From 5a02b8f0c1aade50d21ba917babcceefa39a7165 Mon Sep 17 00:00:00 2001 From: Shane Maynard Date: Sun, 4 Oct 2026 08:23:52 -0400 Subject: [PATCH] fix: stream tracked source into CI qualification container --- .gitea/workflows/rebuild.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/rebuild.yml b/.gitea/workflows/rebuild.yml index 9f99609..580c273 100644 --- a/.gitea/workflows/rebuild.yml +++ b/.gitea/workflows/rebuild.yml @@ -12,11 +12,14 @@ jobs: - name: Qualify offline account and chat contracts before building or deploying run: | # No NAS, speech SDK, model calls or legacy live-default conftest. - # Read-only source mount; test secrets and databases use container /tmp. - docker run --rm --user "$(id -u):$(id -g)" \ + # The socket-backed runner checkout path is not a host bind source. + # Stream only tracked source; secrets/runtime files are never included. + git archive HEAD | docker run --rm -i --user "$(id -u):$(id -g)" \ -e HOME=/tmp -e PYTHONDONTWRITEBYTECODE=1 \ - -v "$PWD:/src:ro" -w /src python:3.12-slim-bookworm \ - sh -eu -c ' + python:3.12-slim-bookworm sh -eu -c ' + mkdir -p /tmp/src + tar -xf - -C /tmp/src + cd /tmp/src python -m venv /tmp/offline-tests /tmp/offline-tests/bin/python -m pip install --no-cache-dir pytest pytest-asyncio -r control/requirements.txt /tmp/offline-tests/bin/python scripts/generate_hope_themes.py --check