From 2564b56053dd7496fe65f6e242994adf8bd5ec6d Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Tue, 11 Aug 2026 18:18:42 -0500 Subject: [PATCH] ci: provision Pi runtime 0.84.1 in the test step (Invariant R) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit invariant_r_unittest.py (landing with the lease-remediation stack, PR #1109) hard-requires an installed `pi` binary pinned to the measured version: it boots Pi's real tool registry and proves the broker's read-only carve-out resolves to real, unshadowed builtins. Absent runtime fails loud by design — so CI must provide it. Install @earendil-works/pi-coding-agent@0.84.1 (the canonical Pi; @mariozechner/* is embedded-legacy) at step level in the test step. Step-level rather than baked into Dockerfile.ci because ci-image publishes are currently blocked on registry UNAUTHORIZED; baking it in is the follow-up once registry auth is fixed, at which point this line degrades to a fast no-op guard like the openssl line above it. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01Dtdjx4Gxude9fwyLezCrhh --- .woodpecker/ci.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.woodpecker/ci.yml b/.woodpecker/ci.yml index c02f3f1c..d0ce1c1f 100644 --- a/.woodpecker/ci.yml +++ b/.woodpecker/ci.yml @@ -109,6 +109,16 @@ steps: # `apk add` guarantees openssl is present on PR pipelines too (and is a # fast no-op once the rebuilt image already ships it). - apk add --no-cache openssl + # Pi runtime (Invariant R): invariant_r_unittest.py hard-requires an + # installed `pi` binary at exactly this measured version — the test + # boots Pi's real tool registry to prove the read-only carve-out + # resolves to real, unshadowed builtins, and fails loud (by design) + # when the runtime is absent or drifts. The canonical Pi is + # @earendil-works/pi-coding-agent@0.84.1 exactly (@mariozechner/* is + # embedded-legacy). Step-level install because ci-base image publishes + # are currently blocked on registry auth; fold into Dockerfile.ci once + # that is fixed, keeping this as a fast no-op guard. + - npm install -g @earendil-works/pi-coding-agent@0.84.1 # postgresql-client (pg_isready) is baked into ci-base. # Wait up to 60s for CI postgres to be ready; fail fast if it never comes up. - |