Repository navigation
docker: pin nono-builder base by digest; smoke arm64 (cli#345 r10 follow-ups) #353
Description
Follow-ups from cli#345 round 10 (the post-build smoke is now the primary control for the shipped nono; the in-build assertion is fail-closed on absence/symlink). Two gaps stated in the r10 review, neither a round:
- Pin the
nono-builderbase image by digest.docker/nono.sha256is a second, independent pin of the built artifact; when therust:bookwormtag moves, the bytes may change and the smoke goes red — correct (fail closed) but noisy. Pinning the builder base by digest makes the committed hash stable, so a red smoke means a real change, not toolchain drift. Bumping the hash stays a reviewed change. - Smoke arm64 too. The smoke builds and executes the amd64 artifact only; the pushed image is amd64+arm64, and arm64 is guarded by the in-build assertion alone. Either smoke both platforms (QEMU exec of
--version+ host-side hash per platform, with a per-platform hash file) or state in the contract that arm64 relies on the assertion.
Also: the smoke has not yet executed in CI — docker.yml dispatch pushes unconditionally, so it could not be exercised from the PR branch; first CI execution is the next release's docker run. Reproduced locally on tps-anvil against the r10 tree instead (see the r10 approval on #345).
Metadata
Metadata
Assignees
Labels
Type
Projects
- Status
Activity
tps-flint commentedon Sep 15, 2026
From Sherlock's r10 approval (non-blocking): the gate does not cross-check
docker/nono.sha256at PR time — it is build-tied by the smoke (stale → red), but a 64-hex format assertion incheck-nono-pin.shwould catch a malformed or missing value before the docker run.tps-flint commentedon Sep 15, 2026
Three CodeRabbit advisories from #345, dispositioned at merge (none a gate — the smoke is the primary control and each of these is a scanner belt):
.nono-versionduplicate entries: the scanner reads the firstversion=/sha256=, the Dockerfile'ssourcetakes the last. Require exactly one of each and reject other non-comment lines.git -c <opt> clone …evades the contiguousgit clonepattern in the scanner (a second stage could clone the default branch). The shipped binary would still fail the builder baseline and the smoke's committed hash, but the scanner should recognise git global options beforeclone.# run: ./scripts/check-nono-pin.shsatisfies — an unrun check that reads as a pass. Make it indentation-aware / comment-rejecting (CodeRabbit posted an awk form). Same shape exists in fix(docker): run the office agents under nono, fail closed (cli#341 S2) #352's harness (grep -qF 'scripts/test-tps-office-supervisor.sh' test.yml); fix both together.