jochen
e0bc919d49
build-agent's npm-package-registry becomes optional, so genesis's step 13 is no longer refused with 'nothing provides npm-package-registry'. Until gitea is assigned, the agent on genesis's node reads the genesis-package-registry own-secret the installer seals at the packages step; it is issued outside the mesh, so no other machine is given one. The binding and its credential are composed only while bound (ADR 0330 §6), and no file names them otherwise.
build-agent
The mesh's build machine as a role every machine can hold (novox/hq ADR 0190). It holds the node seat
node-build-agent: every holder pulls one build at a time from the role's one work queue when it is
idle, so a tier of many images is built by as many machines as hold the seat and are online, and a
machine that is off builds nothing and blocks nothing. The controller asks the role, never a machine;
the outcome names the machine that built it.
What a holding machine needs is what the builder always needed, said here once: a container runtime
(the socket is mounted), the artifact store as a provision, a workspace, and the bus credential. The code is cmd/mesh-builder in the mesh-controller repository, compiled from
that repository's main (build.artifacts[].context); this module ships the packaging.
Assign it to every machine with a container runtime. It replaces builder, the one-holder form of the
same thing; retire that once this is assigned where it was.
The package registry (novox/hq ADR 0336)
The package registry (npm-package-registry, provided by the gitea module) is an optional requirement.
Genesis assigns the build agent before anything provides it, so the agent is assignable on a mesh with no
registry, and mesh-controller.plan and node list the requirement as unbound until the gitea module is
assigned; it then binds with no further act.
Until it binds, the agent on genesis's node reads the genesis-package-registry own-secret, which the
installer seals to it at the packages step: the forge it raised, the port, the npm path, the account
mesh-builder and its password. Issued outside the mesh, so no other machine is given one. A real binding
wins over it, and each build's log says which the build resolved from. A build that needs the registry (a
package artifact, an image whose Dockerfile names .npmrc, a TypeScript artifact with an @novox/
dependency) on an agent with neither fails before building, naming the machine. Go artifacts and images
that do not name .npmrc build without it. manifest_test.go holds the manifest to this.