titan/atlas-iac
3
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity

hermes: add daemonless agent image release lane #16

Merged
bstein merged 4 commits from feature/hermes-unprivileged-image-builder into main 2026-08-17 23:36:51 +00:00
Conversation 0 Commits 4 Files Changed 54 +4935 -43
hermes-automation commented 2026-08-16 23:04:44 +00:00
Member
Copy Link

Outcome

Adds a human-gated, daemonless Jenkins/Kaniko release lane for dockerfiles/Dockerfile.hermes-agent and a job-scoped trigger for agent.hermes.

Security boundary

  • builds only the exact full revision currently on reviewed atlas/titan-iac main
  • no privileged pod, host socket/path, Docker/BuildKit daemon, service-account token, or unauthenticated TCP endpoint
  • pinned executor/tool images; all Linux capabilities dropped and privilege escalation disabled
  • rpi5-only placement; hard excludes titan-04/14/18/19/22/24
  • Harbor push credential remains Vault-seeded Jenkins runtime state and is deleted from the builder after use
  • agent.hermes receives only a Vault-projected Build Token Root credential scoped to this one job, not a Jenkins user/admin credential
  • publishes a source-derived tag and archives the immutable digest plus a reviewable Flux patch; never writes Git, deploys, reconciles, or merges

Validation

  • local quality gate: 370 passed
  • focused builder/runtime tests: 37 passed
  • ruff: passed
  • sh -n services/vault/scripts/vault_k8s_auth_configure.sh: passed
  • kubectl kustomize + client dry-run: services/jenkins, services/hermes, services/vault
  • embedded builder Pod server-side dry-run: passed
  • Kaniko index pinned at sha256:c3109d5926a997b100c4343944e06c6b30a6804b2f9abe0994d3de6ef92b028e with arm64 manifest verified

Unmerged and undeployed; human review is required.

## Outcome Adds a human-gated, daemonless Jenkins/Kaniko release lane for `dockerfiles/Dockerfile.hermes-agent` and a job-scoped trigger for agent.hermes. ## Security boundary - builds only the exact full revision currently on reviewed `atlas/titan-iac` `main` - no privileged pod, host socket/path, Docker/BuildKit daemon, service-account token, or unauthenticated TCP endpoint - pinned executor/tool images; all Linux capabilities dropped and privilege escalation disabled - rpi5-only placement; hard excludes titan-04/14/18/19/22/24 - Harbor push credential remains Vault-seeded Jenkins runtime state and is deleted from the builder after use - agent.hermes receives only a Vault-projected Build Token Root credential scoped to this one job, not a Jenkins user/admin credential - publishes a source-derived tag and archives the immutable digest plus a reviewable Flux patch; never writes Git, deploys, reconciles, or merges ## Validation - local quality gate: 370 passed - focused builder/runtime tests: 37 passed - ruff: passed - `sh -n services/vault/scripts/vault_k8s_auth_configure.sh`: passed - `kubectl kustomize` + client dry-run: `services/jenkins`, `services/hermes`, `services/vault` - embedded builder Pod server-side dry-run: passed - Kaniko index pinned at `sha256:c3109d5926a997b100c4343944e06c6b30a6804b2f9abe0994d3de6ef92b028e` with arm64 manifest verified Unmerged and undeployed; human review is required.
hermes-automation added 1 commit 2026-08-16 23:04:44 +00:00
bstein force-pushed feature/hermes-unprivileged-image-builder from 3cfde3a5a7 to 0881e9eb45 2026-08-16 23:46:48 +00:00 Compare
bstein force-pushed feature/hermes-unprivileged-image-builder from 0881e9eb45 to 4236538c8f 2026-08-17 02:29:10 +00:00 Compare
bstein force-pushed feature/hermes-unprivileged-image-builder from 4236538c8f to 834cedf02a 2026-08-17 04:51:29 +00:00 Compare
bstein force-pushed feature/hermes-unprivileged-image-builder from 834cedf02a to 5ab0eba619 2026-08-17 09:52:24 +00:00 Compare
bstein force-pushed feature/hermes-unprivileged-image-builder from 5ab0eba619 to e8c26ecf85 2026-08-17 11:28:13 +00:00 Compare
bstein added 3 commits 2026-08-17 18:10:32 +00:00 
Cover the uncovered branches in the image release script (redirect
handler, policy-read credential and size bounds, count and shape
rejections, EOF manifest scan) and in the Harbor immutability helper
(scope-failure verification, absent robot duration, stale-read retries,
created-rule ID binding, bounded startup retries). Exclude the
__main__ guard like the sibling release script.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Exercise the mailu sync retry, attribute, and skip branches, the
listener non-object JSON path, and the hygiene conftest skip; drop the
unreachable inverted-range clamp in the semgrep report (the line helper
already floors the end line) and pin that behavior with a test. Exclude
the mailu __main__ guards from measurement.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The coverage check read only line-rate, so a file could pass with weak
branch coverage. Load both Cobertura rates and fail any tracked file
below the 95% floor on either metric, failing closed when branch
evidence is absent. Prove enforcement end to end with a synthetic
fully-lined but branch-weak file failing run_profile.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
bstein merged commit 41d10ad3f7 into main 2026-08-17 23:36:51 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
atlas-reconciler bstein hermes-automation
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: titan/atlas-iac#16
No description provided.
Delete Branch "feature/hermes-unprivileged-image-builder"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?