From 5c986eabaa3876100e0f47e251d9c95e0244ab64 Mon Sep 17 00:00:00 2001 From: jenkins Date: Sun, 23 Aug 2026 16:05:09 -0300 Subject: [PATCH] fix(hermes-voice): unpack Jetson image capabilities --- ci/Jenkinsfile.hermes-voice-image | 5 ++++- services/jenkins/configmap-jcasc.yaml | 1 + testing/tests/test_hermes_voice_release.py | 3 +++ 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/ci/Jenkinsfile.hermes-voice-image b/ci/Jenkinsfile.hermes-voice-image index 17b3de38..b7bf9b93 100644 --- a/ci/Jenkinsfile.hermes-voice-image +++ b/ci/Jenkinsfile.hermes-voice-image @@ -71,7 +71,10 @@ spec: allowPrivilegeEscalation: false capabilities: drop: ["ALL"] - add: ["CHOWN", "FOWNER", "DAC_OVERRIDE", "SETGID", "SETUID"] + # The pinned Jetson Whisper base contains gst-ptp-helper with a + # security.capability xattr. Kaniko needs SETFCAP only while + # unpacking that reviewed base; the pod remains non-privileged. + add: ["CHOWN", "FOWNER", "DAC_OVERRIDE", "SETGID", "SETUID", "SETFCAP"] runAsUser: 0 seccompProfile: {type: RuntimeDefault} resources: diff --git a/services/jenkins/configmap-jcasc.yaml b/services/jenkins/configmap-jcasc.yaml index daf40a2d..73b69c25 100644 --- a/services/jenkins/configmap-jcasc.yaml +++ b/services/jenkins/configmap-jcasc.yaml @@ -702,6 +702,7 @@ data: } pipelineJob('hermes-voice-image') { disabled(false) + concurrentBuild(false) description('Bounded daemonless Kaniko release for reviewed Hermes STT or TTS source. A validated immutable release tag is consumed by Flux.') authenticationToken(System.getenv('HERMES_AGENT_IMAGE_BUILD_TOKEN')) parameters { diff --git a/testing/tests/test_hermes_voice_release.py b/testing/tests/test_hermes_voice_release.py index e4986d56..1114795e 100644 --- a/testing/tests/test_hermes_voice_release.py +++ b/testing/tests/test_hermes_voice_release.py @@ -20,6 +20,8 @@ def test_voice_pipeline_binds_component_source_digest_and_release() -> None: assert "PUBLISH HERMES STT" in pipeline assert "PUBLISH HERMES TTS" in pipeline assert "archiveArtifacts(" in pipeline + assert '"SETFCAP"' in pipeline + assert "privileged: true" not in pipeline def test_jenkins_declares_one_token_guarded_voice_job() -> None: @@ -29,6 +31,7 @@ def test_jenkins_declares_one_token_guarded_voice_job() -> None: "multibranchPipelineJob('titan-iac-quality-gate')", 1 )[0] assert "authenticationToken(System.getenv('HERMES_AGENT_IMAGE_BUILD_TOKEN'))" in block + assert "concurrentBuild(false)" in block assert "scriptPath('ci/Jenkinsfile.hermes-voice-image')" in block