feat: rebuild as multi-user web agent

2026-07-26 06:52:12 +08:00
parent 45792c8fd5
commit 37f83eaac7
634 changed files with 5060 additions and 139619 deletions
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+project_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "${project_dir}"
+
+./scripts/audit-web-image.sh
+
+runtime_image="${RUNTIME_AUDIT_IMAGE:-k1412-agent-runtime:audit}"
+gateway_image="${GATEWAY_AUDIT_IMAGE:-k1412-agent-gateway:audit}"
+workspace_image="${WORKSPACE_AUDIT_IMAGE:-k1412-agent-workspace:audit}"
+trivy_image="aquasec/trivy@sha256:cffe3f5161a47a6823fbd23d985795b3ed72a4c806da4c4df16266c02accdd6f"
+trivy_cache="k1412-trivy-cache"
+
+docker build --platform linux/amd64 -f docker/runtime.Dockerfile -t "${runtime_image}" .
+docker build --platform linux/amd64 -f docker/gateway.Dockerfile -t "${gateway_image}" .
+docker build --platform linux/amd64 -f docker/workspace.Dockerfile -t "${workspace_image}" .
+
+for image in "${runtime_image}" "${gateway_image}" "${workspace_image}"; do
+  docker run --rm "${image}" python -m pip check
+  docker run --rm \
+    -v /var/run/docker.sock:/var/run/docker.sock \
+    -v "${trivy_cache}:/root/.cache" \
+    "${trivy_image}" \
+    image \
+    --quiet \
+    --scanners vuln \
+    --severity HIGH,CRITICAL \
+    --ignore-unfixed \
+    --exit-code 1 \
+    --format json \
+    "${image}" >/dev/null
+done