sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

fix(ci): authenticate tramiton-core fetch in the agent image build (main deploys)
CI / Check (pull_request) Successful in 5m44s
Details
CI / Detect Changes (pull_request) Has been skipped
Details
CI / Deploy Agent (pull_request) Has been skipped
Details
CI / Deploy Dashboard (pull_request) Has been skipped
Details
CI / Deploy Docs (pull_request) Has been skipped
Details
CI / Deploy MCP (pull_request) Has been skipped
Details

Browse Source 
The PR `check` job configures git auth for the private tramiton-core dependency,
but the main-branch `deploy-agent` job builds `Dockerfile.agent` where cargo also
fetches tramiton-core — inside the image build, with no credentials — so agent
image builds on main failed.

Inject the PAT as a BuildKit secret (never baked into a layer):
- Dockerfile.agent: `RUN --mount=type=secret,id=tramiton_token` configures the
  same https-insteadOf rewrite + CARGO_NET_GIT_FETCH_WITH_CLI before cargo build.
- deploy-agent: `DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=
  TRAMITON_FETCH_TOKEN ...`, reusing the existing TRAMITON_FETCH_TOKEN secret.

Only the agent image depends on tramiton-core; dashboard/mcp/docs builds are
unaffected. Self-tests on merge (deploy-agent runs when Dockerfile.agent changes).

Refs #118.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Sharang Parnerkar
2026-07-12 22:18:44 +02:00
co-authored by Claude Fable 5
parent a204f0c59c
commit 3f5ebc4afd
2 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile.agent
+10 -1
View File
@@ -2,7 +2,16 @@ FROM rust:1.94-bookworm AS builder
WORKDIR /app
COPY . .
RUN cargo build --release -p compliance-agent
# compliance-agent depends on the private tramiton-core git repo. Authenticate
# the fetch with a PAT passed as a BuildKit secret (never baked into a layer).
# Build with: DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN ...
RUN --mount=type=secret,id=tramiton_token \
if [ -s /run/secrets/tramiton_token ]; then \
git config --global \
url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
"ssh://git@gitea.meghsakha.com:22222/"; \
fi && \
CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-agent
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y ca-certificates libssl3 git curl python3 python3-pip npm golang-go php-cli && rm -rf /var/lib/apt/lists/*