mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Fable 5.1
1b9d1ca85c
One base (Temurin 21 JDK, node/npm/tsc, php/composer, maven, sqlite, bwrap) built only when its Dockerfile or dependencies change, plus a browser variant; engine/search/VM images FROM base@sha256 with the code in the last layer; the image workflow runs on dispatch, tags, Dockerfile or pin changes, with a build cache. Executor NPROC bound relative to the current process count. Co-Authored-By: Claude Fable 5.1 <[email protected]>
20 lines
828 B
Docker
20 lines
828 B
Docker
# syntax=docker/dockerfile:1
|
|
# Supply digests from plane/task-base.digest; deliberately no floating fallback.
|
|
ARG TASK_BROWSER_TAG=base-unpublished-browser
|
|
ARG TASK_BROWSER_DIGEST
|
|
FROM ghcr.io/norandom/ousast-task-base:${TASK_BROWSER_TAG}@${TASK_BROWSER_DIGEST}
|
|
USER root
|
|
# Dedicated identity for artefacts, apps and Chromium; the verifier keeps root.
|
|
RUN groupadd --gid 10001 search \
|
|
&& useradd --create-home --uid 10001 --gid 10001 search
|
|
# Upstream's public CPython signing fingerprint trips the credential guard.
|
|
ENV GPG_KEY=
|
|
WORKDIR /app
|
|
COPY pyproject.toml README.md LICENSE ./
|
|
COPY src ./src
|
|
RUN --mount=type=cache,target=/root/.cache/pip \
|
|
/venv/bin/pip install --no-deps --no-cache-dir .
|
|
# Entrypoints and verifier-owned recipes/oracles are included in src.
|
|
USER root
|
|
# Preserve the AX runner ENTRYPOINT and CMD.
|