From 00ee5f163a026e362158be450b8c13a97987b501 Mon Sep 17 00:00:00 2001 From: DCCONSTRUCTIONS Date: Mon, 31 Aug 2026 21:42:31 +0300 Subject: [PATCH] fix(worker): keep commit labels shell-safe --- .../worker/observatory_portable/Dockerfile.worker-006-agent | 2 +- .../observatory_portable/Install-Worker006AgentImage.ps1 | 4 ++-- tests/test_observatory_worker_agent_image_artifact.py | 4 ++++ tests/test_worker_006_agent_image_installer.py | 5 +++++ 4 files changed, 12 insertions(+), 3 deletions(-) diff --git a/experiments/perception/worker/observatory_portable/Dockerfile.worker-006-agent b/experiments/perception/worker/observatory_portable/Dockerfile.worker-006-agent index 79bbb38..b4814eb 100644 --- a/experiments/perception/worker/observatory_portable/Dockerfile.worker-006-agent +++ b/experiments/perception/worker/observatory_portable/Dockerfile.worker-006-agent @@ -72,7 +72,7 @@ RUN mkdir -p /run/nodedc/registries \ && find /opt/nodedc/mission-core -type f -exec chmod 0444 {} + \ && python3 -c "import k1link.observatory.m49_worker_container_main as entrypoint; import k1link.observatory.m49_worker_service as composition; assert callable(entrypoint.main); assert callable(composition.compose_installed_m49_worker_service)" -LABEL org.opencontainers.image.title="NODE.DC Observatory Worker 006 agent" \ +LABEL org.opencontainers.image.title="NODE.DC-Observatory-Worker-006-agent" \ org.opencontainers.image.source="NODEDC_MISSION_CORE" \ org.opencontainers.image.revision="${NODEDC_SOURCE_REVISION}" \ com.nodedc.product="mission-core" \ diff --git a/experiments/perception/worker/observatory_portable/Install-Worker006AgentImage.ps1 b/experiments/perception/worker/observatory_portable/Install-Worker006AgentImage.ps1 index 321ab9a..9fe466b 100644 --- a/experiments/perception/worker/observatory_portable/Install-Worker006AgentImage.ps1 +++ b/experiments/perception/worker/observatory_portable/Install-Worker006AgentImage.ps1 @@ -537,7 +537,7 @@ function Assert-ImageContract { [int64]$DependencyManifest.byte_length ).ToString([Globalization.CultureInfo]::InvariantCulture) $expectedLabels = [ordered]@{ - "org.opencontainers.image.title" = "NODE.DC Observatory Worker 006 agent" + "org.opencontainers.image.title" = "NODE.DC-Observatory-Worker-006-agent" "org.opencontainers.image.source" = "NODEDC_MISSION_CORE" "org.opencontainers.image.revision" = $SourceRevision "com.nodedc.product" = "mission-core" @@ -1061,7 +1061,7 @@ try { "--change", "USER 0:0", "--change", "ENTRYPOINT $ImageEntrypoint", "--change", "CMD $ImageCommand", - "--change", 'LABEL org.opencontainers.image.title="NODE.DC Observatory Worker 006 agent"', + "--change", "LABEL org.opencontainers.image.title=NODE.DC-Observatory-Worker-006-agent", "--change", "LABEL org.opencontainers.image.source=NODEDC_MISSION_CORE", "--change", "LABEL org.opencontainers.image.revision=$SourceRevision", "--change", "LABEL com.nodedc.product=mission-core", diff --git a/tests/test_observatory_worker_agent_image_artifact.py b/tests/test_observatory_worker_agent_image_artifact.py index dd29d67..2f70c1a 100644 --- a/tests/test_observatory_worker_agent_image_artifact.py +++ b/tests/test_observatory_worker_agent_image_artifact.py @@ -69,6 +69,10 @@ def test_agent_dockerfile_is_offline_commit_bound_and_model_free() -> None: assert "org.opencontainers.image.revision=\"${NODEDC_SOURCE_REVISION}\"" in payload assert "com.nodedc.build-context.sha256=\"${NODEDC_BUILD_CONTEXT_SHA256}\"" in payload assert "com.nodedc.models=\"external\"" in payload + assert ( + 'org.opencontainers.image.title="NODE.DC-Observatory-Worker-006-agent"' + in payload + ) assert f"PYTHONPATH=/opt/nodedc/mission-core/src:{DEPENDENCY_IMAGE_PATH}" in payload assert 'ENTRYPOINT ["python3", "-m", "k1link.observatory.m49_worker_container_main"]' in payload assert "CMD []" in payload diff --git a/tests/test_worker_006_agent_image_installer.py b/tests/test_worker_006_agent_image_installer.py index fddf229..32beabf 100644 --- a/tests/test_worker_006_agent_image_installer.py +++ b/tests/test_worker_006_agent_image_installer.py @@ -27,6 +27,11 @@ def test_worker_agent_installer_is_local_offline_and_non_buildkit() -> None: assert "--security-opt no-new-privileges" in script assert "target=/nodedc-build-source,readonly" in script assert "docker commit --pause=true @changes $containerId $tag" in script + assert ( + "LABEL org.opencontainers.image.title=" + "NODE.DC-Observatory-Worker-006-agent" + ) in script + assert 'title="NODE.DC Observatory Worker 006 agent"' not in script assert "docker rm -f $containerId" in script assert "docker rm -f $containerName" not in script