Spaces:
Running
Running
| # Build the linux/amd64 Space image and verify its runtime surface. | |
| set -euo pipefail | |
| TAG="${1:-img2threejs:verify}" | |
| PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" | |
| NO_SECRET_CONTAINER="i2t-no-secret-$$" | |
| GUARD_CONTAINER="i2t-guard-$$" | |
| VERIFY_TMP="$(mktemp -d -t img2threejs-docker-verify.XXXXXX)" | |
| cleanup() { | |
| docker rm -f "$NO_SECRET_CONTAINER" "$GUARD_CONTAINER" >/dev/null 2>&1 || true | |
| rm -rf "$VERIFY_TMP" | |
| } | |
| trap cleanup EXIT | |
| cd "$PROJECT_ROOT" | |
| echo "==> docker build --platform=linux/amd64 -t $TAG ." | |
| docker build --platform=linux/amd64 -t "$TAG" . | |
| echo "==> image size" | |
| docker images "$TAG" --format ' {{.Repository}}:{{.Tag}} {{.Size}}' | |
| echo "==> runtime image allowlist" | |
| docker run --rm --entrypoint sh "$TAG" -c ' | |
| set -eu | |
| for path in \ | |
| /home/user/app/.git \ | |
| /home/user/app/.pytest_cache \ | |
| /home/user/app/.venv \ | |
| /home/user/app/.workflow \ | |
| /home/user/app/docs \ | |
| /home/user/app/grimoire \ | |
| /home/user/app/pytest.ini \ | |
| /home/user/app/scripts \ | |
| /home/user/app/SKILL.md \ | |
| /home/user/app/tests \ | |
| /home/user/app/upstream-src \ | |
| /home/user/app/verification \ | |
| /home/user/app/forge/tests; do | |
| test ! -e "$path" | |
| done | |
| test -z "$(find /home/user/app -type d -name __pycache__ -print -quit)" | |
| test -z "$(find /home/user/app -type f \( -name "rollout*.jsonl" -o -name "*.pyc" \) -print -quit)" | |
| test -f /home/user/app/app/main.py | |
| test -f /home/user/app/forge/stage3_build/generate_threejs_factory.py | |
| test -f /home/user/app/LICENSE | |
| echo " strict runtime source allowlist ok" | |
| ' | |
| echo "==> no-secret container: health, UI, and honest 503" | |
| docker run -d --name "$NO_SECRET_CONTAINER" -p 17860:7860 "$TAG" >/dev/null | |
| curl --fail --silent --show-error \ | |
| --retry 45 --retry-all-errors --retry-connrefused --retry-delay 1 \ | |
| --connect-timeout 2 --max-time 90 \ | |
| http://127.0.0.1:17860/health >"$VERIFY_TMP/health.json" | |
| grep -q '"status":"ok"' "$VERIFY_TMP/health.json" | |
| grep -q '"llm_configured":false' "$VERIFY_TMP/health.json" | |
| curl --fail --silent --show-error http://127.0.0.1:17860/ \ | |
| >"$VERIFY_TMP/index.html" | |
| grep -q 'img2threejs' "$VERIFY_TMP/index.html" | |
| curl --fail --silent --show-error http://127.0.0.1:17860/static/app.js \ | |
| >"$VERIFY_TMP/app.js" | |
| grep -q 'startJob' "$VERIFY_TMP/app.js" | |
| no_secret_code="$(curl --silent --output "$VERIFY_TMP/no-secret-job.json" \ | |
| --write-out '%{http_code}' \ | |
| -F "file=@tests/fixtures/ref.png;type=image/png" \ | |
| http://127.0.0.1:17860/api/jobs)" | |
| if [[ "$no_secret_code" != "503" ]]; then | |
| echo "FAIL: expected 503 without LLM secrets, got $no_secret_code" >&2 | |
| sed -n '1,20p' "$VERIFY_TMP/no-secret-job.json" >&2 | |
| exit 1 | |
| fi | |
| grep -q 'llm_not_configured' "$VERIFY_TMP/no-secret-job.json" | |
| if grep -qiE 'sculptRuntime|makeModel|model\.bundle' "$VERIFY_TMP/no-secret-job.json"; then | |
| echo "FAIL: no-secret response appears to contain fabricated artifacts" >&2 | |
| exit 1 | |
| fi | |
| echo " health/UI/honest 503 ok" | |
| echo "==> configured guard container: invalid upload reaches image validation" | |
| docker run -d --name "$GUARD_CONTAINER" -p 17861:7860 \ | |
| -e LLM_API_KEY=verification-dummy \ | |
| -e LLM_MODEL=verification-dummy \ | |
| -e LLM_BASE_URL=http://127.0.0.1:9 \ | |
| "$TAG" >/dev/null | |
| curl --fail --silent --show-error \ | |
| --retry 45 --retry-all-errors --retry-connrefused --retry-delay 1 \ | |
| --connect-timeout 2 --max-time 90 \ | |
| http://127.0.0.1:17861/health >"$VERIFY_TMP/guard-health.json" | |
| grep -q '"llm_configured":true' "$VERIFY_TMP/guard-health.json" | |
| printf '<html><body>not an image</body></html>' >"$VERIFY_TMP/not-image.html" | |
| guard_code="$(curl --silent --output "$VERIFY_TMP/guard-job.json" \ | |
| --write-out '%{http_code}' \ | |
| -F "file=@$VERIFY_TMP/not-image.html;type=text/html" \ | |
| http://127.0.0.1:17861/api/jobs)" | |
| if [[ "$guard_code" != "415" ]]; then | |
| echo "FAIL: expected 415 for a declared non-image, got $guard_code" >&2 | |
| sed -n '1,20p' "$VERIFY_TMP/guard-job.json" >&2 | |
| exit 1 | |
| fi | |
| grep -q 'unsupported_media_type' "$VERIFY_TMP/guard-job.json" | |
| echo " upload content-type guard ok" | |
| echo "ALL DOCKER CHECKS PASSED" | |