mirror of
https://github.com/feder-cr/Jobs_Applier_AI_Agent.git
synced 2026-11-07 02:35:57 -10:00
feder-cr
2968ca8372
A Dot keeps the golden image it was made from and boots every new runtime disk, so the engine already talked to servers other than the one its pinned copy of the interface described. The engine now reads the interface from the installed server when it starts (nanobot/dots/server_interface.py, server_capture.py run as dot by the server's own python): the page tools are what that server serves, a page tool it does not serve is not offered (GET /tools says so), and a Dot whose server cannot be read offers no page tool and its launches say why. With nothing in the engine tied to a version, the image no longer pins one: each build asks PyPI for the newest invisible-playwright-mcp, the newest invisible-playwright it accepts and the invisible-core that one pins (browser-release.ts). The three enter the inputs digest, pins.env and the manifest, which records what was installed. mcp-requirements.lock and capture-mcp-interface.py go; the copy of the interface becomes a test fixture. The owner's no-other-browser rule is checked at build on what was actually installed (builder/other-browsers.txt), and the golden image workflow runs every six hours so a new release is published as a prebuilt image.
77 lines
3.3 KiB
YAML
77 lines
3.3 KiB
YAML
name: golden image
|
|
|
|
# Builds the golden image once, here, and publishes it as the release golden-<inputs digest>, which
|
|
# `invisible-dots image build` downloads instead of building (guest/image-builder/src/prebuilt.ts). The digest is the
|
|
# one every host computes from the pinned inputs and the newest release of the Dot's browser on the package index
|
|
# (browser-release.ts), so a host only ever takes the image of its own inputs. A digest that already has its release
|
|
# is not built again.
|
|
#
|
|
# The schedule is what makes a new release of the browser reach the hosts as a prebuilt image: no file of this
|
|
# repository changes when one is published, and the next run here finds a new digest and builds it.
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- guest/image-builder/**
|
|
- virtualization/images/**
|
|
schedule:
|
|
- cron: "17 */6 * * *"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
concurrency:
|
|
group: golden-image
|
|
cancel-in-progress: false
|
|
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
|
|
jobs:
|
|
build:
|
|
name: build and publish the golden image
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 180
|
|
env:
|
|
INVISIBLE_DOTS_HOME: ${{ github.workspace }}/../idots-home
|
|
GH_TOKEN: ${{ github.token }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "24"
|
|
cache: npm
|
|
- uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: guest/dot-agentd/go.mod
|
|
- name: KVM for the builder VM, and QEMU
|
|
run: |
|
|
echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
|
|
sudo udevadm control --reload-rules
|
|
sudo udevadm trigger --name-match=kvm
|
|
sudo apt-get update -qq
|
|
sudo apt-get install -y -qq --no-install-recommends qemu-system-x86 qemu-utils
|
|
- run: npm ci --no-audit --no-fund
|
|
- run: npm run build --workspace @invisible-dots/cli
|
|
# The runtime ISO, which `image build` makes first, carries dot-agentd.
|
|
- working-directory: guest/dot-agentd
|
|
run: CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -buildvcs=false -ldflags="-s -w" -o bin/dot-agentd ./cmd/dot-agentd
|
|
- name: the image (downloaded instead when its release exists already)
|
|
id: build
|
|
run: |
|
|
node apps/cli/dist/invisible-dots.mjs image build --compress | tee build.log
|
|
tag=$(node .github/scripts/golden-release.mjs "$INVISIBLE_DOTS_HOME/images" "$RUNNER_TEMP/release")
|
|
echo "tag=$tag" >> "$GITHUB_OUTPUT"
|
|
- name: publish
|
|
run: |
|
|
tag='${{ steps.build.outputs.tag }}'
|
|
if gh release view "$tag" >/dev/null 2>&1; then
|
|
echo "$tag is published already"
|
|
exit 0
|
|
fi
|
|
gh release create "$tag" "$RUNNER_TEMP"/release/* \
|
|
--title "Golden image $tag" \
|
|
--notes "The golden image of the inputs ${tag#golden-}, built by the golden image workflow from ${GITHUB_SHA}. invisible-dots image build downloads it when a checkout's inputs have this digest. It holds Ubuntu 24.04, the software guest/image-builder/pins.json and the engine's lock name, and the release of invisible-playwright-mcp its manifest records, each under its own license (THIRD_PARTY_NOTICES.md)."
|