jochen
8d8dcd5ebb
mesh/merge-gate head 8d8dcd5ebb86 merged into trunk cd239283207a — pass: builds gitea, lab → novox, shanks; no bus step; every machine composes with the ch…
mesh/repo-check head 8d8dcd5ebb86 merged into trunk cd239283207a — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…
mesh/delivery delivered
The lab's credential came from the package team, which also writes the @novox packages, and the branches a run clones are not reviewed yet. The lab now contributes {"access": "read"} to its npm-package-registry requirement, and gitea's provisioner puts such a consumer on a team of its own, readers: code read on the org's repositories, package read, no write, and off the package team. The build agent, which publishes, stays on packages. A stop's SIGTERM to the run's process group killed the wrapper before it removed the credential file. The run's script now removes it as soon as its clones are done and traps every way it ends, and a run's start and lab_check remove what a crash or a reboot left.
113 lines
2.1 KiB
JSON
113 lines
2.1 KiB
JSON
{
|
|
"module": "lab",
|
|
"version": "1",
|
|
"capabilities": [
|
|
"container-runtime",
|
|
"virtualisation"
|
|
],
|
|
"requires": [
|
|
"npm-package-registry"
|
|
],
|
|
"contributes": {
|
|
"npm-package-registry": {
|
|
"access": "read"
|
|
}
|
|
},
|
|
"binds": {
|
|
"npm-package-registry": "${dir:state}/package-registry.json"
|
|
},
|
|
"secrets": {
|
|
"npm-package-registry": "${dir:state}/package-registry.secret"
|
|
},
|
|
"data": {
|
|
"own": [
|
|
{
|
|
"id": "work",
|
|
"path": "${dir:work}",
|
|
"class": "cache",
|
|
"why": "the lab's runs, each thrown away"
|
|
}
|
|
]
|
|
},
|
|
"resources": [
|
|
{
|
|
"id": "state",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"place": "."
|
|
},
|
|
{
|
|
"id": "work",
|
|
"type": "directory",
|
|
"path": "/var/lib/mesh-lab-runs",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "runtime-env",
|
|
"type": "file",
|
|
"path": "${dir:state}/lab.env",
|
|
"mode": "0600",
|
|
"content": "MESH_LAB_FORGE=${setting:forge}\nMESH_LAB_FORGE_BINDING=${dir:state}/package-registry.json\nMESH_LAB_FORGE_SECRET=${dir:state}/package-registry.secret\n"
|
|
},
|
|
{
|
|
"id": "git",
|
|
"type": "package",
|
|
"package": "git"
|
|
},
|
|
{
|
|
"id": "make",
|
|
"type": "package",
|
|
"package": "make"
|
|
},
|
|
{
|
|
"id": "python",
|
|
"type": "package",
|
|
"package": "python"
|
|
},
|
|
{
|
|
"id": "file",
|
|
"type": "package",
|
|
"package": "file"
|
|
},
|
|
{
|
|
"id": "iproute2",
|
|
"type": "package",
|
|
"package": "iproute2"
|
|
},
|
|
{
|
|
"id": "npm",
|
|
"type": "package",
|
|
"package": "npm"
|
|
},
|
|
{
|
|
"id": "go",
|
|
"type": "package",
|
|
"package": "go"
|
|
},
|
|
{
|
|
"id": "incus",
|
|
"type": "package",
|
|
"package": "incus"
|
|
}
|
|
],
|
|
"build": {
|
|
"artifacts": [
|
|
{
|
|
"name": "code",
|
|
"kind": "bundle",
|
|
"language": "typescript",
|
|
"entrypoints": [
|
|
"tools/index.js"
|
|
],
|
|
"loads": [
|
|
"tools/index.js"
|
|
],
|
|
"env": {
|
|
"MESH_LAB_WORK": "${dir:work}",
|
|
"MESH_LAB_ENV_FILE": "${dir:state}/lab.env"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|