Ralph Bean ralphbean

Stage orchestration models

Three distinct mental models have emerged in the PR #201 discussion for how stages, sandboxes, scripts, and agents relate to each other. They agree on many things but differ on where orchestration logic lives and what runs inside vs. outside the sandbox.

Common ground

All three models agree on:

Pre-scripts and post-scripts run outside the sandbox (post needs git push, gh pr; pre may gather data the sandbox can't access).
The sandbox enforces network, filesystem, and process isolation.

title: "10. Per-org GitHub Apps for agent identity" status: Proposed relates_to:

agent-architecture
agent-infrastructure
security-threat-model topics:
security
credentials

Fedora Konflux Cluster

See https://github.com/konflux-ci/community/blob/main/sigs/fedora/cluster.md

This uses the rpm list from here as an input in rpms.in: https://gitlab.com/CentOS/automotive/container-images/-/raw/main/images/autosd-buildbox/Containerfile?ref_type=heads

Generate rpms.txt by using the dnf lockfile plugin prototype like this:

❯ dnf lockfile --recursive $(cat rpms.in)
Wrote 406 packages to rpms.txt

Install them like this:

	FROM registry.redhat.io/ubi9/ubi:latest

	RUN dnf -y install podman

	# Change the graph root.
	RUN sed -i 's/^graphroot = .*/graphroot = "\/usr\/lib\/containers\/storage"/' /etc/containers/storage.conf
	# Ignore chown errors
	RUN sed -i 's/#ignore_chown_errors = "false"/ignore_chown_errors = "true"/' /etc/containers/storage.conf

	# TEST workaround for bootc-build-image error (maybe overlay issue)

	#!/usr/bin/env python
	""" Write oci-copy.yaml file based on latest data in hugginface

	In order to get the latest revision:

	$ python3 refresh-oci-copy-file.py prometheus-eval/prometheus-8x7b-v2.0

	In order to get files and digests for a specific revision in the history:

	$ python3 refresh-oci-copy-file.py --revision e0bb4692356a1738acf25f15180e9f025725b0f2 prometheus-eval/prometheus-8x7b-v2.0

	#!/bin/bash -e
	# A script to pull down multiarch artifacts with conflicting names stored in a single image index

	PULLSPEC=$1
	REPO=$(echo $PULLSPEC \| awk -F ':' '{ print $1 }')
	TAG=$(echo $PULLSPEC \| awk -F ':' '{ print $2 }')

	IMAGE_INDEX=$(oras manifest fetch $PULLSPEC)

	OUTPUT=output/

	#!/bin/bash -e
	# Given a filename with a pipelines-as-code pipelinerun and a task name within it
	# remove the bundle taskref and replace it with an inline version of the task definition.
	# For hacking.

	filename=$1
	taskname=$2

	prefix=".spec.pipelineSpec"
	kind=$(yq .kind "$filename")

	#!/usr/bin/env python

	import argparse
	import os
	import sys

	import jira


	def get_args():

	#!/bin/sh

	echo "hello world!"