Publish nativelink-worker image for C++ #794
Conversation
There was a problem hiding this comment.
+@adam-singer +@zbirenbaum +@blakehatch +@MarcusSorealheis @kubevalet
+@allada After this change the image needs to be set to "public" in the Package Settings for (not yet existing): https://github.com/TraceMachina/nativelink/pkgs/container/nativelink-worker-lre-cc
Reviewable status: 0 of 5 LGTMs obtained, and pending CI: Analyze (javascript-typescript), Analyze (python), Bazel Dev / ubuntu-22.04, Cargo Dev / macos-13, Cargo Dev / ubuntu-22.04, Local / ubuntu-22.04, Publish image, Publish nativelink-worker-lre-cc, Remote / large-ubuntu-22.04, asan / ubuntu-22.04, docker-compose-compiles-nativelink (20.04), docker-compose-compiles-nativelink (22.04), integration-tests (20.04), integration-tests (22.04), macos-13, pre-commit-checks, ubuntu-20.04 / stable, ubuntu-22.04, ubuntu-22.04 / stable, vale, windows-2022 / stable, zig-cc ubuntu-20.04, zig-cc ubuntu-22.04 (waiting on @adam-singer, @allada, @blakehatch, @MarcusSorealheis, and @zbirenbaum)
aaronmondal
force-pushed
the
publish-cc-worker
branch
2 times, most recently
from
30f2b1c to
5fcb651
Compare
There was a problem hiding this comment.
Reviewed 6 of 6 files at r1, all commit messages.
Reviewable status: 1 of 5 LGTMs obtained (waiting on @allada, @blakehatch, @MarcusSorealheis, and @zbirenbaum)
allada
force-pushed
the
main
branch
2 times, most recently
from
a2a06c2 to
09defc6
Compare
There was a problem hiding this comment.
Reviewable status: 2 of 5 LGTMs obtained (waiting on @allada, @blakehatch, and @MarcusSorealheis)
There was a problem hiding this comment.
-@allada -@blakehatch -@MarcusSorealheis
Reviewable status:
complete! 2 of 2 LGTMs obtained
This should make it easier to spin up test instances for C++ projects. The nativelink worker image may now be fetched from: ``` ghcr.io/tracemachina/nativelink-worker-lre-cc:<sometag> ``` Since the toolchain images are somewhat more complex than the minimal `nativelink` image, we now use trivy to scan images for vulnerabilities. The database for these scans is fetched dynamically. This breaks perfect reproducibility for the image publishing workflow when rolling back/reverting, but ensures that new commits aren't checked against outdated vulnerability databases.
aaronmondal
force-pushed
the
publish-cc-worker
branch
from
5fcb651 to
55677a9
Compare
There was a problem hiding this comment.
Reviewed 6 of 6 files at r1, all commit messages.
Reviewable status:
This should make it easier to spin up test instances for C++ projects. The nativelink worker image may now be fetched from:
Since the toolchain images are somewhat more complex than the minimal
nativelinkimage, we now use trivy to scan images for vulnerabilities. The database for these scans is fetched dynamically. This breaks perfect reproducibility for the image publishing workflow when rolling back/reverting, but ensures that new commits aren't checked against outdated vulnerability databases.This change is