mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-05-29 06:31:32 +00:00
66489f38c7
`hermes dump` and the startup banner both call `git rev-parse HEAD` to
report the running commit, but `.dockerignore` line 2 excludes `.git` —
so inside the published image `hermes dump` shows
`version: ... [(unknown)]` and the banner drops its `· upstream <sha>`
suffix entirely. That makes support triage from container bug reports
impossible: we can't tell which commit the user is actually running.
Fix: thread the build-time SHA through as a Docker build-arg, write it
to `/opt/hermes/.hermes_build_sha` in the image, and have a new
`hermes_cli/build_info.get_build_sha()` read it as a fallback after the
existing live-git lookup fails. Output format is unchanged in both
callsites — same 8-char short SHA whether resolved live or baked.
Wiring:
- Dockerfile: `ARG HERMES_GIT_SHA=` + write-file step after the source
copy. Empty/missing arg → no file written → callers fall through to
live git (so local `docker build` without --build-arg is unchanged).
- docker-publish.yml: passes `HERMES_GIT_SHA=${{ github.sha }}` on all
four build-push-action steps (amd64/arm64, smoke-test + final push).
- dump.py:_get_git_commit() / banner.py:get_git_banner_state(): try
live git first, fall back to baked SHA, then to legacy `(unknown)`
/ None. Banner returns `upstream == local, ahead=0` because a built
image is by definition pinned to one commit.
Coverage:
- Unit tests cover build_info (file present/absent/empty/error,
truncation, whitespace), dump (live-git wins, both fallbacks,
identical output-format regression guard), and banner (no-repo +
baked, no-repo + no-sha, shallow-clone fallback).
- tests/docker/test_dump_build_sha.py is an integration regression
guard that runs against the real image, reads
`/opt/hermes/.hermes_build_sha`, and asserts `hermes dump` surfaces
its content (or stays at `(unknown)` if no file).
- Verified end-to-end: `docker build --build-arg HERMES_GIT_SHA=abc...`
→ `docker run ... dump` reports `[abc12345]`; without the build-arg
it reports `[(unknown)]` as before.
51 lines
2.1 KiB
Python
51 lines
2.1 KiB
Python
"""
|
|
Baked-in build metadata for Hermes Agent.
|
|
|
|
Source installs report their git revision live via ``git rev-parse`` (see
|
|
``hermes_cli/dump.py`` and ``hermes_cli/banner.py``). That doesn't work inside
|
|
the published Docker image because ``.dockerignore`` excludes ``.git``, so
|
|
those callsites fall back to ``"(unknown)"`` / drop the banner suffix entirely.
|
|
|
|
To make ``hermes dump`` and the startup banner identify the exact commit the
|
|
image was built from, the Docker build writes the build-time ``$HERMES_GIT_SHA``
|
|
arg into ``<project_root>/.hermes_build_sha``. This module is the single
|
|
read-side helper consumed by both callsites — keeping the lookup in one place
|
|
so the file path and missing-file behaviour stay consistent.
|
|
|
|
Behaviour:
|
|
|
|
- Returns ``None`` when the file is absent. Source installs and dev images
|
|
built without the ``HERMES_GIT_SHA`` build-arg fall through to live-git
|
|
resolution in the caller, so non-Docker installs are unaffected.
|
|
- Returns ``None`` on any IO / decoding error. The build-sha is a nice-to-have
|
|
for support triage; nothing in the CLI is allowed to crash because of it.
|
|
- Truncates to ``short`` characters (default 8) to match the format used by
|
|
``git rev-parse --short=8`` throughout the codebase.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
from typing import Optional
|
|
|
|
# Path is resolved relative to this module so it works regardless of cwd —
|
|
# matches the pattern used by ``banner._resolve_repo_dir``.
|
|
_BUILD_SHA_FILE = Path(__file__).parent.parent / ".hermes_build_sha"
|
|
|
|
|
|
def get_build_sha(short: int = 8) -> Optional[str]:
|
|
"""Return the baked-in build SHA, truncated to ``short`` chars, or None.
|
|
|
|
Reads ``<project_root>/.hermes_build_sha`` if present. The file is
|
|
written by the Dockerfile's ``HERMES_GIT_SHA`` build-arg and contains
|
|
the full 40-character commit hash on a single line.
|
|
"""
|
|
try:
|
|
if not _BUILD_SHA_FILE.is_file():
|
|
return None
|
|
sha = _BUILD_SHA_FILE.read_text(encoding="utf-8").strip()
|
|
except Exception:
|
|
return None
|
|
if not sha:
|
|
return None
|
|
return sha[:short] if short and short > 0 else sha
|