Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Ship darnit itself in a hermetic container to eliminate host-environment as an audit-nondeterminism source

未关闭
  • 哪里不对？
#423 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
48/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
活跃
技术栈
docker, github-actions, python
领域
devops, infrastructure, release

调研方向

Start by reading feature 012 and its existing release assets to find where packaging, GHCR publishing, signing, and SBOM generation belong. Then inspect the workspace Python target, lockfile, release runbook, and CI setup; the issue names packaging/Dockerfile as a possible location. Done means a pinned non-root image is published with the existing release surfaces, documented usage, and a CI smoke test that runs a mock audit against a fixture repo.

由索引模型根据 Issue 内容生成。

描述

infrastructure

Summary

Short-term shippable companion to the determinism set (#418-#421):
publish darnit itself as a pinned container image so audit output is
not influenced by the operator's host environment (Python version,
gh CLI version, git version, tree-sitter version, LLM SDK version,
etc.).

This does not help the audited repo's reproducibility. It closes a
different loop: darnit's own audit runs are more reproducible across
operators when everyone runs the same pinned binaries.

Scope

  • Add a Dockerfile at packaging/Dockerfile (or wherever feature 012
    already lands packaging assets):
    • Pin Python interpreter version (matching workspace target).
    • uv sync --frozen for lockfile-pinned deps.
    • Install pinned versions of gh CLI, git, syft, cosign as
      needed by darnit's exec handlers.
    • Non-root user; minimal working-dir layout.
    • ENTRYPOINT ["darnit"].
  • Publish under the same release surfaces feature 012 already uses
    (GHCR image, cosign-signed, SBOM via syft).
  • Document usage in the release runbook (mount repo as
    /workspace, pass GH_TOKEN, ANTHROPIC_API_KEY env vars).
  • Add a smoke-test in CI that pulls the image and runs a mock audit
    against a fixture repo to catch regressions.

Non-goals for v0

  • Automatic invocation from darnit audit (the container is a
    distribution shape, not a runtime dependency of the CLI).
  • Devcontainer image for darnit development (separate concern;
    the shipped image is for audit execution).
  • Rootless / distroless base variants (nice-to-have; revisit if
    operators ask).
  • Reproducible-build guarantees on the image itself (bit-for-bit
    container reproducibility is #227 / feature 012's territory).

Constitution alignment

  • II. Conservative-by-Default: eliminating host-env drift from
    audit output preserves the "same commit -> same verdict" invariant
    that the determinism issues (#418 in particular) are chasing at
    the code-path level.

Related

  • 012-packaging-distribution -- reuses the existing release
    infrastructure (SBOM, cosign, GHCR).
  • #227 (HermeticBuild -- evolve beyond grep-based heuristic) --
    the image itself is a small proof point that darnit knows how to
    ship a hermetic build.
  • #418 (Determinism Tier 1) -- companion; a hermetic runner
    closes the host-side lever the code-side determinism fixes leave
    open.
  • Design conversation 2026-09-05 -- filed as short-term
    companion to the environment-generation sieve issue (filed
    alongside this one) while that ambitious sieve is still in
    investigation.
主要语言
Python
星标
22
派生
27
平均合并
1 天 19 小时
30 天内合并 PR
39

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

darnitdevorg/darnit 的其他 Issue

查看 darnitdevorg/darnit 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。