Skip to content

feat: verifyContainer (run the referee in Docker) - #31

Merged
wangzhizhou merged 1 commit into
mainfrom
feat/verify-container
Nov 10, 2026
Merged

wangzhizhou merged 1 commit into
mainfrom
feat/verify-container

Conversation

@wangzhizhou

Copy link
Copy Markdown
Contributor

补齐通用化的最后一块:验证环境。

  • 仓库画像新增 verifyContainer:docker run --rm -v <worktree>:/work -w /work --entrypoint bash <image> -c "<cmd>",用于 Swift / .NET / 特定 JDK 等宿主没有的工具链。
  • 容器模式下不在宿主预装 npm 依赖(避免二进制不匹配);Docker 不可用时明确失败,不会假装已验证。
  • 冻结指纹纳入镜像名与命令引用脚本的内容哈希。
  • Agent 仍在宿主执行(只编辑代码),容器只负责裁判;macOS/Xcode 没有官方镜像 → 用 Mode 1/2 的自托管 runs-on。
  • 测试 61 个用例全绿。

The last portability blocker for non-Ubuntu toolchains: the hub runner only
has what the image ships. A repo profile can now pin an image:

  "verify": ["swift test"], "verifyContainer": "swift:6.0"

- verify.ts: buildVerifyInvocation() wraps the frozen command in
  `docker run --rm -v <worktree>:/work -w /work --entrypoint bash <image> -c`,
  skips host-side npm install (binaries would not match), and fails loudly
  when docker is unavailable instead of pretending the run was verified.
- the frozen fingerprint now includes the image, so a profile change is
  detected like any other gate change.
- tests: invocation matrix (host / docker / tampered npm body) + capture.
- docs/portability.md: container section and macOS/self-hosted guidance.
@wangzhizhou
wangzhizhou merged commit e40c4c8 into main Nov 10, 2026
2 checks passed
@wangzhizhou
wangzhizhou deleted the feat/verify-container branch November 10, 2026 05:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant