Release v0.43.0

.github/workflows/agent-ci.yml

@@ -21,7 +21,7 @@ concurrency:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     defaults:
       run:
         working-directory: agent
@@ -49,7 +49,7 @@ jobs:
         run: ./.bin/staticcheck ./...
 
   build:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     strategy:
       matrix:
         include:

.github/workflows/agent-tip-release.yml

@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   agent:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     strategy:
       matrix:
         include:
@@ -50,7 +50,7 @@ jobs:
 
   release:
     needs: agent
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - name: Download all artifacts
         uses: actions/download-artifact@v8

.github/workflows/cli-ci.yml

@@ -21,7 +21,7 @@ concurrency:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     defaults:
       run:
         working-directory: cli
@@ -49,7 +49,7 @@ jobs:
         run: ./.bin/staticcheck ./...
 
   build:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     strategy:
       matrix:
         include:

.github/workflows/react-doctor.yml

@@ -2,9 +2,16 @@ name: React Doctor
 
 on:
   pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
+    types: [opened, synchronize, reopened]
+    branches: [main]
+    paths:
+      - "web/**"
+      - ".github/workflows/react-doctor.yml"
   push:
     branches: [main]
+    paths:
+      - "web/**"
+      - ".github/workflows/react-doctor.yml"
 
 permissions:
   contents: read
@@ -18,7 +25,7 @@ concurrency:
 
 jobs:
   react-doctor:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v5
         with:

.github/workflows/release-pr.yml

@@ -40,7 +40,7 @@ jobs:
       github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'push' &&
         (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/release'))
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     concurrency:
       group: release-pr-maintain
       cancel-in-progress: false
@@ -195,7 +195,7 @@ jobs:
       github.event.pull_request.merged == true &&
       github.event.pull_request.base.ref == 'release' &&
       startsWith(github.event.pull_request.head.ref, 'automation/release/')
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     concurrency:
       group: release-tag-${{ github.event.pull_request.merge_commit_sha }}
       cancel-in-progress: false

.github/workflows/release.yml

@@ -150,7 +150,7 @@ jobs:
   homebrew:
     needs: release
     if: startsWith(github.ref, 'refs/tags/v')
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     concurrency:
       group: homebrew-tap
       cancel-in-progress: false

.github/workflows/updater-ci.yml

@@ -23,7 +23,7 @@ concurrency:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     defaults:
       run:
         working-directory: deployment/updater
@@ -51,7 +51,7 @@ jobs:
         run: ./.bin/staticcheck ./...
 
   build:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     strategy:
       matrix:
         include:
@@ -83,7 +83,7 @@ jobs:
           go build -o dist/control-plane-updater-${{ matrix.goos }}-${{ matrix.goarch }} .
 
   image:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     strategy:
       matrix:
         platform:

agent/internal/build/build.go

@@ -48,9 +48,17 @@ type Builder struct {
 const (
 	staleBuildDirAge     = 1 * time.Hour
 	staleTempArtifactAge = 24 * time.Hour
+	dockerfilePathKey    = "TECHULUS_DOCKERFILE_PATH"
 )
 
+type dockerfileConfig struct {
+	directory string
+	filename  string
+	found     bool
+}
+
 var managedTempArtifactPattern = regexp.MustCompile(`^(backup|restore)-[0-9a-fA-F-]{36}\.tar\.gz$|^restore-extract-[0-9a-fA-F-]{36}$`)
+var windowsAbsoluteRootPattern = regexp.MustCompile(`^[A-Za-z]:[\\/]`)
 
 func NewBuilder(dataDir string, logSender LogSender) *Builder {
 	return &Builder{
@@ -217,32 +225,17 @@ func (b *Builder) resolveCommitSha(ctx context.Context, config *Config, buildDir
 }
 
 func (b *Builder) buildAndPush(ctx context.Context, config *Config, buildDir string) error {
-	contextDir := buildDir
+	contextDir, err := resolveBuildContext(buildDir, config.RootDir)
+	if err != nil {
+		return err
+	}
 	if config.RootDir != "" {
-		contextDir = filepath.Join(buildDir, config.RootDir)
-		if _, err := os.Stat(contextDir); err != nil {
-			return fmt.Errorf("root directory %s does not exist: %w", config.RootDir, err)
-		}
 		b.sendLog(config, fmt.Sprintf("Using root directory: %s", config.RootDir))
 	}
 
