mirror of
https://github.com/0xWheatyz/handler.git
synced 2026-08-30 07:26:25 +00:00
tester
bcf4f7b0f7
The git-push gate (handler.hooks.gate -> verify.run_build) shells `mise run build-image`, but .mise.toml never defined that task, so every agent push was hard-blocked with "no task build-image found". Define it. The agent sandbox and control image ship no container daemon or builder (by design — no Docker socket, no --privileged), so a real image build can't run at push time. Use hadolint as a daemonless soundness check on both Dockerfiles, with .hadolint.yaml pinning the failure threshold to errors so genuine Dockerfile mistakes block the push while the deliberate, commented style choices (unpinned apt/npm/go) don't. The authoritative end-to-end multi-arch build-and-push stays in CI (.github/workflows/docker*.yml) on every PR to main. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
10 lines
708 B
YAML
10 lines
708 B
YAML
# Config for the daemonless `mise run build-image` pre-push gate (see .mise.toml).
|
|
# Only genuine Dockerfile errors (bad syntax / invalid instructions) should block a push;
|
|
# the deliberate, commented choices in the Dockerfiles are not defects:
|
|
# DL3008 — apt packages are intentionally unpinned (rolling base image).
|
|
# DL3016 — `npm install -g @anthropic-ai/claude-code` tracks the latest Claude Code CLI.
|
|
# DL3062 — `go install ...@latest` is deliberate (forge tracks its latest release).
|
|
# DL4006 — the piped NodeSource/mise setup runs under the default shell on purpose.
|
|
# The authoritative end-to-end multi-arch build runs in CI (.github/workflows/docker*.yml).
|
|
failure-threshold: error
|