fix(installer): ship all app build contexts and refresh GitWorkshop dependencies

scripts/check-app-build-contexts.py

@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+"""Validate build-source apps against an OTA/ISO runtime payload before shipping."""
+import sys
+from pathlib import Path
+import yaml
+
+
+def check(root: Path) -> int:
+    root = root.resolve()
+    manifests = sorted((root / 'apps').glob('*/manifest.y*ml'))
+    if not manifests:
+        raise ValueError(f'No app manifests in {root / "apps"}')
+    count = 0
+    for manifest in manifests:
+        app = yaml.safe_load(manifest.read_text())['app']
+        build = app.get('container', {}).get('build')
+        if not build:
+            continue
+        context = Path(build['context'])
+        if context.is_absolute():
+            context = root / context.relative_to('/opt/archipelago')
+        else:
+            context = manifest.parent / context
+        context = context.resolve()
+        if not context.is_relative_to(root) or not context.is_dir():
+            raise ValueError(f'{app["id"]}: missing or out-of-payload build context: {context}')
+        dockerfile = (context / build.get('dockerfile', 'Dockerfile')).resolve()
+        if not dockerfile.is_relative_to(context) or not dockerfile.is_file():
+            raise ValueError(f'{app["id"]}: missing or out-of-context Dockerfile: {dockerfile}')
+        count += 1
+    return count
+
+
+if __name__ == '__main__':
+    try:
+        count = check(Path(sys.argv[1] if len(sys.argv) > 1 else '.'))
+    except (ValueError, KeyError, OSError, yaml.YAMLError) as error:
+        sys.exit(f'Invalid app build payload: {error}')
+    print(f'Validated {count} app build contexts and Dockerfiles.')

scripts/create-release-manifest.sh

@@ -101,6 +101,7 @@ if [ -z "$FRONTEND_ARCHIVE" ]; then
                 cp -r "$PROJECT_ROOT/$runtime_path" "$RUNTIME_DIR/$runtime_path"
             fi
         done
+        python3 "$PROJECT_ROOT/scripts/check-app-build-contexts.py" "$RUNTIME_DIR"
         # KEEP IN SYNC with the `for unit in [...]` array in
         # core/archipelago/src/bootstrap.rs (run_runtime_assets). A unit that
         # bootstrap installs but this list does not ship simply never reaches a

scripts/iso-smoke-test.sh

@@ -64,6 +64,13 @@ for f in live/vmlinuz live/initrd.img live/filesystem.squashfs \
     fi
 done
 
+# Verify the mounted artifact carries every manifest-declared build source.
+if python3 "$REPO/scripts/check-app-build-contexts.py" "$MNT/archipelago"; then
+    ok "app build contexts and Dockerfiles"
+else
+    bad "incomplete app build payload"
+fi
+
 # ── GRUB must boot the live system ───────────────────────────────────
 if grep -q "boot=live" "$MNT/boot/grub/grub.cfg" 2>/dev/null; then
     ok "grub.cfg has boot=live"