Install the pinned reachability engine in the Docker image - #345
Open
lelia wants to merge 1 commit into
Open
Conversation
The image installed @coana-tech/cli unpinned while the launcher asks npx for DEFAULT_COANA_CLI_VERSION. npx reuses the global install only when the versions match, so once the two diverged every scan re-downloaded the engine (~119 MB) and the launcher took roughly three times as long, silently. The Dockerfile now reads the pinned version out of reachability.py, so the image and the runtime cannot drift and the pin stays bumped in exactly one place. Splitting the coana install out of the toolchain RUN keeps a pin bump to a 353 MB layer rather than rebuilding the 2.3 GB combined layer. Marking a release stable now builds that version from its own tag, so an older wheel is no longer paired with the default branch's build recipe and pin. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Dockerfileinstalled@coana-tech/cliunpinned, while the launcher asks npx for the version inDEFAULT_COANA_CLI_VERSION. npx reuses the image's global install only when the versions match; on a mismatch it downloads the engine again on every scan.Measured in the published image:
The two agreed only because release rebuilds happened to follow the pin bumps. Nothing enforced it, and the failure mode is silent — no error, no test failure, just slower scans and extra egress.
Change
reachability.pyand installs exactly that, failing the build if the value cannot be read. The pin stays bumped in one place, so the image and the runtime cannot drift.RUN. A pin bump now rebuilds a 353 MB layer instead of the 2.3 GB combined layer.socketsecurity==inputs.versionfrom PyPI, so building from the default branch paired an old wheel with a newer build recipe and pin.tests/unit/test_dockerfile_coana_pin.pyruns the Dockerfile's own extraction expression against the real source and rejects an unpinned install.Dockerfilewas added to the unit-test path filter so the guard runs on Dockerfile-only changes.Verification
15.10.36;socketcli --helpandcoana-cliboth work.Could not read DEFAULT_COANA_CLI_VERSION from reachability.pyrather than silently installing unpinned.sed.e2e-reachability needs to run here — this changes how the engine is installed, so it is the meaningful gate.
Not included
socketnpm is still installed unpinned and the npm cache is still shipped in the image. Both are tracked separately.Refs: CE-431
Note
Medium Risk
Changes how the published Docker image installs the reachability engine and how stable releases are checked out; misconfiguration could cause failed builds or resumed per-scan downloads, but runtime scan logic is unchanged.
Overview
Fixes Docker scans re-downloading the reachability engine when the image’s global
@coana-tech/clididn’t match what the CLI requests vianpx @coana-tech/cli@DEFAULT_COANA_CLI_VERSION.The Dockerfile now copies
reachability.py, extracts the pin withsed, and runsnpm install @coana-tech/cli@<that version>(build fails if extraction fails). The Coana install is split into its own layer so pin bumps don’t rebuild the larger toolchain step. Mark release as stable checks outref: v${{ inputs.version }}so stable images are built from the tagged release’s Dockerfile/pin, notmainpaired with an older PyPI wheel.CI adds
Dockerfileto the unit-test path filter and newtest_dockerfile_coana_pin.pyguards thesedexpression and rejects unpinned Coananpm installlines. Release is bumped to 2.7.2 with changelog notes.Reviewed by Cursor Bugbot for commit 21a802d. Configure here.