공급망: Node 재현 빌드 시간 예산을 현실화 #12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: buildroot-guest | |
| on: | |
| workflow_dispatch: | |
| workflow_call: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "scripts/buildroot/**" | |
| - ".github/workflows/buildroot-guest.yml" | |
| permissions: | |
| contents: read | |
| jobs: | |
| reproduce: | |
| name: reproduce-${{ matrix.profile }}-${{ matrix.slot }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 180 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| profile: [linux, node] | |
| slot: [a, b] | |
| env: | |
| PYPROC_BUILDROOT_WORKSPACE: ${{ github.workspace }}/../pyproc-buildroot-${{ matrix.profile }}-${{ matrix.slot }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - name: Build pinned Buildroot guest and legal material | |
| run: npm run assets:buildroot -- --profile ${{ matrix.profile }} | |
| - name: Normalize evidence paths | |
| id: evidence | |
| run: | | |
| echo "dist=$(realpath "$PYPROC_BUILDROOT_WORKSPACE/dist")" >> "$GITHUB_OUTPUT" | |
| echo "legal=$(realpath "$PYPROC_BUILDROOT_WORKSPACE/output/legal-info")" >> "$GITHUB_OUTPUT" | |
| - name: Upload independent build evidence | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: pyproc-buildroot-guest-${{ matrix.profile }}-${{ matrix.slot }} | |
| path: ${{ steps.evidence.outputs.dist }}/ | |
| if-no-files-found: error | |
| retention-days: 30 | |
| - name: Upload complete legal material | |
| if: matrix.slot == 'a' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: pyproc-buildroot-legal-info-${{ matrix.profile }} | |
| path: ${{ steps.evidence.outputs.legal }}/ | |
| if-no-files-found: error | |
| compression-level: 0 | |
| retention-days: 30 | |
| verify: | |
| name: verify-byte-identical-${{ matrix.profile }} | |
| needs: reproduce | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| profile: [linux, node] | |
| steps: | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: pyproc-buildroot-guest-${{ matrix.profile }}-a | |
| path: .cache/repro/a | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: pyproc-buildroot-guest-${{ matrix.profile }}-b | |
| path: .cache/repro/b | |
| - name: Verify image, manifest, SBOM, and legal gate | |
| run: | | |
| set -euo pipefail | |
| cmp .cache/repro/a/build-manifest.json .cache/repro/b/build-manifest.json | |
| cmp .cache/repro/a/buildroot.cyclonedx.json .cache/repro/b/buildroot.cyclonedx.json | |
| mkdir -p .cache/repro/verified | |
| cp .cache/repro/a/* .cache/repro/verified/ | |
| node --input-type=module <<'NODE' | |
| import { createHash } from "node:crypto"; | |
| import { readFile, writeFile } from "node:fs/promises"; | |
| const base = ".cache/repro/verified"; | |
| const manifest = JSON.parse(await readFile(`${base}/build-manifest.json`, "utf8")); | |
| const left = await readFile(`.cache/repro/a/${manifest.output.name}`); | |
| const right = await readFile(`.cache/repro/b/${manifest.output.name}`); | |
| if (!left.equals(right)) throw new Error("independent guest image bytes differ"); | |
| const image = await readFile(`${base}/${manifest.output.name}`); | |
| const actualSha256 = createHash("sha256").update(image).digest("hex"); | |
| if (actualSha256 !== manifest.output.sha256) throw new Error("verified image SHA-256 mismatch"); | |
| if (image.byteLength !== manifest.output.byteLength) throw new Error("verified image byteLength mismatch"); | |
| if (manifest.evidence.legalWarnings.length) throw new Error("verified legal-info warnings are not empty"); | |
| if (manifest.profile === "node") { | |
| if (manifest.runtime?.name !== "node" || manifest.runtimeOracle?.version !== `v${manifest.runtime.version}`) { | |
| throw new Error("verified Node runtime oracle mismatch"); | |
| } | |
| if (manifest.runtimeOracle.sha256 !== manifest.runtime.oracle.sha256) { | |
| throw new Error("verified Node workload digest mismatch"); | |
| } | |
| } | |
| const receipt = { | |
| schemaVersion: 1, | |
| recipe: manifest.recipe, | |
| githubRunId: process.env.GITHUB_RUN_ID, | |
| headSha: process.env.GITHUB_SHA, | |
| independentBuilds: ["a", "b"], | |
| byteIdentical: true, | |
| output: manifest.output, | |
| }; | |
| await writeFile(`${base}/reproducibility-manifest.json`, `${JSON.stringify(receipt, null, 2)}\n`); | |
| NODE | |
| - name: Upload verified reproducible guest | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: pyproc-buildroot-guest-verified-${{ matrix.profile }} | |
| path: .cache/repro/verified/ | |
| if-no-files-found: error | |
| retention-days: 90 |