Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Ship darnit itself in a hermetic container to eliminate host-environment as an audit-nondeterminism source

Abierto
  • ¿Algo no está bien?
#423 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
48/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
docker, github-actions, python
Área
devops, infrastructure, release

Línea de trabajo

Start by reading feature 012 and its existing release assets to find where packaging, GHCR publishing, signing, and SBOM generation belong. Then inspect the workspace Python target, lockfile, release runbook, and CI setup; the issue names packaging/Dockerfile as a possible location. Done means a pinned non-root image is published with the existing release surfaces, documented usage, and a CI smoke test that runs a mock audit against a fixture repo.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

infrastructure

Summary

Short-term shippable companion to the determinism set (#418-#421):
publish darnit itself as a pinned container image so audit output is
not influenced by the operator's host environment (Python version,
gh CLI version, git version, tree-sitter version, LLM SDK version,
etc.).

This does not help the audited repo's reproducibility. It closes a
different loop: darnit's own audit runs are more reproducible across
operators when everyone runs the same pinned binaries.

Scope

  • Add a Dockerfile at packaging/Dockerfile (or wherever feature 012
    already lands packaging assets):
    • Pin Python interpreter version (matching workspace target).
    • uv sync --frozen for lockfile-pinned deps.
    • Install pinned versions of gh CLI, git, syft, cosign as
      needed by darnit's exec handlers.
    • Non-root user; minimal working-dir layout.
    • ENTRYPOINT ["darnit"].
  • Publish under the same release surfaces feature 012 already uses
    (GHCR image, cosign-signed, SBOM via syft).
  • Document usage in the release runbook (mount repo as
    /workspace, pass GH_TOKEN, ANTHROPIC_API_KEY env vars).
  • Add a smoke-test in CI that pulls the image and runs a mock audit
    against a fixture repo to catch regressions.

Non-goals for v0

  • Automatic invocation from darnit audit (the container is a
    distribution shape, not a runtime dependency of the CLI).
  • Devcontainer image for darnit development (separate concern;
    the shipped image is for audit execution).
  • Rootless / distroless base variants (nice-to-have; revisit if
    operators ask).
  • Reproducible-build guarantees on the image itself (bit-for-bit
    container reproducibility is #227 / feature 012's territory).

Constitution alignment

  • II. Conservative-by-Default: eliminating host-env drift from
    audit output preserves the "same commit -> same verdict" invariant
    that the determinism issues (#418 in particular) are chasing at
    the code-path level.

Related

  • 012-packaging-distribution -- reuses the existing release
    infrastructure (SBOM, cosign, GHCR).
  • #227 (HermeticBuild -- evolve beyond grep-based heuristic) --
    the image itself is a small proof point that darnit knows how to
    ship a hermetic build.
  • #418 (Determinism Tier 1) -- companion; a hermetic runner
    closes the host-side lever the code-side determinism fixes leave
    open.
  • Design conversation 2026-09-05 -- filed as short-term
    companion to the environment-generation sieve issue (filed
    alongside this one) while that ambitious sieve is still in
    investigation.
Lenguaje dominante
Python
Estrellas
22
Forks
27
Merge medio
1 d 20 h
PR fusionados (30 d)
39

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de darnitdevorg/darnit

Todos los issues de darnitdevorg/darnit

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.