50 lines
3.2 KiB
Bash
50 lines
3.2 KiB
Bash
#!/usr/bin/env bash
|
|
# Explicit remote-runner opt-in: invokes real models using the dedicated CLI login.
|
|
set -euo pipefail
|
|
umask 077
|
|
binary=$(realpath "$1")
|
|
cli=${FOUNDRY_REAL_CODEX_INSTALL:-/opt/endoleap-infra/codex-cli}
|
|
login=${FOUNDRY_REAL_CODEX_HOME:-/opt/endoleap-infra/foundry/codex/home}
|
|
: "${FOUNDRY_CANVAS_IMAGE_MODELS:?Set only backend model names verified for image output}"
|
|
test -x "$binary"
|
|
test -s "$login/auth.json"
|
|
test -s "$login/models_cache.json"
|
|
suffix=$(openssl rand -hex 8)
|
|
database=foundry-real-db-$suffix
|
|
worker=foundry-real-worker-$suffix
|
|
scratch=$(mktemp -d /tmp/foundry-real.XXXXXXXX)
|
|
cleanup(){ docker rm -f "$worker" "$database" >/dev/null 2>&1 || true; rm -rf "$scratch"; }
|
|
trap cleanup EXIT
|
|
install -d -m 700 "$scratch/run"
|
|
chown 1000:1000 "$scratch/run"
|
|
docker run -d --name "$database" --network none -e POSTGRES_HOST_AUTH_METHOD=trust postgres:17-alpine >/dev/null
|
|
for attempt in {1..30}; do if docker exec "$database" pg_isready -h 127.0.0.1 -U postgres >/dev/null 2>&1; then break; fi; sleep 1; done
|
|
docker exec -i "$database" psql -X -U postgres -v ON_ERROR_STOP=1 < db/001-auth.sql
|
|
docker exec "$database" psql -X -U postgres -v ON_ERROR_STOP=1 -c 'CREATE ROLE foundry_fixture LOGIN'
|
|
python3 deploy/migrate.py --container "$database" --database postgres --role foundry_fixture
|
|
# Only the CLI container sees the login. Core/tests receive the private socket,
|
|
# never the login, runtime configuration or Docker socket.
|
|
docker run -d --name "$worker" --init --network bridge --user 1000:1000 \
|
|
--cap-drop ALL --security-opt no-new-privileges --read-only --pids-limit 128 --memory 1g \
|
|
--tmpfs /tmp:rw,nosuid,nodev,size=128m --tmpfs /work:ro,nosuid,nodev \
|
|
--tmpfs /home/node/.codex:rw,nosuid,nodev,size=32m,uid=1000,gid=1000 --workdir /work \
|
|
-e "FOUNDRY_CANVAS_IMAGE_MODELS=$FOUNDRY_CANVAS_IMAGE_MODELS" \
|
|
--mount "type=bind,source=$binary,target=/opt/foundry,readonly" \
|
|
--mount "type=bind,source=$cli,target=/opt/codex,readonly" \
|
|
--mount "type=bind,source=$login/auth.json,target=/home/node/.codex/auth.json,readonly" \
|
|
--mount "type=bind,source=$login/models_cache.json,target=/home/node/.codex/models_cache.json,readonly" \
|
|
--mount "type=bind,source=$scratch/run,target=/run/foundry-codex" \
|
|
--mount type=bind,source=/etc/ssl/certs/ca-certificates.crt,target=/etc/ssl/certs/ca-certificates.crt,readonly \
|
|
node:24-bookworm-slim /opt/foundry codex-worker >/dev/null
|
|
for attempt in {1..30}; do if [[ -S "$scratch/run/worker.sock" ]]; then break; fi; sleep 1; done
|
|
test -S "$scratch/run/worker.sock"
|
|
CGO_ENABLED=0 go test -mod=readonly -c -o bin/platform-real-tests ./internal/platform
|
|
docker run --rm --network "container:$database" --user 1000:1000 \
|
|
--read-only --cap-drop ALL --security-opt no-new-privileges \
|
|
--tmpfs /tmp:rw,nosuid,nodev,noexec,size=16m,mode=1777 \
|
|
--mount "type=bind,source=$(pwd)/bin/platform-real-tests,target=/opt/integration-tests,readonly" \
|
|
--mount "type=bind,source=$scratch/run,target=/run/canvas-real,readonly" \
|
|
-e PLATFORM_TEST_DATABASE_URL=postgres://foundry_fixture@127.0.0.1:5432/postgres?sslmode=disable \
|
|
-e FOUNDRY_REAL_CODEX_SOCKET=/run/canvas-real/worker.sock \
|
|
--entrypoint /opt/integration-tests postgres:17-alpine -test.v -test.run '^TestCanvasAIRealWorker$' -test.timeout 6m
|