdk" in image and "--no-install-recommends" in image
assert "rm -rf /var/lib/apt/lists/" in image
assert "setpriv --version" in base
assert "21-jdk" in base and "--no-install-recommends" in base
assert "rm -rf /var/lib/apt/lists/" in base
workflow_text = Path(".github/workflows/engine-image.yml").read_text()
entries = yaml.safe_load(workflow_text)["jobs"]["image"]["strategy"]["matrix"]["include"]
assert {"package": "ousast-search-task", "dockerfile": "plane/Dockerfile.search-task"} in entries