feat: rebuild as multi-user web agent

2026-07-26 06:52:12 +08:00
parent 45792c8fd5
commit 37f83eaac7
634 changed files with 5060 additions and 139619 deletions
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+project_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "${project_dir}"
+
+image="${WEB_AUDIT_IMAGE:-k1412-agent-web:audit}"
+trivy_image="aquasec/trivy@sha256:cffe3f5161a47a6823fbd23d985795b3ed72a4c806da4c4df16266c02accdd6f"
+trivy_cache="k1412-trivy-cache"
+docker build -f docker/web.Dockerfile -t "${image}" .
+
+docker run --rm --entrypoint sh "${image}" -lc '
+  python -m pip check &&
+  python -m pip install -q pip-audit &&
+  python -m pip_audit
+'
+
+docker volume inspect "${trivy_cache}" >/dev/null 2>&1 \
+  || docker volume create "${trivy_cache}" >/dev/null
+trivy=(docker run --rm \
+  -v /var/run/docker.sock:/var/run/docker.sock \
+  -v "${trivy_cache}:/root/.cache" \
+  "${trivy_image}")
+scan_args=(image --quiet --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1)
+if ! "${trivy[@]}" "${scan_args[@]}" --format json "${image}" >/dev/null; then
+  "${trivy[@]}" "${scan_args[@]}" "${image}" || true
+  exit 1
+fi