fix: Node 게스트 재현 빌드 경로를 고정한다 #14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: buildroot-guest | |
| on: | |
| workflow_dispatch: | |
| workflow_call: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "scripts/buildroot/**" | |
| - ".github/workflows/buildroot-guest.yml" | |
| permissions: | |
| contents: read | |
| jobs: | |
| reproduce: | |
| name: reproduce-${{ matrix.profile }}-${{ matrix.slot }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 300 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| profile: [linux, node] | |
| slot: [a, b] | |
| env: | |
| # Matrix slots have isolated runners. Node records its cross-toolchain | |
| # path, so independent builds must use the same absolute workspace. | |
| PYPROC_BUILDROOT_WORKSPACE: ${{ github.workspace }}/../pyproc-buildroot-${{ matrix.profile }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - name: Build pinned Buildroot guest and legal material | |
| run: npm run assets:buildroot -- --profile ${{ matrix.profile }} | |
| - name: Normalize evidence paths | |
| id: evidence | |
| run: | | |
| echo "dist=$(realpath "$PYPROC_BUILDROOT_WORKSPACE/dist")" >> "$GITHUB_OUTPUT" | |
| echo "legal=$(realpath "$PYPROC_BUILDROOT_WORKSPACE/output/legal-info")" >> "$GITHUB_OUTPUT" | |
| - name: Upload independent build evidence | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: pyproc-buildroot-guest-${{ matrix.profile }}-${{ matrix.slot }} | |
| path: ${{ steps.evidence.outputs.dist }}/ | |
| if-no-files-found: error | |
| retention-days: 30 | |
| - name: Upload complete legal material | |
| if: matrix.slot == 'a' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: pyproc-buildroot-legal-info-${{ matrix.profile }} | |
| path: ${{ steps.evidence.outputs.legal }}/ | |
| if-no-files-found: error | |
| compression-level: 0 | |
| retention-days: 30 | |
| verify: | |
| name: verify-byte-identical-${{ matrix.profile }} | |
| needs: reproduce | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| profile: [linux, node] | |
| steps: | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: pyproc-buildroot-guest-${{ matrix.profile }}-a | |
| path: .cache/repro/a | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: pyproc-buildroot-guest-${{ matrix.profile }}-b | |
| path: .cache/repro/b | |
| - name: Verify image, manifest, SBOM, and legal gate | |
| run: | | |
| set -euo pipefail | |
| cmp .cache/repro/a/build-manifest.json .cache/repro/b/build-manifest.json | |
| cmp .cache/repro/a/buildroot.cyclonedx.json .cache/repro/b/buildroot.cyclonedx.json | |
| mkdir -p .cache/repro/verified | |
| cp .cache/repro/a/* .cache/repro/verified/ | |
| node --input-type=module <<'NODE' | |
| import { createHash } from "node:crypto"; | |
| import { readFile, writeFile } from "node:fs/promises"; | |
| const base = ".cache/repro/verified"; | |
| const manifest = JSON.parse(await readFile(`${base}/build-manifest.json`, "utf8")); | |
| const left = await readFile(`.cache/repro/a/${manifest.output.name}`); | |
| const right = await readFile(`.cache/repro/b/${manifest.output.name}`); | |
| if (!left.equals(right)) throw new Error("independent guest image bytes differ"); | |
| const image = await readFile(`${base}/${manifest.output.name}`); | |
| const actualSha256 = createHash("sha256").update(image).digest("hex"); | |
| if (actualSha256 !== manifest.output.sha256) throw new Error("verified image SHA-256 mismatch"); | |
| if (image.byteLength !== manifest.output.byteLength) throw new Error("verified image byteLength mismatch"); | |
| if (manifest.evidence.legalWarnings.length) throw new Error("verified legal-info warnings are not empty"); | |
| if (manifest.profile === "node") { | |
| if (manifest.runtime?.name !== "node" || manifest.runtimeOracle?.version !== `v${manifest.runtime.version}`) { | |
| throw new Error("verified Node runtime oracle mismatch"); | |
| } | |
| if (manifest.runtimeOracle.sha256 !== manifest.runtime.oracle.sha256) { | |
| throw new Error("verified Node workload digest mismatch"); | |
| } | |
| } | |
| const receipt = { | |
| schemaVersion: 1, | |
| recipe: manifest.recipe, | |
| githubRunId: process.env.GITHUB_RUN_ID, | |
| headSha: process.env.GITHUB_SHA, | |
| independentBuilds: ["a", "b"], | |
| byteIdentical: true, | |
| output: manifest.output, | |
| }; | |
| await writeFile(`${base}/reproducibility-manifest.json`, `${JSON.stringify(receipt, null, 2)}\n`); | |
| NODE | |
| - name: Upload verified reproducible guest | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: pyproc-buildroot-guest-verified-${{ matrix.profile }} | |
| path: .cache/repro/verified/ | |
| if-no-files-found: error | |
| retention-days: 90 |