Skip to content

fix(deps): preflight runtime dependencies #2557

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kongche-jbw wants to merge 1 commit into
base: main
Choose a base branch
from
+1,317 −57
Open

fix(deps): preflight runtime dependencies #2557

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -233,6 +233,15 @@ jobs:
- name: Regression test tokenless catalog version mismatch detection
run: bash tests/test-check-component-versions.sh

check-build-runtime-deps:
name: Check build runtime dependencies
runs-on: anolisa-k8s-general-ci-x64
steps:
- uses: actions/checkout@v4

- name: Test aggregated runtime dependency preflight
run: bash tests/test-build-all-runtime-deps.sh

# =========================================================================
# Step 3: Build & Lint copilot-shell
# =========================================================================
Expand Down
63 changes: 60 additions & 3 deletions .github/workflows/sec-core-source-code-build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ permissions:
env:
RUSTUP_DIST_SERVER: https://static.rust-lang.org
RUSTUP_UPDATE_ROOT: https://static.rust-lang.org/rustup
UV_PYTHON_INSTALL_MIRROR: https://github.com/astral-sh/python-build-standalone/releases/download

jobs:
build:
Expand All @@ -36,7 +37,7 @@ jobs:
if: matrix.container != ''
run: |
sed -i -e "s/cloud.aliyuncs/aliyun/g" /etc/yum.repos.d/*.repo
dnf install -y tar git sudo
dnf install -y tar git sudo bubblewrap gnupg2 jq
# Fix sudo PAM in container: replace with permissive config
cat > /etc/pam.d/sudo <<'EOF'
#%PAM-1.0
Expand All @@ -45,12 +46,31 @@ jobs:
session sufficient pam_permit.so
EOF
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 24
- name: Expose Node.js in the system PATH
run: |
sudo ln -sfn "$(command -v node)" /usr/local/bin/node
PATH=/usr/local/bin:/usr/bin:/bin node --version
- name: Install runtime dependencies (Ubuntu 22.04)
if: matrix.container == ''
run: |
sudo apt-get update
sudo apt-get install -y bubblewrap gnupg jq
- uses: dtolnay/rust-toolchain@1.93.0
with:
components: clippy, rustfmt, rust-src
- name: Build and install
run: |
./scripts/build-all.sh --component sec-core
build_status=0
./scripts/build-all.sh --component sec-core || build_status=$?
if (( build_status != 0 )); then
echo "::group::sec-core build failure log"
tail -n 200 target/build.log 2>/dev/null || echo "target/build.log is unavailable"
echo "::endgroup::"
exit "$build_status"
fi
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
- name: Verify CLI
run: |
Expand All @@ -60,6 +80,17 @@ jobs:
run: agent-sec-daemon --help
- name: Verify sandbox
run: linux-sandbox --help
- name: Verify runtime dependencies
run: |
sec_runtime_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PATH="$sec_runtime_path" bwrap --version
if PATH="$sec_runtime_path" command -v gpg; then
PATH="$sec_runtime_path" gpg --version
else
PATH="$sec_runtime_path" gpg2 --version
fi
PATH="$sec_runtime_path" node --version
PATH="$sec_runtime_path" jq --version
- name: Verify deployment
run: |
echo "=== Skills ==="
Expand Down Expand Up @@ -96,6 +127,13 @@ jobs:
runs-on: anolisa-k8s-general-ci-x64
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 24
- name: Expose Node.js in the system PATH
run: |
sudo ln -sfn "$(command -v node)" /usr/local/bin/node
PATH=/usr/local/bin:/usr/bin:/bin node --version
- uses: dtolnay/rust-toolchain@1.93.0
with:
components: clippy, rustfmt, rust-src
Expand All @@ -105,14 +143,32 @@ jobs:
sudo apt-get install -y passwd util-linux
- name: Build and install in system mode
run: |
./scripts/build-all.sh --component sec-core --system
build_status=0
./scripts/build-all.sh --component sec-core --system || build_status=$?
if (( build_status != 0 )); then
echo "::group::sec-core build failure log"
tail -n 200 target/build.log 2>/dev/null || echo "target/build.log is unavailable"
echo "::endgroup::"
exit "$build_status"
fi
- name: Verify system commands
run: |
agent-sec-cli --version
agent-sec-cli --help
agent-sec-cli scan-pii --help >/dev/null
agent-sec-daemon --help
linux-sandbox --help
- name: Verify runtime dependencies
run: |
sec_runtime_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PATH="$sec_runtime_path" bwrap --version
if PATH="$sec_runtime_path" command -v gpg; then
PATH="$sec_runtime_path" gpg --version
else
PATH="$sec_runtime_path" gpg2 --version
fi
PATH="$sec_runtime_path" node --version
PATH="$sec_runtime_path" jq --version
- name: Verify system deployment
run: |
echo "=== System binaries ==="
Expand Down Expand Up @@ -149,5 +205,6 @@ jobs:
esac
namei -l /usr/local/lib/anolisa/sec-core/venv/bin/python
sudo useradd -m -s /bin/bash secprobe || true
sudo -u secprobe env PATH=/usr/local/bin:/usr/bin:/bin node --version
sudo -u secprobe /usr/local/bin/agent-sec-cli --version
sudo -u secprobe /usr/local/bin/agent-sec-cli scan-pii --help >/dev/null
Loading
Loading