zcode_mulm
b3b4e2b391
迁移自 mu-ref/est-ci-reusable（模板三修复版：est-bundle CA、verify 解释器 无关、build-arg 无内嵌引号、revision-arg-name、install+quality 单容器、 verdaccio add-host）+ Est-Infra 的 source-policy/REGISTER/ci-stats 上移； 全部去项目专名。架构依据 coordination runbooks/ci-repo-architecture.md。
1.6 KiB
1.6 KiB
CI helper image register (digest-pinned)
Rules:
- Workflows MUST reference helper images by index digest (
@sha256:...), never by bare tag. - Every bake updates the table below and pushes
est/<name>:vN(tag kept for humans; digest is the identity). - Bake Dockerfiles live under
tools/ci/helper/(to be added in P1; current images were baked on tn by zcode during M1-416).
| name | tag | index digest | amd64 manifest digest | size | contents |
|---|---|---|---|---|---|
| ci-node-bookworm | v1 | sha256:78c01b0be47ebc60c0fa940110d66c60ca4e57f0fa57178bb88788e4ea131b61 | sha256:76cf59f18cca34a25c864b9305f42983e56aa5d3c918657827822a83d794dc35 | 585MB | node + mirrored apt, docker-ce-cli (tuna docker-ce apt, GPG-verified), chromium runtime GUI libs, git/perl (F1 foundation) |
| ci-node-alpine | v1 | sha256:a08d2cea4d69e3cf831be410e5e62a72a55a9bf8e9b0c3fcef4df553f9f181e6 | sha256:f4795742c2e53d6df221659af81a385e887d60873637ba34ce36c86f13261a6c | 86MB | node + alpine docker-cli, mirrors pre-swapped (F2) |
Usage conventions (proven on the business-repo pipelines)
- Mounts (verify/build containers): docker.sock,
$HOME/.docker/config.json(ro), host CA (ro), host buildx plugin (ro), workspace. - Env:
SSL_CERT_FILE+NODE_EXTRA_CA_CERTSpoint at the mounted CA. - Cache dirs: directory level 0777 only; never
chmod -R(selection files are validated 0600). - Registry references: bare repo +
@digest(docker 29 rejectsrepo:tag@digest).
TODO (P1)
- Add the two Dockerfiles under
tools/ci/helper/so rebakes are reproducible. - Record bake receipts (apt/apk mirror used, timings) per bake in a changelog.