jochen
dd39d4ace7
mesh/merge-gate head dd39d4ace74b merged into trunk 0d723484a84a — pass: builds lab → shanks; no bus step; every machine composes with the change as it did…
mesh/repo-check head dd39d4ace74b merged into trunk 0d723484a84a — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…
mesh/delivery delivered
The lab's tools read their bound npm-package-registry credential, root's at 0600 on the machine. The controller gives the runtime's account exactly the files a tools bundle names in its env (ADR 0192), as gitea and umami are given theirs, so the bundle now names the credential and its binding there, and no other credential changes hands. The merge check runs as root, where no directory mode stops a removal: the test that makes an unremovable tree now skips there before it makes anything, and a second test clears leftovers whoever runs it.
115 lines
2.3 KiB
JSON
115 lines
2.3 KiB
JSON
{
|
|
"module": "lab",
|
|
"version": "1",
|
|
"capabilities": [
|
|
"container-runtime",
|
|
"virtualisation"
|
|
],
|
|
"requires": [
|
|
"npm-package-registry"
|
|
],
|
|
"contributes": {
|
|
"npm-package-registry": {
|
|
"access": "read"
|
|
}
|
|
},
|
|
"binds": {
|
|
"npm-package-registry": "${dir:state}/package-registry.json"
|
|
},
|
|
"secrets": {
|
|
"npm-package-registry": "${dir:state}/package-registry.secret"
|
|
},
|
|
"data": {
|
|
"own": [
|
|
{
|
|
"id": "work",
|
|
"path": "${dir:work}",
|
|
"class": "cache",
|
|
"why": "the lab's runs, each thrown away"
|
|
}
|
|
]
|
|
},
|
|
"resources": [
|
|
{
|
|
"id": "state",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"place": "."
|
|
},
|
|
{
|
|
"id": "work",
|
|
"type": "directory",
|
|
"path": "/var/lib/mesh-lab-runs",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "runtime-env",
|
|
"type": "file",
|
|
"path": "${dir:state}/lab.env",
|
|
"mode": "0600",
|
|
"content": "MESH_LAB_FORGE=${setting:forge}\nMESH_LAB_FORGE_BINDING=${dir:state}/package-registry.json\nMESH_LAB_FORGE_SECRET=${dir:state}/package-registry.secret\n"
|
|
},
|
|
{
|
|
"id": "git",
|
|
"type": "package",
|
|
"package": "git"
|
|
},
|
|
{
|
|
"id": "make",
|
|
"type": "package",
|
|
"package": "make"
|
|
},
|
|
{
|
|
"id": "python",
|
|
"type": "package",
|
|
"package": "python"
|
|
},
|
|
{
|
|
"id": "file",
|
|
"type": "package",
|
|
"package": "file"
|
|
},
|
|
{
|
|
"id": "iproute2",
|
|
"type": "package",
|
|
"package": "iproute2"
|
|
},
|
|
{
|
|
"id": "npm",
|
|
"type": "package",
|
|
"package": "npm"
|
|
},
|
|
{
|
|
"id": "go",
|
|
"type": "package",
|
|
"package": "go"
|
|
},
|
|
{
|
|
"id": "incus",
|
|
"type": "package",
|
|
"package": "incus"
|
|
}
|
|
],
|
|
"build": {
|
|
"artifacts": [
|
|
{
|
|
"name": "code",
|
|
"kind": "bundle",
|
|
"language": "typescript",
|
|
"entrypoints": [
|
|
"tools/index.js"
|
|
],
|
|
"loads": [
|
|
"tools/index.js"
|
|
],
|
|
"env": {
|
|
"MESH_LAB_WORK": "${dir:work}",
|
|
"MESH_LAB_ENV_FILE": "${dir:state}/lab.env",
|
|
"MESH_LAB_FORGE_BINDING": "${dir:state}/package-registry.json",
|
|
"MESH_LAB_FORGE_SECRET": "${dir:state}/package-registry.secret"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|