sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

fix(ci): authenticate tramiton-core fetch in the agent image build (main deploys) #143

Merged
sharang merged 1 commits from fix/ci-docker-tramiton-fetch into main 2026-07-12 20:25:40 +00:00
Conversation 0 Commits 1 Files Changed 2
+16 -2
sharang commented 2026-07-12 20:18:45 +00:00
Owner
Copy Link
Copy Source

The PR check job authenticates the private tramiton-core git fetch, but the main-branch deploy-agent job builds Dockerfile.agent where cargo also fetches tramiton-core — inside the image build, with no credentials — so agent image builds on main fail.

Fix: inject the PAT as a BuildKit secret (never baked into an image layer).

  • Dockerfile.agent: RUN --mount=type=secret,id=tramiton_token … applies the same https-insteadOf rewrite + CARGO_NET_GIT_FETCH_WITH_CLI=true before cargo build.
  • deploy-agent: DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN …, reusing the existing TRAMITON_FETCH_TOKEN secret.

Only the agent image depends on tramiton-core (dashboard/mcp/docs unaffected). Self-tests on merge — changing Dockerfile.agent makes detect-changes run deploy-agent.

Note: couldn't fully run the image build locally (no PAT value on hand + no .dockerignore so the context is large), but this mirrors the working PR-stage auth and uses standard BuildKit secret injection. Assumes the deploy runner's Docker daemon supports BuildKit (docker:27-cli → yes).

The PR `check` job authenticates the private tramiton-core git fetch, but the main-branch **`deploy-agent`** job builds `Dockerfile.agent` where cargo also fetches tramiton-core — inside the image build, with no credentials — so **agent image builds on main fail**. Fix: inject the PAT as a **BuildKit secret** (never baked into an image layer). - `Dockerfile.agent`: `RUN --mount=type=secret,id=tramiton_token …` applies the same `https`-insteadOf rewrite + `CARGO_NET_GIT_FETCH_WITH_CLI=true` before `cargo build`. - `deploy-agent`: `DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN …`, reusing the existing `TRAMITON_FETCH_TOKEN` secret. Only the agent image depends on tramiton-core (dashboard/mcp/docs unaffected). **Self-tests on merge** — changing `Dockerfile.agent` makes `detect-changes` run `deploy-agent`. Note: couldn't fully run the image build locally (no PAT value on hand + no `.dockerignore` so the context is large), but this mirrors the working PR-stage auth and uses standard BuildKit secret injection. Assumes the deploy runner's Docker daemon supports BuildKit (docker:27-cli → yes).
sharang added the infrastructure label 2026-07-12 20:18:45 +00:00
sharang added 1 commit 2026-07-12 20:18:46 +00:00
fix(ci): authenticate tramiton-core fetch in the agent image build (main deploys)
CI / Check (pull_request) Successful in 5m44s
Details
CI / Detect Changes (pull_request) Has been skipped
Details
CI / Deploy Agent (pull_request) Has been skipped
Details
CI / Deploy Dashboard (pull_request) Has been skipped
Details
CI / Deploy Docs (pull_request) Has been skipped
Details
CI / Deploy MCP (pull_request) Has been skipped
Details
3f5ebc4afd 
The PR `check` job configures git auth for the private tramiton-core dependency,
but the main-branch `deploy-agent` job builds `Dockerfile.agent` where cargo also
fetches tramiton-core — inside the image build, with no credentials — so agent
image builds on main failed.

Inject the PAT as a BuildKit secret (never baked into a layer):
- Dockerfile.agent: `RUN --mount=type=secret,id=tramiton_token` configures the
  same https-insteadOf rewrite + CARGO_NET_GIT_FETCH_WITH_CLI before cargo build.
- deploy-agent: `DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=
  TRAMITON_FETCH_TOKEN ...`, reusing the existing TRAMITON_FETCH_TOKEN secret.

Only the agent image depends on tramiton-core; dashboard/mcp/docs builds are
unaffected. Self-tests on merge (deploy-agent runs when Dockerfile.agent changes).

Refs #118.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
sharang merged commit c6b5622113 into main 2026-07-12 20:25:40 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
P0-demo
CERTifAI P0 demo build tickets (CS-*)
 bug
critical
enhancement
epic
Tracking issue spanning multiple sub-issues
 high
infrastructure
onboarding
Multi-target onboarding wizard redesign
 performance
security
v0.3.0
No labels infrastructure
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#143