tegwick
c228583b60
All checks were successful
Build and Publish Service Image / build-and-push (push) Successful in 2m38s
.forgejo/workflows/service-image.yaml builds Containerfile from the pushed commit's tarball and pushes forgejo.coulomb.social/coulomb/informed-decision :main-<short sha>, then reports the immutable digest. Before pushing it checks the zlib floor, the runtime smoke (tools/zlib_overlay/check_runtime.py) and that the installed modules equal the commit's source. Containerfile builds the wheel in-image (hash-pinned setuptools in requirements-build.lock) and installs the zlib overlay's hash-pinned, Alpine-signed zlib-1.3.2-r1 package offline, failing below 1.3.2-r1, so the live image's zlib fix cannot regress. Overlay workflows are unchanged. Local build: 13/13 container checks, zlib 1.3.2-r1, source manifest match. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
13 lines
681 B
Python
13 lines
681 B
Python
"""Print `sha256 ./relative/path` for the installed informed_decision modules (C-sorted).
|
|
|
|
Run inside the service image (`docker run -i --entrypoint python IMAGE - < this file`). CI compares
|
|
the output with `sha256sum` over the pushed commit's informed_decision/*.py: the image must carry
|
|
exactly the source it was built from. Opens no database and no network.
|
|
"""
|
|
import hashlib
|
|
from pathlib import Path
|
|
|
|
ROOT = Path('/opt/venv/lib/python3.12/site-packages/informed_decision')
|
|
rows = sorted('./' + str(p.relative_to(ROOT)) for p in ROOT.rglob('*.py') if '__pycache__' not in p.parts)
|
|
for rel in rows:
|
|
print(hashlib.sha256((ROOT / rel).read_bytes()).hexdigest() + ' ' + rel)
|