feat(image): give the image a way to put a pinned binary on PATH, and bake actionlint - #281
Merged
Merged
Conversation
… bake actionlint actionlint is the tool two repositories opened their command with, and their CI did not start for weeks. It could not be added: it is not in the Ubuntu archive, and the only mechanism for a command on a job's PATH was apt. The baked toolchains cannot serve -- they land in the runner tool cache, which only the setup-* actions add to PATH, so a plain `run:` step cannot call them. guest.path_binaries pins single-binary tools the way the compiler cache is already pinned: archive digest, the entry expected inside it, and the binary's own digest. Provisioning verifies all three before installing to /usr/local/bin, the same sequence sccache goes through a few lines above. Validation requires each pinned binary to appear in guest.provides, so a tool installed but not declared -- a tool nobody knows they have, which is half of what this mechanism exists to end -- fails the manifest. actionlint v1.7.12 is pinned. Its archive digest was checked against the checksums the release publishes, not merely computed from what arrived. The variant-parity guard enumerates Guest fields rather than comparing them, so listing path_binaries there would only say "may differ". They must not: a tool on PATH is part of what every worker promises, and a version differing between the standard and integration images would make the same command mean two things depending on where a job landed. It is listed to satisfy the enumeration and the sameness is asserted properly by TestVariantsPinTheSamePathBinaries. The install loop was exercised against the real archive before being believed: it verifies, extracts, installs, cleans up, and actionlint 1.7.12 runs. A tampered binary digest aborts it with exit 1. Claude-Session: https://claude.ai/code/session_01NpzpgiRaxi5mHVTMoRYndt
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
actionlintis the tool two repositories opened their command with, and their CI did not start for weeks. It could not be added: it is not in the Ubuntu archive, and the only mechanism for a command on a job's PATH was apt. The baked toolchains cannot serve — they land in the runner tool cache, which only thesetup-*actions add to PATH, so a plainrun:step cannot call them.guest.path_binariespins single-binary tools the way the compiler cache already is: archive digest, the entry expected inside it, and the binary's own digest. Provisioning verifies all three before installing to/usr/local/bin— the same sequencesccachegoes through a few lines above. Validation requires each pinned binary to appear inguest.provides, so a tool installed but not declared — a tool nobody knows they have, which is half of what this mechanism exists to end — fails the manifest.actionlint v1.7.12 is pinned. Its archive digest was checked against the checksums the release publishes, not merely computed from whatever arrived.
One guard needed strengthening rather than satisfying. The variant-parity test enumerates
Guestfields rather than comparing them, so listingpath_binariesthere would only say "may differ". They must not differ: a tool on PATH is part of what every worker promises, and a version differing between the standard and integration images would make the same command mean two things depending on where a job landed. It is listed to satisfy the enumeration, and the sameness is asserted properly by a newTestVariantsPinTheSamePathBinaries.Exercised before being believed. The install loop was run against the real archive: it verifies, extracts, installs, cleans up, and
actionlint 1.7.12runs. A tampered binary digest aborts it with exit 1.make verifygreen; both fingerprints repinned because the manifest and the build recipe both really changed.Follows #280, which added
guest.providesand the smoke assertion that proves it.https://claude.ai/code/session_01NpzpgiRaxi5mHVTMoRYndt