mirror of
https://github.com/stablyai/orca.git
synced 2026-11-15 18:37:24 +00:00
Neil
484b999dc8
GOLDEN_IMAGE_SOURCE=git:<repo>#<branch>: each cron tick resolves the branch HEAD through the GitHub App installation on that repo (read-only single-repo token, operator-only request surface) and, when HEAD differs from the active image's commit and the compare touches VM paths, starts a source build: fetch the commit, build orcad + bundled orca CLI, provision, then the existing wipe, snapshot, smoke, atomic activate (previous image kept as rollback). The commit is recorded as bundle_sha256 git:<sha> (kept through clone refreshes) and in /opt/orca/runtime/orcad/SOURCE_COMMIT. Also (W2): openssh-server in the image (on demand only), https apt sources, unlocked password field for key-only sshd.
33 lines
2.1 KiB
TypeScript
33 lines
2.1 KiB
TypeScript
// Embeds the image scripts + manifest as strings so the Worker can run a golden build itself.
|
|
// Regenerate after editing image/: `pnpm --filter @orca-cloud/sandbox-control exec tsx image/generate-vm-scripts.ts`
|
|
// (image/vm-scripts.test.ts fails while the generated file is stale).
|
|
import { readFileSync, writeFileSync } from 'node:fs'
|
|
import { fileURLToPath } from 'node:url'
|
|
import { VM_SCRIPTS } from './golden-image'
|
|
|
|
const here = (p: string): string => fileURLToPath(new URL(p, import.meta.url).href)
|
|
|
|
export function renderVmScriptsModule(): string {
|
|
const manifest = JSON.parse(readFileSync(here('./golden-image.manifest.json'), 'utf8'))
|
|
const scripts = Object.fromEntries(VM_SCRIPTS.map((name) => [name, readFileSync(here(`./vm/${name}`), 'utf8')]))
|
|
return [
|
|
'// GENERATED by image/generate-vm-scripts.ts from image/. Do not edit.',
|
|
"import type { BuildInputs, GoldenImageManifest } from './golden-image'",
|
|
'',
|
|
`export const MANIFEST: GoldenImageManifest = ${JSON.stringify(manifest)}`,
|
|
`export const PROVISION_SCRIPT: string = ${JSON.stringify(readFileSync(here('./provision-golden.sh'), 'utf8'))}`,
|
|
`export const VM_SCRIPT_SOURCES: BuildInputs['vmScripts'] = ${JSON.stringify(scripts)}`,
|
|
// The Worker's from-source golden build (GOLDEN_IMAGE_SOURCE=git:…): builds orcad, then provisions.
|
|
`export const SOURCE_BUILD_SCRIPT: string = ${JSON.stringify(readFileSync(here('./source-build.sh'), 'utf8'))}`,
|
|
// Run by the control plane per environment build / workspace boot; not installed in the image.
|
|
`export const ENVIRONMENT_BUILD_SCRIPT: string = ${JSON.stringify(readFileSync(here('./env/environment-build.sh'), 'utf8'))}`,
|
|
`export const ENVIRONMENT_DEPS_HOOK: string = ${JSON.stringify(readFileSync(here('./env/post-checkout-deps.sh'), 'utf8'))}`,
|
|
`export const WORKSPACE_PRELUDE_SCRIPT: string = ${JSON.stringify(readFileSync(here('./env/workspace-prelude.sh'), 'utf8'))}`,
|
|
''
|
|
].join('\n')
|
|
}
|
|
|
|
if (process.argv[1] && import.meta.url === new URL(`file://${process.argv[1]}`).href) {
|
|
writeFileSync(here('./vm-scripts.generated.ts'), renderVmScriptsModule())
|
|
}
|