-	dockerfileRelPath := "Dockerfile"
-	hasDockerfile := false
-	forcedDockerfile := false
-	if customPath := config.Secrets["TECHULUS_DOCKERFILE_PATH"]; customPath != "" {
-		if !filepath.IsLocal(customPath) {
-			return fmt.Errorf("TECHULUS_DOCKERFILE_PATH must be a relative path within the build context, got %q", customPath)
-		}
-		resolved := filepath.Join(contextDir, customPath)
-		if info, err := os.Stat(resolved); err != nil || info.IsDir() {
-			b.sendLog(config, fmt.Sprintf("TECHULUS_DOCKERFILE_PATH is set but %s was not found in the repository", customPath))
-			return fmt.Errorf("TECHULUS_DOCKERFILE_PATH %q not found in build context", customPath)
-		}
-		dockerfileRelPath = filepath.Clean(customPath)
-		hasDockerfile = true
-		forcedDockerfile = true
-	} else if _, err := os.Stat(filepath.Join(contextDir, "Dockerfile")); err == nil {
-		hasDockerfile = true
+	dockerfile, err := resolveDockerfile(contextDir, config.Secrets)
+	if err != nil {
+		return err
 	}
 
 	buildkitAddr := os.Getenv("BUILDKIT_HOST")
@@ -253,6 +246,9 @@ func (b *Builder) buildAndPush(ctx context.Context, config *Config, buildDir str
 	var secretArgs []string
 	var secretEnv []string
 	for key, value := range config.Secrets {
+		if key == dockerfilePathKey {
+			continue
+		}
 		secretArgs = append(secretArgs, "--secret", fmt.Sprintf("id=%s,env=%s", key, key))
 		secretEnv = append(secretEnv, fmt.Sprintf("%s=%s", key, value))
 	}
@@ -266,10 +262,10 @@ func (b *Builder) buildAndPush(ctx context.Context, config *Config, buildDir str
 	archImageUri := config.ImageURI + "-" + arch
 	archOutputFlag := fmt.Sprintf("type=image,name=%s,push=true,registry.insecure=true", archImageUri)
 
-	if hasDockerfile {
-		log.Printf("[build:%s] building with Dockerfile %s via buildctl for %s", truncateStr(config.BuildID, 8), dockerfileRelPath, platform)
-		if forcedDockerfile {
-			b.sendLog(config, fmt.Sprintf("Using Dockerfile %s (from TECHULUS_DOCKERFILE_PATH)", dockerfileRelPath))
+	if dockerfile.found {
+		log.Printf("[build:%s] building with Dockerfile via buildctl for %s", truncateStr(config.BuildID, 8), platform)
+		if configuredPath := strings.TrimSpace(config.Secrets[dockerfilePathKey]); configuredPath != "" {
+			b.sendLog(config, fmt.Sprintf("Using Dockerfile: %s", configuredPath))
 		} else {
 			b.sendLog(config, "Using existing Dockerfile")
 		}
@@ -280,8 +276,8 @@ func (b *Builder) buildAndPush(ctx context.Context, config *Config, buildDir str
 			"build",
 			"--frontend", "dockerfile.v0",
 			"--local", "context=.",
-			"--local", fmt.Sprintf("dockerfile=%s", filepath.Dir(dockerfileRelPath)),
-			"--opt", fmt.Sprintf("filename=%s", filepath.Base(dockerfileRelPath)),
+			"--local", fmt.Sprintf("dockerfile=%s", dockerfile.directory),
+			"--opt", fmt.Sprintf("filename=%s", dockerfile.filename),
 			"--opt", fmt.Sprintf("platform=%s", platform),
 			"--output", archOutputFlag,
 		}
@@ -350,6 +346,93 @@ func (b *Builder) buildAndPush(ctx context.Context, config *Config, buildDir str
 	return nil
 }
 
