I'm siGit, running on siGit Code & Deploy platform, browsing siGit Code coding agent repo.
development
| 1 | # ghcr.io/getsigit/sigit-code-assurance-runner: the guest image of the `sigit-code-assurance` |
| 2 | # Fireactions pool, where siGit Code Assurance tests a release candidate in a fresh microVM. |
| 3 | # The package is public and holds no secrets: everything a run needs arrives with the job. |
| 4 | # |
| 5 | # It carries no app dependencies, so the same image serves any repository the gate runs on; |
| 6 | # jobs run their own `pnpm install`. What it does carry is this release's `sigit`, so the |
| 7 | # assurance agent doesn't download it on every run. release-assurance-image.yml rebuilds it |
| 8 | # for each sigit release. |
| 9 | # |
| 10 | # Fireactions needs an image that boots systemd and runs `fireactions agent`, so this starts from |
| 11 | # the official fireactions-images base (runner, docker, gh, jq, agent) and adds what the gate |
| 12 | # needs on top. It does not start from mcr.microsoft.com/playwright: that image has no init. |
| 13 | # |
| 14 | # docker build --build-arg SIGIT_VERSION=v1.7.6 -t sigit-code-assurance-runner packaging/assurance-runner |
| 15 | |
| 16 | ARG BASE=ghcr.io/hostinger/fireactions-images/ubuntu24.04:latest |
| 17 | |
| 18 | # tauri-driver is cargo-only; build it here and copy the binary so the guest has no Rust. |
| 19 | FROM rust:1-bookworm AS tauri-driver |
| 20 | RUN cargo install tauri-driver --locked --root /out |
| 21 | |
| 22 | FROM ${BASE} |
| 23 | |
| 24 | LABEL org.opencontainers.image.source=https://github.com/getsigit/sigit \ |
| 25 | org.opencontainers.image.description="Guest image for siGit Code Assurance runs" |
| 26 | |
| 27 | ARG NODE_VERSION=24.12.0 |
| 28 | ARG PNPM_VERSION=10 |
| 29 | # Must match the consumer's @playwright/test. A job's `playwright install` is a no-op when it |
| 30 | # does and a browser download when it doesn't, and the visual baselines are only stable against |
| 31 | # the browsers they were recorded with. |
| 32 | ARG PLAYWRIGHT_VERSION=1.64.1 |
| 33 | # A sigit release tag (v1.7.6), or `latest`. Its linux-amd64 binary has to run on this base's |
| 34 | # glibc (2.39), which is why release-github builds it on ubuntu-24.04. |
| 35 | ARG SIGIT_VERSION=latest |
| 36 | |
| 37 | # Build-time only inside the microVM: Fireactions boots this as a rootfs, so jobs must set |
| 38 | # PLAYWRIGHT_BROWSERS_PATH themselves (see sigit-app fireactions-smoke.yml). |
| 39 | ENV DEBIAN_FRONTEND=noninteractive \ |
| 40 | PLAYWRIGHT_BROWSERS_PATH=/ms-playwright |
| 41 | |
| 42 | # Tauri runtime on Linux (AppImage under tauri-driver), a virtual display, and bubblewrap for |
| 43 | # the assurance agent's sandbox. |
| 44 | RUN apt-get update \ |
| 45 | && apt-get install -y --no-install-recommends \ |
| 46 | xvfb libwebkit2gtk-4.1-0 webkit2gtk-driver bubblewrap \ |
| 47 | && rm -rf /var/lib/apt/lists/* |
| 48 | |
| 49 | # Node from nodejs.org, then pnpm. |
| 50 | RUN curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" \ |
| 51 | | tar -xJ -C /usr/local --strip-components=1 \ |
| 52 | && npm install -g "pnpm@${PNPM_VERSION}" |
| 53 | |
| 54 | # Browsers and their system libraries and fonts, at the pinned Playwright version. |
| 55 | RUN npx -y "playwright@${PLAYWRIGHT_VERSION}" install --with-deps chromium webkit \ |
| 56 | && chmod -R a+rX /ms-playwright \ |
| 57 | && rm -rf /var/lib/apt/lists/* |
| 58 | |
| 59 | COPY --from=tauri-driver /out/bin/tauri-driver /usr/local/bin/tauri-driver |
| 60 | |
| 61 | # The released sigit. The .sha256 sidecar is a bare digest, so it is compared rather than fed |
| 62 | # to `sha256sum -c`. It comes from the same origin as the binary: it catches a truncated or |
| 63 | # corrupted download, not a tampered release. |
| 64 | RUN set -eu; \ |
| 65 | if [ "${SIGIT_VERSION}" = latest ]; then \ |
| 66 | url=https://github.com/getsigit/sigit/releases/latest/download/sigit-linux-amd64; \ |
| 67 | else \ |
| 68 | url="https://github.com/getsigit/sigit/releases/download/${SIGIT_VERSION}/sigit-linux-amd64"; \ |
| 69 | fi; \ |
| 70 | expected="$(curl -fsSL --retry 2 "${url}.sha256" | tr -d '[:space:]')"; \ |
| 71 | curl -fsSL --retry 2 "${url}" -o /usr/local/bin/sigit; \ |
| 72 | actual="$(sha256sum /usr/local/bin/sigit | cut -d' ' -f1)"; \ |
| 73 | [ "${actual}" = "${expected}" ] || { echo "sigit checksum mismatch: got ${actual}, expected ${expected}" >&2; exit 1; }; \ |
| 74 | chmod 755 /usr/local/bin/sigit; \ |
| 75 | /usr/local/bin/sigit --version |