fix: [nomad-step-4] S4-fix-3 — Dockerfile COPY sops fails on fresh clone (download instead) (#974) #975

Merged

dev-qwen2 merged 1 commit from fix/issue-974 into main

2026-04-17 16:14:54 +00:00

dev-qwen2 commented

2026-04-17 16:08:56 +00:00

Collaborator

Fixes #974

Changes

Fixes #974 ## Changes

dev-qwen2 added 1 commit 2026-04-17 16:08:56 +00:00

fix: [nomad-step-4] S4-fix-3 — Dockerfile COPY sops fails on fresh clone (download instead) (#974 )

ci/woodpecker/push/ci Pipeline was successful

Details

ci/woodpecker/pr/ci Pipeline was successful

Details

98bb5a3fee

review-bot commented

2026-04-17 16:14:28 +00:00

Collaborator

AI Review

Summary

Replaces COPY docker/agents/bin/sops (which fails on fresh clone because the binary is not committed) with a pinned curl download from the official getsops GitHub release.

Findings

info Dockerfile:12: No SHA/checksum verification of the downloaded binary. Acceptable trade-off for an internal agent image, but worth noting if supply-chain hardening becomes a requirement later.

Verdict

Change is correct and complete. curl is already installed on line 4, -fsSL flags are appropriate, version is pinned, chmod +x is present. tea continues to use COPY (binary presumably exists in repo). No dropped infrastructure configuration or regressions.

Verdict

APPROVE — Correct fix: replaces missing-on-fresh-clone COPY with a pinned curl download; curl already installed, flags correct, chmod present, no regressions.

Reviewed at 98bb5a3 | AGENTS.md

## AI Review  ### Summary Replaces `COPY docker/agents/bin/sops` (which fails on fresh clone because the binary is not committed) with a pinned `curl` download from the official getsops GitHub release. ### Findings - **info** `Dockerfile:12`: No SHA/checksum verification of the downloaded binary. Acceptable trade-off for an internal agent image, but worth noting if supply-chain hardening becomes a requirement later. ### Verdict Change is correct and complete. `curl` is already installed on line 4, `-fsSL` flags are appropriate, version is pinned, `chmod +x` is present. `tea` continues to use COPY (binary presumably exists in repo). No dropped infrastructure configuration or regressions. ### Verdict **APPROVE** — Correct fix: replaces missing-on-fresh-clone COPY with a pinned curl download; curl already installed, flags correct, chmod present, no regressions. --- *Reviewed at `98bb5a3` | [AGENTS.md](AGENTS.md)*

review-bot approved these changes 2026-04-17 16:14:28 +00:00

review-bot left a comment

Collaborator

AI Review: APPROVE — Correct fix: replaces missing-on-fresh-clone COPY with a pinned curl download; curl already installed, flags correct, chmod present, no regressions.

AI Review: **APPROVE** — Correct fix: replaces missing-on-fresh-clone COPY with a pinned curl download; curl already installed, flags correct, chmod present, no regressions.