Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Ship darnit itself in a hermetic container to eliminate host-environment as an audit-nondeterminism source

オープン
  • 何か問題がありますか？
#423 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
48/100
issue の種類
機能追加
明瞭さ
おおむね明確
活発さ
活発
技術スタック
docker, github-actions, python
領域
devops, infrastructure, release

調査の方向性

Start by reading feature 012 and its existing release assets to find where packaging, GHCR publishing, signing, and SBOM generation belong. Then inspect the workspace Python target, lockfile, release runbook, and CI setup; the issue names packaging/Dockerfile as a possible location. Done means a pinned non-root image is published with the existing release surfaces, documented usage, and a CI smoke test that runs a mock audit against a fixture repo.

索引モデルが issue の本文から書いたものです。

説明

infrastructure

Summary

Short-term shippable companion to the determinism set (#418-#421):
publish darnit itself as a pinned container image so audit output is
not influenced by the operator's host environment (Python version,
gh CLI version, git version, tree-sitter version, LLM SDK version,
etc.).

This does not help the audited repo's reproducibility. It closes a
different loop: darnit's own audit runs are more reproducible across
operators when everyone runs the same pinned binaries.

Scope

  • Add a Dockerfile at packaging/Dockerfile (or wherever feature 012
    already lands packaging assets):
    • Pin Python interpreter version (matching workspace target).
    • uv sync --frozen for lockfile-pinned deps.
    • Install pinned versions of gh CLI, git, syft, cosign as
      needed by darnit's exec handlers.
    • Non-root user; minimal working-dir layout.
    • ENTRYPOINT ["darnit"].
  • Publish under the same release surfaces feature 012 already uses
    (GHCR image, cosign-signed, SBOM via syft).
  • Document usage in the release runbook (mount repo as
    /workspace, pass GH_TOKEN, ANTHROPIC_API_KEY env vars).
  • Add a smoke-test in CI that pulls the image and runs a mock audit
    against a fixture repo to catch regressions.

Non-goals for v0

  • Automatic invocation from darnit audit (the container is a
    distribution shape, not a runtime dependency of the CLI).
  • Devcontainer image for darnit development (separate concern;
    the shipped image is for audit execution).
  • Rootless / distroless base variants (nice-to-have; revisit if
    operators ask).
  • Reproducible-build guarantees on the image itself (bit-for-bit
    container reproducibility is #227 / feature 012's territory).

Constitution alignment

  • II. Conservative-by-Default: eliminating host-env drift from
    audit output preserves the "same commit -> same verdict" invariant
    that the determinism issues (#418 in particular) are chasing at
    the code-path level.

Related

  • 012-packaging-distribution -- reuses the existing release
    infrastructure (SBOM, cosign, GHCR).
  • #227 (HermeticBuild -- evolve beyond grep-based heuristic) --
    the image itself is a small proof point that darnit knows how to
    ship a hermetic build.
  • #418 (Determinism Tier 1) -- companion; a hermetic runner
    closes the host-side lever the code-side determinism fixes leave
    open.
  • Design conversation 2026-09-05 -- filed as short-term
    companion to the environment-generation sieve issue (filed
    alongside this one) while that ambitious sieve is still in
    investigation.
主要言語
Python
スター
22
フォーク
27
平均マージ
2日 1時間
マージ済み PR（30日）
35

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

darnitdevorg/darnit のほかの issue

darnitdevorg/darnit の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。