fix: seal P1 acceptance startup and raw Git state

This commit is contained in:
2026-08-10 00:02:29 +02:00
parent 87ee55a35f
commit d14a99abe7
3 changed files with 132 additions and 22 deletions
+3 -10
View File
@@ -1,4 +1,4 @@
#!/usr/bin/env -S -u BASH_ENV -u ENV /bin/bash
#!/usr/bin/env -S -i PATH=/usr/bin:/bin /bin/bash
set -euo pipefail
script_path=${BASH_SOURCE[0]}
script_dir=${script_path%/*}
@@ -51,19 +51,12 @@ wrapper_root=$(/usr/bin/mktemp -d /tmp/thoth-p1-wrapper.XXXXXXXX)
trap '/bin/rm -rf -- "$wrapper_root"' EXIT HUP INT TERM
/bin/mkdir -m 700 "$wrapper_root/home" "$wrapper_root/tmp"
owned_path="${node_path%/*}:/usr/bin:/bin"
build_env=(/usr/bin/env -i "PATH=$owned_path" "HOME=$wrapper_root/home" "TMPDIR=$wrapper_root/tmp" "LANG=${LANG:-C}")
for name in LC_ALL TZ; do
[[ -n "${!name:-}" ]] && build_env+=("$name=${!name}")
done
build_env=(/usr/bin/env -i "PATH=$owned_path" "HOME=$wrapper_root/home" "TMPDIR=$wrapper_root/tmp")
/bin/rm -rf -- "$repo_root/backend/dist"
"${build_env[@]}" "$node_path" "$npm_path" --prefix "$repo_root/backend" run build
safe_env=(/usr/bin/env -i "PATH=$owned_path" "HOME=$wrapper_root/home" "TMPDIR=$wrapper_root/tmp" "LANG=${LANG:-C}"
safe_env=(/usr/bin/env -i "PATH=$owned_path" "HOME=$wrapper_root/home" "TMPDIR=$wrapper_root/tmp"
"THT_BIN=$repo_root/harness/.venv/bin/tht" "P1_ACCEPTANCE_NODE_PATH=$node_path" "P1_ACCEPTANCE_NPM_PATH=$npm_path")
for name in LC_ALL TZ; do
[[ -n "${!name:-}" ]] && safe_env+=("$name=${!name}")
done
[[ -n "${P1_ACCEPTANCE_FAIL_AT:-}" ]] && safe_env+=("P1_ACCEPTANCE_FAIL_AT=$P1_ACCEPTANCE_FAIL_AT")
set +e
"${safe_env[@]}" "$node_path" "$repo_root/backend/scripts/p1-acceptance.mjs" "$@"
status=$?