+func resolveBuildContext(buildDir, rootDir string) (string, error) {
+	if rootDir == "" {
+		return buildDir, nil
+	}
+
+	if windowsAbsoluteRootPattern.MatchString(rootDir) {
+		return "", fmt.Errorf("root directory %s must be relative to and inside the cloned repository", rootDir)
+	}
+	normalizedRoot := strings.ReplaceAll(rootDir, "\\", "/")
+	cleanedRoot := filepath.Clean(filepath.FromSlash(normalizedRoot))
+	if filepath.IsAbs(cleanedRoot) || cleanedRoot == ".." || strings.HasPrefix(cleanedRoot, ".."+string(filepath.Separator)) {
+		return "", fmt.Errorf("root directory %s must be relative to and inside the cloned repository", rootDir)
+	}
+
+	contextDir := filepath.Join(buildDir, cleanedRoot)
+	info, err := os.Stat(contextDir)
+	if err != nil {
+		return "", fmt.Errorf("root directory %s does not exist: %w", rootDir, err)
+	}
+	if !info.IsDir() {
+		return "", fmt.Errorf("root directory %s is not a directory", rootDir)
+	}
+
+	resolvedBuildDir, err := filepath.EvalSymlinks(buildDir)
+	if err != nil {
+		return "", fmt.Errorf("failed to resolve cloned repository directory: %w", err)
+	}
+	resolvedContextDir, err := filepath.EvalSymlinks(contextDir)
+	if err != nil {
+		return "", fmt.Errorf("failed to resolve root directory %s: %w", rootDir, err)
+	}
+	relativePath, err := filepath.Rel(resolvedBuildDir, resolvedContextDir)
+	if err != nil || relativePath == ".." || strings.HasPrefix(relativePath, ".."+string(filepath.Separator)) {
+		return "", fmt.Errorf("root directory %s must resolve inside the cloned repository", rootDir)
+	}
+
+	return contextDir, nil
+}
+
+func resolveDockerfile(contextDir string, secrets map[string]string) (dockerfileConfig, error) {
+	configuredPath, configured := secrets[dockerfilePathKey]
+	configuredPath = strings.TrimSpace(configuredPath)
+	if configured && configuredPath == "" {
+		return dockerfileConfig{}, fmt.Errorf("%s cannot be empty", dockerfilePathKey)
+	}
+
+	if !configured {
+		if _, err := os.Stat(filepath.Join(contextDir, "Dockerfile")); err == nil {
+			return dockerfileConfig{directory: ".", filename: "Dockerfile", found: true}, nil
+		} else if !os.IsNotExist(err) {
+			return dockerfileConfig{}, fmt.Errorf("failed to inspect Dockerfile: %w", err)
+		}
+		return dockerfileConfig{}, nil
+	}
+
+	cleanedPath := filepath.Clean(configuredPath)
+	if filepath.IsAbs(cleanedPath) || cleanedPath == ".." || strings.HasPrefix(cleanedPath, ".."+string(filepath.Separator)) {
+		return dockerfileConfig{}, fmt.Errorf("%s must be relative to the service root directory", dockerfilePathKey)
+	}
+
+	info, err := os.Stat(filepath.Join(contextDir, cleanedPath))
+	if err != nil {
+		return dockerfileConfig{}, fmt.Errorf("dockerfile %s does not exist: %w", configuredPath, err)
+	}
+	if info.IsDir() {
+		return dockerfileConfig{}, fmt.Errorf("dockerfile path %s is a directory", configuredPath)
+	}
+	resolvedContextDir, err := filepath.EvalSymlinks(contextDir)
+	if err != nil {
+		return dockerfileConfig{}, fmt.Errorf("failed to resolve service root directory: %w", err)
+	}
+	resolvedPath, err := filepath.EvalSymlinks(filepath.Join(contextDir, cleanedPath))
+	if err != nil {
+		return dockerfileConfig{}, fmt.Errorf("failed to resolve Dockerfile %s: %w", configuredPath, err)
+	}
+	relativePath, err := filepath.Rel(resolvedContextDir, resolvedPath)
+	if err != nil || relativePath == ".." || strings.HasPrefix(relativePath, ".."+string(filepath.Separator)) {
+		return dockerfileConfig{}, fmt.Errorf("%s must resolve inside the service root directory", dockerfilePathKey)
+	}
+
+	return dockerfileConfig{
+		directory: filepath.Dir(cleanedPath),
+		filename:  filepath.Base(cleanedPath),
+		found:     true,
+	}, nil
+}
+
 func (b *Builder) runCommand(cmd *exec.Cmd, config *Config) (string, error) {
 	output, err := cmd.CombinedOutput()
 	outputStr := string(output)