Jens/geointel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): cap Syft heap inside DinD
Managed validation / Managed repository validation (pull_request) Successful in 2m39s
Details
GeoIntel release gates / Compile, test, contracts and builds (pull_request) Successful in 2m49s
Details
GeoIntel release gates / Python and npm vulnerability policy (pull_request) Successful in 31s
Details
GeoIntel release gates / Production AI image, SBOM and container scan (pull_request) Successful in 7m31s
Details
GeoIntel release gates / Deploy exact gated revision to Unraid (pull_request) Skipped
Details

Browse Source
This commit is contained in:
Jens
2026-08-30 13:25:37 +02:00
parent aec584d433
commit 9f771a61cf
2 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/tests/test_rc6_supply_chain.py
+2
View File
@@ -123,6 +123,8 @@ def test_scanner_images_are_versioned_and_digest_pinned() -> None:
assert 'docker save "$IMAGE_ID"' in sbom assert 'docker save "$IMAGE_ID"' in sbom
assert '"docker-archive:$WORKDIR/$IMAGE_ARCHIVE"' in sbom assert '"docker-archive:$WORKDIR/$IMAGE_ARCHIVE"' in sbom
assert 'SYFT_PARALLELISM=${SYFT_PARALLELISM:-1}' in sbom assert 'SYFT_PARALLELISM=${SYFT_PARALLELISM:-1}' in sbom
assert 'GOMEMLIMIT=${SYFT_GOMEMLIMIT:-4GiB}' in sbom
assert 'GOGC=${SYFT_GOGC:-25}' in sbom
assert "--select-catalogers=-binary" in sbom assert "--select-catalogers=-binary" in sbom
assert '--volumes-from "$HOSTNAME"' in sbom assert '--volumes-from "$HOSTNAME"' in sbom
assert 'ARCHIVE_ID_FILE="${IMAGE_ARCHIVE}.image-id"' in sbom assert 'ARCHIVE_ID_FILE="${IMAGE_ARCHIVE}.image-id"' in sbom
scripts/generate_container_sbom.sh
+7 -4
View File
@@ -57,13 +57,16 @@ if [[ -n "${HOSTNAME:-}" ]] && docker inspect --type container "$HOSTNAME" >/dev
WORKSPACE_ARGS=(--volumes-from "$HOSTNAME") WORKSPACE_ARGS=(--volumes-from "$HOSTNAME")
fi fi
# CUDA and PyTorch ship several gigabytes of native binaries. Syft's heuristic # CUDA and PyTorch ship several gigabytes of native binaries. Keep Syft's Go
# binary catalogers exceed the isolated runner's 8 GiB limit on that content. # heap below the isolated runner's 8 GiB limit and collect garbage proactively;
# Authoritative dpkg, Python, npm and other installed-package catalogers remain # otherwise the Docker-in-Docker job can be OOM-killed even with one cataloger
# enabled; Trivy still scans the complete immutable archive independently. # worker. Authoritative dpkg, Python, npm and other installed-package catalogers
# remain enabled; Trivy still scans the complete immutable archive independently.
docker run --rm \ docker run --rm \
--user 0:0 \ --user 0:0 \
-e "SYFT_PARALLELISM=${SYFT_PARALLELISM:-1}" \ -e "SYFT_PARALLELISM=${SYFT_PARALLELISM:-1}" \
-e "GOMEMLIMIT=${SYFT_GOMEMLIMIT:-4GiB}" \
-e "GOGC=${SYFT_GOGC:-25}" \
"${WORKSPACE_ARGS[@]}" \ "${WORKSPACE_ARGS[@]}" \
-w "$WORKDIR" \ -w "$WORKDIR" \
"$SYFT_IMAGE" \ "$SYFT_IMAGE" \