ef43cc3be8
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
Make the wake digest/HMAC suite RUN and PASS in the real Woodpecker CI
runner (Alpine/musl, root), then hard-require the HMAC legs in CI.
Root cause of the runner-only D1/D4/D5/D6 failures (a masked-local run
passed, so it was runner-specific): a TOOLCHAIN divergence, not locale or
root. digest.sh's _scrub_ctrl used GNU-sed `\xNN` hex-escape byte matching.
The CI runner is node:24-alpine, whose sed is BusyBox — BusyBox sed REJECTS
a `\xNN` character range ("bad regex ... Invalid character range"), aborting
the whole scrub sed and silently VOIDING the scrub. Every scrubbed value
collapsed to empty, cascading into D1 (blank locators), D4 (no scrub/redact,
SHA blanked), D5 (blank agent prefix), D6 (blank [digest] class). Confirmed
by reproducing the exact 9-assertion failure in the ci-base image as root.
Fix (at the correct layer — a wake digest must render identically on any
runner):
- digest.sh _scrub_ctrl: patterns are now LITERAL bytes (printf %b), matching
byte-identically under GNU sed (glibc dev) and BusyBox sed (Alpine CI).
Verified identical output on both. Contract preserved: two-tier trust,
exit-4 hard-locator FAIL-LOUD, secret-scrub, and 40-hex SHA preservation
all unchanged — deterministic, not weakened.
- test-wake-digest-hmac.sh D4: replaced PCRE `grep -qP` (BusyBox grep has no
-P; the `&&` silently skipped the check in CI) with portable literal-byte
`grep -E` ranges (two disjoint bidi/zero-width ranges, excluding legit
U+2014 em-dash).
CI enablement:
- Dockerfile.ci + .woodpecker/ci.yml test step: add openssl (the non-circular
HMAC signer) so H1/H2, beacon B12, install I8 can run. The apk add in the
test step covers PR pipelines before ci-base rebuilds.
- Flip the 3 openssl skip-guards (digest whole-file, beacon B12, install I8)
to HARD-REQUIRE openssl when CI is set (Woodpecker CI=woodpecker) and FAIL
loud if absent; KEEP the skip for openssl-less local dev.
- manifest.txt: wake 0.6.2 -> 0.6.3 (digest.sh scrub portability; precedent).
Red-first verified in the ci-base container (root): D4 catches a broken
redaction, H1 catches a tamper that doesn't break the MAC, B12/I8 catch a
corrupted signer.
Closes #912
Part of #892
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb
49 lines
2.6 KiB
Docker
49 lines
2.6 KiB
Docker
# Pre-baked CI base image for Woodpecker pipelines.
|
|
#
|
|
# Purpose: eliminate the cold `pnpm install` that dominates every pipeline
|
|
# (~731s median). This image ships the native toolchain (no per-run `apk add`)
|
|
# AND a warm, content-addressable pnpm store with the dependency-tree tarballs
|
|
# already fetched at build time. `pnpm fetch` only populates the store from the
|
|
# lockfile — it does NOT run the native node-gyp builds (better-sqlite3,
|
|
# node-pty, sqlite3, canvas, sharp); those still compile at `pnpm install`,
|
|
# which is exactly why the musl toolchain stays baked into this image. A
|
|
# pipeline `pnpm install --frozen-lockfile --prefer-offline` then resolves
|
|
# tarballs from local hard-links (no network) and compiles natives against the
|
|
# already-present toolchain, in tens of seconds instead of ~731s.
|
|
#
|
|
# Rebuilt only when `pnpm-lock.yaml` or this Dockerfile change
|
|
# (see .woodpecker/ci-image.yml).
|
|
#
|
|
# Node version is pinned to 24 (Active LTS). This is the follow-up bump from
|
|
# node:22 — sequenced AFTER the CI cache work landed so the runtime change
|
|
# carries zero cache variables. node:26 stays held until it reaches LTS
|
|
# (Oct 2026); the Current line risks native-module (node-gyp) breakage on a
|
|
# runner that compiles better-sqlite3 / canvas / sharp / node-pty from source.
|
|
FROM node:24-alpine
|
|
|
|
# Native toolchain required to compile node-gyp deps on musl, plus the
|
|
# postgresql-client used by the test step's pg_isready readiness probe. `bash`,
|
|
# `git`, and `jq` are baked here too — framework shell tests and the shipped
|
|
# Codex review wrappers require them without per-run installation in ci.yml.
|
|
# `openssl` (#912) is the non-circular HMAC signer for the wake trust layer:
|
|
# the digest H1/H2, beacon B12, and install I8 legs hard-require it in CI so the
|
|
# §4 G6 evidence comes from an actually-run HMAC leg, not a skipped one.
|
|
RUN apk add --no-cache python3 make g++ postgresql-client bash git jq openssl
|
|
|
|
# Pin pnpm to the repo's packageManager version via corepack.
|
|
RUN corepack enable && corepack prepare pnpm@10.6.2 --activate
|
|
|
|
WORKDIR /app
|
|
|
|
# Pin the store location so the pipeline can point `store-dir` at the same path.
|
|
ENV PNPM_HOME=/root/.local/share/pnpm
|
|
RUN pnpm config set store-dir /root/.local/share/pnpm/store
|
|
|
|
# Warm the store. `pnpm fetch` populates the content-addressable store with the
|
|
# dependency tarballs directly from the lockfile (no package.json / workspace
|
|
# needed), so a baked store stays valid until the lockfile changes. Note:
|
|
# `fetch` does NOT compile native modules — that happens later at `pnpm install`
|
|
# in the pipeline, against the toolchain baked above.
|
|
COPY pnpm-lock.yaml ./
|
|
RUN pnpm fetch --frozen-lockfile
|