Files
orca/cloud/apps/sandbox-control/image/commit-provision-env.mjs
T
Neil 63377c810d fix(sandbox-control): source-built goldens provision with the built commit's image files, not the Worker's copies (#137)
The Worker-started source build used the VM scripts, provision script and manifest pins embedded in
the Worker that started it, so a golden built from a newer commit could miss that commit's new VM
scripts (seen live: snap_HTsU from 19f900e has #122's orcad but not orca-desktop-proxy or
orca-desktop-page.js). source-build.sh now sources image/commit-provision-env.mjs from the fetched
checkout (no dependencies; mirrors provisionEnv, enforced by a test), so the image ships exactly that
commit. Tests also require every image/vm file to be a declared VM script and installed by provision.
2026-11-09 18:10:35 -08:00

46 lines
2.1 KiB
JavaScript

// Provision env for the image files of THIS checkout (manifest pins + every image/vm/* entry point),
// printed as shell-quoted `export NAME=value` lines. source-build.sh sources it after fetching a
// commit, so a source-built golden always ships that commit's VM scripts and provision, never the
// (possibly older) copies embedded in the Worker that started the build. No dependencies: it runs
// before anything is installed. Mirrors golden-image.ts provisionEnv (golden-image.test.ts checks).
// node image/commit-provision-env.mjs [imageDir]
import { readFileSync, readdirSync } from 'node:fs'
import { join } from 'node:path'
import { fileURLToPath } from 'node:url'
export function commitProvisionEnv(imageDir) {
const manifest = JSON.parse(readFileSync(join(imageDir, 'golden-image.manifest.json'), 'utf8'))
const env = {
AGENT_NPM_PACKAGES: manifest.agentCliPackages.join(' ')
}
if (manifest.gh?.version && manifest.gh?.sha256) {
env.GH_VERSION = manifest.gh.version
env.GH_SHA256 = manifest.gh.sha256
}
if (manifest.chrome) {
env.CHROME_VERSION = manifest.chrome.version
env.CHROME_SHA256 = manifest.chrome.sha256
}
if (manifest.desktop) {
env.NOVNC_VERSION = manifest.desktop.novnc.version
env.NOVNC_SHA256 = manifest.desktop.novnc.sha256
env.WEBSOCKIFY_VERSION = manifest.desktop.websockify.version
env.WEBSOCKIFY_SHA256 = manifest.desktop.websockify.sha256
}
const vmDir = join(imageDir, 'vm')
for (const name of readdirSync(vmDir).sort()) {
env[`ORCA_VM_SCRIPT_${name.replaceAll(/[-.]/g, '_')}`] = readFileSync(join(vmDir, name)).toString('base64')
}
return env
}
const shellQuote = (value) => `'${value.replaceAll("'", `'\\''`)}'`
if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
const imageDir = process.argv[2] ?? fileURLToPath(new URL('.', import.meta.url))
for (const [name, value] of Object.entries(commitProvisionEnv(imageDir))) {
process.stdout.write(`export ${name}=${shellQuote(value)}\n`)
}
process.stdout.write(`export ORCA_PROVISION_SCRIPT=${shellQuote(readFileSync(join(imageDir, 'provision-golden.sh')).toString('base64'))}\n`)
}