Jannik/PaperClipAI
1
0 Fork 0
mirror of https://github.com/paperclipai/paperclip.git synced 2026-11-04 19:28:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: bind release image inputs to frozen runtime receipts

Browse Source 
Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
DottaandPaperclip committed 2026-10-15 07:22:39 -05:00
1 parent 84592191eb
commit 5a117d6d35
2 files changed
+8 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

scripts/__tests__/prepare-runner-release-image.test.mjs
+5 -1
View File
@@ -13,8 +13,12 @@ test('release image consumes one successful exact-source producer set', () => {
assert.deepEqual(selectReleaseArtifacts(artifacts, '123', 2), artifacts);
});
test('frozen runtime source can differ from workflow dispatch source', () => {
assert.doesNotThrow(() => validateReleaseRun({ ...run, head_sha: 'c'.repeat(40) }, source));
});
for (const [name, patch] of [
['different source', { head_sha: 'c'.repeat(40) }],
['invalid workflow source', { head_sha: 'not-a-sha' }],
['incomplete producer', { conclusion: null }],
['failed producer', { conclusion: 'failure' }],
['unrelated workflow', { path: '.github/workflows/ci.yml' }],
scripts/prepare-runner-release-image.mjs
+3 -3
View File
@@ -10,9 +10,9 @@ import { isDeepStrictEqual } from 'node:util';
import { verifyReleaseProviderPack } from '../packages/paperclip-runner/scripts/release-provider-pack.mjs';
export function validateReleaseRun(run, source) {
if (!/^[a-f0-9]{40}$/.test(source) || run.head_sha !== source || run.conclusion !== 'success'
if (!/^[a-f0-9]{40}$/.test(source) || !/^[a-f0-9]{40}$/.test(run.head_sha ?? '') || run.conclusion !== 'success'
|| run.path !== '.github/workflows/release-smoke.yml' || run.repository?.full_name !== 'paperclipai/paperclip') {
throw Error('Image inputs require a successful exact-source Release Smoke run in paperclipai/paperclip');
throw Error('Image inputs require a successful repository-owned Release Smoke run in paperclipai/paperclip');
}
}
@@ -142,7 +142,7 @@ z.extractall(dest)
await copyFile(new URL('../docker/daytona-runner/Dockerfile.release', import.meta.url), join(output, 'Dockerfile'));
await copyFile(join(dirs[0], 'linux-x64/provider-pack.json'), join(output, 'provider-pack.json'));
for (const dir of dirs) await rm(dir, { recursive: true });
const evidence = { sourceRevision: source, producerRunId: runId, producerAttempt: run.run_attempt, providerPackDigest: pack.digest,
const evidence = { sourceRevision: source, producerRunId: runId, producerWorkflowSource: run.head_sha, producerAttempt: run.run_attempt, providerPackDigest: pack.digest,
daemonSha256: sha256, baseImage: process.env.RELEASE_BASE_IMAGE, artifacts: selected.map(a => ({ id: a.id, name: a.name, digest: a.digest })), providerCalls: 0 };
await writeFile(resolve(output, '../release-image-inputs.json'), JSON.stringify(evidence, null, 2) + '\n');
console.log(JSON.stringify(evidence));