mosaicstack/stack
21
0
Fork 1
Code Issues 338 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

security: constrain dogfood delivery execution (#1487)

Browse Source
This commit is contained in:
marcie
2026-08-30 16:51:28 -05:00
parent 8356e72c1c
commit f194ccb8a3
13 changed files with 672 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/gateway.Dockerfile
+5 -3
View File
@@ -33,13 +33,15 @@ ENV NODE_ENV=production
# bash/curl/python3 are runtime dependencies of the provider-neutral Mosaic git
# wrappers. jq supports wrapper discovery for non-canonical Gitea hosts.
RUN apk add --no-cache bash curl git jq python3 \
&& ln -sf /bin/bash /usr/bin/bash \
&& mkdir -p /opt/mosaic/.workspaces \
&& chown -R node:node /opt/mosaic /app
ENV MOSAIC_ROOT=/opt/mosaic
# Dogfood agents use the same fail-closed credential helper and PR-create wrapper
# as fleet seats. Copy only that operation and its shared dependencies. Unrelated
# fleet operations, including merge and infrastructure tools, stay out of the image.
# Dogfood agents use the same fail-closed credential helper, queue guard, and
# PR-create wrapper as fleet seats. Copy only those operations and their shared
# dependencies. Merge and infrastructure tools stay out of the image.
COPY --from=builder /app/packages/mosaic/framework/tools/git/pr-create.sh /opt/mosaic/tools/git/pr-create.sh
COPY --from=builder /app/packages/mosaic/framework/tools/git/ci-queue-wait.sh /opt/mosaic/tools/git/ci-queue-wait.sh
COPY --from=builder /app/packages/mosaic/framework/tools/git/detect-platform.sh /opt/mosaic/tools/git/detect-platform.sh
COPY --from=builder /app/packages/mosaic/framework/tools/git/repo-decl.sh /opt/mosaic/tools/git/repo-decl.sh
COPY --from=builder /app/packages/mosaic/framework/tools/git/git-credential-mosaic /opt/mosaic/tools/git/git-credential-mosaic