open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-20 16:07:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(ql3): ship local process launcher asset

Browse Source
This commit is contained in:
whyour
2026-08-28 08:31:14 +08:00
parent ce4284ff76
commit 920a31fb66
3 changed files with 59 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/containers/ql3-local-application/Dockerfile
+8
View File
@@ -123,6 +123,8 @@ COPY --from=workspace /workspace/packages/ql3-local-process/package.json \
node_modules/@qinglong/local-process/package.json
COPY --from=workspace /workspace/packages/ql3-local-process/dist \
node_modules/@qinglong/local-process/dist
COPY --from=workspace /workspace/packages/ql3-local-process/assets \
node_modules/@qinglong/local-process/assets
COPY --from=workspace /workspace/packages/ql3-local-secret/package.json \
node_modules/@qinglong/local-secret/package.json
COPY --from=workspace /workspace/packages/ql3-local-secret/dist \
@@ -132,6 +134,8 @@ COPY --from=workspace /workspace/packages/ql3-local-sqlite/package.json \
COPY --from=workspace /workspace/packages/ql3-local-sqlite/dist \
node_modules/@qinglong/local-sqlite/dist
RUN chmod 0555 node_modules/@qinglong/local-process/assets/ql3-launcher.sh
RUN rm -rf node_modules/.bin \
&& node /tmp/ql3-prune-runtime-artifact.cjs node_modules/@qinglong \
@qinglong/local-application \
@@ -190,6 +194,8 @@ COPY --from=workspace /workspace/packages/ql3-local-process/package.json \
node_modules/@qinglong/local-process/package.json
COPY --from=workspace /workspace/packages/ql3-local-process/dist \
node_modules/@qinglong/local-process/dist
COPY --from=workspace /workspace/packages/ql3-local-process/assets \
node_modules/@qinglong/local-process/assets
COPY --from=workspace /workspace/packages/ql3-local-secret/package.json \
node_modules/@qinglong/local-secret/package.json
COPY --from=workspace /workspace/packages/ql3-local-secret/dist \
@@ -199,6 +205,8 @@ COPY --from=workspace /workspace/packages/ql3-local-sqlite/package.json \
COPY --from=workspace /workspace/packages/ql3-local-sqlite/dist \
node_modules/@qinglong/local-sqlite/dist
RUN chmod 0555 node_modules/@qinglong/local-process/assets/ql3-launcher.sh
RUN rm -rf node_modules/.bin \
&& node /tmp/ql3-prune-runtime-artifact.cjs node_modules/@qinglong \
@qinglong/local-api/config \
scripts/ql3-local-image-audit.cjs
+16 -6
View File
@@ -266,6 +266,13 @@ function auditDockerfile(contents, findings) {
sortedObject(
Object.fromEntries(RUNTIME_PACKAGES.map((name) => [name, 2])),
),
) ||
!assembledStage.includes(
'COPY --from=workspace /workspace/packages/ql3-local-process/assets \\\n' +
' node_modules/@qinglong/local-process/assets',
) ||
!assembledStage.includes(
'RUN chmod 0555 node_modules/@qinglong/local-process/assets/ql3-launcher.sh',
)
) {
addFinding(findings, 'RUNTIME_INTERNAL_PACKAGE_CLOSURE_DRIFT');
@@ -280,14 +287,19 @@ function auditDockerfile(contents, findings) {
!sameJson(
sortedObject(consoleRuntimeCopyCounts),
sortedObject(
Object.fromEntries(
CONSOLE_RUNTIME_PACKAGES.map((name) => [name, 2]),
),
Object.fromEntries(CONSOLE_RUNTIME_PACKAGES.map((name) => [name, 2])),
),
) ||
!consoleAssembledStage.includes(
'COPY --from=workspace /workspace/packages/ql3-local-api/assets \\\n' +
' node_modules/@qinglong/local-api/assets',
) ||
!consoleAssembledStage.includes(
'COPY --from=workspace /workspace/packages/ql3-local-process/assets \\\n' +
' node_modules/@qinglong/local-process/assets',
) ||
!consoleAssembledStage.includes(
'RUN chmod 0555 node_modules/@qinglong/local-process/assets/ql3-launcher.sh',
)
) {
addFinding(findings, 'CONSOLE_RUNTIME_INTERNAL_PACKAGE_CLOSURE_DRIFT');
@@ -448,9 +460,7 @@ function auditLocalImageContract(root) {
),
consoleRuntimePackages: Object.freeze(
[
...CONSOLE_RUNTIME_PACKAGES.map(
(name) => `@qinglong/${name.slice(4)}`,
),
...CONSOLE_RUNTIME_PACKAGES.map((name) => `@qinglong/${name.slice(4)}`),
...Object.keys(RUNTIME_DEPENDENCIES),
].sort(),
),
test/back/ql3LocalImageAudit.test.cjs
+35 -7
View File
@@ -89,19 +89,47 @@ test('rejects Console assets, loopback identity or retained JavaScript drift', (
'--retain-js=local-api/assets/console/console.js',
'--retain-js=local-api/assets/console/unreviewed.js',
)
.replace('io.qinglong.local.console="offline-loopback"', 'io.qinglong.local.console="public"');
.replace(
'io.qinglong.local.console="offline-loopback"',
'io.qinglong.local.console="public"',
);
fs.writeFileSync(dockerfilePath, dockerfile);
const report = auditLocalImageContract(current.root);
assert.equal(report.compatible, false);
assert.ok(
report.findings.some(
({ code }) => code === 'CONSOLE_RUNTIME_NONESSENTIAL_FILES_NOT_REMOVED',
),
);
assert.ok(
report.findings.some(
({ code }) => code === 'CONSOLE_RUNTIME_IDENTITY_OR_LABEL_DRIFT',
),
);
} finally {
current.close();
}
});
test('rejects a Local runtime without the verified process launcher asset', () => {
const current = fixture();
try {
const dockerfilePath = path.join(current.target, 'Dockerfile');
const dockerfile = fs
.readFileSync(dockerfilePath, 'utf8')
.replaceAll(
'COPY --from=workspace /workspace/packages/ql3-local-process/assets \\\n' +
' node_modules/@qinglong/local-process/assets\n',
'',
);
fs.writeFileSync(dockerfilePath, dockerfile);
const report = auditLocalImageContract(current.root);
assert.equal(report.compatible, false);
assert.ok(
report.findings.some(
({ code }) =>
code === 'CONSOLE_RUNTIME_NONESSENTIAL_FILES_NOT_REMOVED',
),
);
assert.ok(
report.findings.some(
({ code }) => code === 'CONSOLE_RUNTIME_IDENTITY_OR_LABEL_DRIFT',
code === 'RUNTIME_INTERNAL_PACKAGE_CLOSURE_DRIFT' ||
code === 'CONSOLE_RUNTIME_INTERNAL_PACKAGE_CLOSURE_DRIFT',
),
);
} finally {