mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
Marius CiepluchandClaude Fable 5.1
86e7a61f83
ai-service-plane task 3, Requirements 4.1-4.4 (with 2.2 and 2.3 honoured by the exit-code contract): - src/openultrasast/plane/runner.py: the ax-task-runner entrypoint. Reads the Task from AX_TASK_YAML and the bound Workspaces from AX_WORKSPACES_YAML (task-1 loaders), serves /healthz and /readyz on port 80 (AX_RUNNER_PORT; 0 picks a free port, AX_RUNNER_HTTP=0 disables it for unit tests), materialises each workspace at its bound path (spec.files verbatim; spec.git at <path>/<name>, exported from the OUSAST_CASE_CACHE checkout whose origin matches, else a shallow clone at the pin; a repo already present on a resumed volume is kept) and only then answers 200 on /readyz. Runs spec.command by importing openultrasast.plane.tasks.<name> with the remaining elements as argv; sets OUSAST_WORKSPACE_DIR from the first binding when the Task's env leaves it unset. A crash writes summary.json with status failed and the traceback. When OUSAST_ARTIFACT_URL is set, the whole OUSAST_OUTPUT_DIR is POSTed as an uncompressed tar (Content-Type application/x-tar, X-Ousast-Task, X-Ousast-Run) with three attempts and backoff; a failed delivery rewrites summary.json to failed and exits 2. Exit codes: done 0, failed 2, unfinished 3. - plane/Dockerfile.runner: python:3.12-slim + git, `pip install .` (no extras), a shell wrapper at /usr/local/bin/ax-task-runner exec'ing the module; built and loaded into kind by ops/ax/up.sh, not by the tests. - tests/test_plane_runner.py (+ tests/plane_stub_task.py registered as the task module): env contract on a files workspace, readyz 503 then 200, delivery to a local receiver with the headers and tar checked, delivery failure -> failed and exit 2 after three attempts, crash -> failed with traceback, exit codes per status, case-cache export at the pin, shallow-clone fallback, resume keeps the checkout. - model/audit.py: SPEC_OWNED row for plane.runner; module-audit measurement regenerated (122 modules, no orphans, note kept). Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
33 lines
1.5 KiB
Docker
33 lines
1.5 KiB
Docker
# The ax task-runner image for this project (ai-service-plane Requirement 4.2).
|
|
#
|
|
# ax's default runner image is gcr.io/ax-substrate/ate-images/ax-task-runner@sha256:3a0dea6a... (Python 3.12,
|
|
# git, curl, ax's Go runner as PID 1). This image keeps the same base and the same contract -- PID 1 is
|
|
# /usr/local/bin/ax-task-runner, fed AX_TASK_YAML / AX_WORKSPACES_YAML, serving /healthz and /readyz on port 80 --
|
|
# but the runner is this package's `openultrasast.plane.runner`, so a task's spec.command names a module under
|
|
# `openultrasast.plane.tasks` and the output directory is delivered to the reconciler at exit.
|
|
#
|
|
# Build from the repository root (the package is the context):
|
|
# docker build -f plane/Dockerfile.runner -t openultrasast-runner:dev .
|
|
# `ops/ax/up.sh` builds it and loads it into kind; nothing here is exercised by the unit tests.
|
|
|
|
FROM python:3.12-slim
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends git ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /opt/openultrasast
|
|
COPY pyproject.toml README.md ./
|
|
COPY src ./src
|
|
# Core install only: PyYAML for the manifests, no extras (no HarnessX, no tree-sitter).
|
|
RUN pip install --no-cache-dir . \
|
|
&& printf '#!/bin/sh\nexec python -m openultrasast.plane.runner "$@"\n' > /usr/local/bin/ax-task-runner \
|
|
&& chmod 0755 /usr/local/bin/ax-task-runner
|
|
|
|
# ax mounts the persistent volume here; it is also the command's working directory in ax's own runner.
|
|
RUN mkdir -p /workspace
|
|
WORKDIR /workspace
|
|
|
|
EXPOSE 80
|
|
ENTRYPOINT ["/usr/local/bin/ax-task-runner"]
|