Jannik/PaperClipAI
1
0 Fork 0
mirror of https://github.com/paperclipai/paperclip.git synced 2026-10-29 04:25:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

ci: cache Daytona image builds safely

Browse Source
This commit is contained in:
Dotta committed 2026-09-05 06:35:18 -05:00
1 parent bcc6fe7a44
commit a0431ff919
4 files changed
+92 -24
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

tests/runner-e2e/workflow-security.test.ts
+24
View File
@@ -352,6 +352,30 @@ describe("public repository paid workflow security", () => {
);
expect(daytonaImageJob).toContain('echo "source_revision="');
expect(daytonaImageJob).toContain('echo "content_id="');
expect(daytonaImageJob).toContain(
"IMAGE_CACHE: ghcr.io/paperclipai/paperclip-daytona-runner:e2e-buildcache-amd64",
);
expect(daytonaImageJob).toContain(
"TARGET_REF: ${{ needs.authorize.outputs.target_ref }}",
);
expect(daytonaImageJob).toContain(
"DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}",
);
const cacheRead = daytonaImageJob.indexOf(
'--cache-from "type=registry,ref=${IMAGE_CACHE}"',
);
const trustedTargetCheck = daytonaImageJob.indexOf(
'if [ "$TARGET_REF" = "refs/heads/$DEFAULT_BRANCH" ]; then',
);
const cacheWrite = daytonaImageJob.indexOf(
'--cache-to "type=registry,ref=${IMAGE_CACHE},mode=max"',
);
expect(cacheRead).toBeGreaterThan(0);
expect(trustedTargetCheck).toBeGreaterThan(cacheRead);
expect(cacheWrite).toBeGreaterThan(trustedTargetCheck);
expect(daytonaImageJob.slice(trustedTargetCheck, cacheWrite)).not.toContain(
"secrets.",
);
const targetCodeJobs = [
fullStack.slice(
fullStack.indexOf(" catalog:"),