80 lines
3.7 KiB
Bash
Executable File
80 lines
3.7 KiB
Bash
Executable File
#!/bin/bash
|
|
# repo-readonly init — read-only project-repo clone for harness-path
|
|
# kind: script nodes (spec/typed-workflows.md WF-COMP-34, bug 3bee78fa).
|
|
#
|
|
# Threat model: the script node is invoked by entrypoint/runners/shell.py
|
|
# with cwd=context["workspace"]; the existing entrypoint paths set
|
|
# context["workspace"] to /workspace/project from AGENT_WORKING_DIR
|
|
# (the env var this init.sh exports via its harness.yaml env field).
|
|
# The init.sh MUST clone AGENT_REPO_URL (the upstream project repo URL
|
|
# emitted by the WF-COMP-34 compiler emission as payload.agent_repo.url
|
|
# and propagated to the container env by the dispatcher) into
|
|
# /workspace/project at its default branch — read-only, no fork, no push,
|
|
# no AR-39 select-base, no scratchpad, no .gitignore munging.
|
|
#
|
|
# Bug discovered live 2026-10-02 (bug 3bee78fa, run
|
|
# 9a368e71-d6ab-4185-a98c-9b31d41bb4b5): without this layer, every
|
|
# harness-path kind: script node ran with /workspace/project missing,
|
|
# so any preflight that read repo files (e.g. preflight-test-collection
|
|
# invoking pytest --collect-only tests/test_k8s_gc.py) saw an empty cwd
|
|
# and either reported zero files or failed with the upstream tool's own
|
|
# misconfig error. The WF-COMP-34 compiler emission (this repo's
|
|
# controlplane/typed_workflows/compiler.py, bug 3bee78fa) writes
|
|
# payload.agent_repo onto every harness-path script node's manifest, so
|
|
# the URL reaches the env when the template (or the node) declares
|
|
# agent_repo. This init.sh is the other half — the layer that actually
|
|
# clones it.
|
|
|
|
set -euo pipefail
|
|
|
|
echo "=== repo-readonly/v1 init.sh ==="
|
|
|
|
# WF-COMP-34 unset-case contract: if AGENT_REPO_URL is unset, this is a
|
|
# no-op. The script node keeps its pre-fix silent empty workspace
|
|
# runtime exactly — a template that omits agent_repo does not get a
|
|
# surprise clone. The entrypoint V2 guard (entrypoint/entrypoint.py:901-906)
|
|
# only fires when AGENT_REPO_URL IS set; the unset case is a no-op on
|
|
# both sides (no clone here, no V2 trip there), so the legacy
|
|
# script_on_harness=False path's observable behaviour is preserved
|
|
# verbatim.
|
|
if [ -z "${AGENT_REPO_URL:-}" ]; then
|
|
echo "AGENT_REPO_URL unset; no clone (WF-COMP-34 unset-case contract)."
|
|
exit 0
|
|
fi
|
|
|
|
# If the clone target already exists (e.g. a previous layer cloned into
|
|
# it), skip — never clobber. The framework composite order
|
|
# (shared-variables/v1 first, cp-service-token/v1 second,
|
|
# repo-readonly/v1 last) guarantees neither prior layer writes here.
|
|
if [ -d /workspace/project ]; then
|
|
echo "/workspace/project already exists; skipping clone."
|
|
exit 0
|
|
fi
|
|
|
|
mkdir -p /workspace
|
|
|
|
echo "Cloning (read-only): $AGENT_REPO_URL -> /workspace/project"
|
|
# Read-only clone: no checkout of a task branch, no push target, no
|
|
# remote operations beyond the initial clone. --depth 1 is enough —
|
|
# a script node reads files, not history. If history is needed later,
|
|
# the spec can be amended; today every preflight is a pytest --collect-only
|
|
# or a prettier --check or similar that does not need commit ancestry.
|
|
if git clone --depth 1 "$AGENT_REPO_URL" /workspace/project; then
|
|
echo "Cloned $AGENT_REPO_URL to /workspace/project"
|
|
else
|
|
# Loud failure: a harness-path script node that declares agent_repo
|
|
# and finds the clone fails SHOULD fail the task at init time, not
|
|
# silently leave /workspace/project missing for the V2 guard to
|
|
# catch 26 seconds later (that failure mode is the symptom this
|
|
# bug was filed for).
|
|
echo "ERROR: Failed to clone $AGENT_REPO_URL" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Strip any symlinks (security: prevent /proc/1/environ exfiltration;
|
|
# mirrors agent-repo/v1's defence).
|
|
find /workspace/project -type l -exec rm {} \; 2>/dev/null || true
|
|
|
|
echo "AGENT_WORKING_DIR=${AGENT_WORKING_DIR:-/workspace/project}"
|
|
echo "=== repo-readonly/v1 init.sh complete ==="
|