Skip to content

feat: add ACS tooling to the NVIDIA StackRox image #182

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
robbycochran merged 2 commits into from
Sep 14, 2026
Merged

feat: add ACS tooling to the NVIDIA StackRox image #182

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3c4c1e2
feat: add ACS triage tools to StackRox image (#180)
robbycochran Sep 12, 2026
2066fe1
docs: clarify StackRox provider prerequisites
robbycochran Sep 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion profiles/stackrox/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,18 @@
NVIDIA OpenShell community base with integrations shared by StackRox workflows,
including Atlassian MCP and Google Workspace tooling.

It also includes the ACS triage toolchain: Go, `gopls` (the Go-analysis MCP
server), and `ajv-cli` for JSON Schema validation. `gcloud` is intentionally
not included; OpenShell provider credentials and inference routing replace the
runner-side service-account setup used by the original GitHub Actions workflow.
Comment thread
coderabbitai[bot] marked this conversation as resolved.

Generic Harness workflows use the NVIDIA base image directly. Select the
published StackRox image only when a workflow needs one of these additions;
providers, credentials, skills, and task-specific policy remain outside the
image.
image. The image does not create or attach providers; a workflow must name
providers that are already provisioned and attach them through
`sandbox.providers` before provider credentials or inference routes are
available.

Build it locally with:

Expand Down
5 changes: 4 additions & 1 deletion profiles/stackrox/image/sandbox-default/CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,4 +14,7 @@ You are running inside an OpenShell sandbox. Credentials are injected via the Op
- `gh` — GitHub CLI (pre-authenticated). Run `gh auth setup-git` before any git clone/push/pull to configure git credential helper.
- `gws` — Google Workspace CLI (when available). Use `gws schema <service.resource.method>` to discover API parameters.
- MCP servers (Jira, Confluence) are configured in `.mcp.json` and connected automatically.
- `python3`, `uv`, `node`, `npm`, `git`, `curl`
- `go`, `gopls`, `python3`, `uv`, `node`, `npm`, `ajv`, `git`, `curl`

The OpenShell Vertex provider supplies model access and credentials. The image
does not install `gcloud` or copy service-account keys into the sandbox.
28 changes: 27 additions & 1 deletion profiles/stackrox/image/sandbox-default/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,13 +19,16 @@
#
# mcp-atlassian 0.21.1 https://github.com/sooperset/mcp-atlassian/releases
# gws CLI 0.22.5 https://github.com/googleworkspace/cli/releases
# gopls 0.20.0 https://pkg.go.dev/golang.org/x/tools/gopls
# ajv-cli 5.0.0 https://github.com/ajv-validator/ajv-cli
#
# Base image tools (inherited, pinned upstream):
# claude latest https://claude.ai/install.sh
# gh latest https://cli.github.com/packages
# node 22.x https://deb.nodesource.com
# python 3.14.x https://github.com/astral-sh/uv
# uv 0.10.x https://github.com/astral-sh/uv
# Go 1.24.2 https://go.dev/dl/
#
# ── Workarounds in this image ──────────────────────────────────────────
#
Expand All @@ -47,6 +50,25 @@ USER root
# https://github.com/sooperset/mcp-atlassian
RUN pip install --no-cache-dir mcp-atlassian==0.21.1

# Go and gopls for the Go-analysis MCP server used by ACS triage. Keep the Go
# toolchain in the runtime image because gopls invokes `go list` and related
# commands while analyzing a checked-out repository.
ARG GO_VERSION=1.24.2
ARG GO_SHA256_AMD64=68097bd680839cbc9d464a0edce4f7c333975e27a90246890e9f1078c7e702ad
ARG GO_SHA256_ARM64=756274ea4b68fa5535eb9fe2559889287d725a8da63c6aae4d5f23778c229f4b
ARG GOPLS_VERSION=0.20.0
RUN set -eux; \
case "$(dpkg --print-architecture)" in \

@stackrox-openshell-workflow stackrox-openshell-workflow Bot Sep 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The gopls version 0.20.0 appears to be incorrect. Valid versions are prefixed with v (e.g., v0.15.0), and version 0.20.0 has not been released. This will likely cause the go install command on line 73 to fail.

@robbycochran robbycochran Sep 12, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skipped: this finding is incorrect. The Dockerfile passes golang.org/x/tools/gopls@v${GOPLS_VERSION}; v0.20.0 is a published module version (confirmed with go list -m -versions golang.org/x/tools/gopls). The v prefix is supplied by the command, so this installation is valid.

@stackrox-openshell-workflow stackrox-openshell-workflow Bot Sep 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The gopls version 0.20.0 appears to be incorrect. A version like v0.15.0 is expected, but version 0.20.0 has not been released. This will likely cause the go install command on line 73 to fail.

@robbycochran robbycochran Sep 12, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skipped for the same reason: v0.20.0 is published and the Dockerfile constructs the required @v0.20.0 module selector. No change is needed.

@stackrox-openshell-workflow stackrox-openshell-workflow Bot Sep 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The specified gopls version, 0.20.0, is not a valid version and has not been released. This will cause the go install command on line 71 to fail. Please use a valid, published version for golang.org/x/tools/gopls.

@robbycochran robbycochran Sep 12, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skipped: this repeated finding is incorrect. v0.20.0 is a published golang.org/x/tools/gopls module version, and the Dockerfile constructs the required @v0.20.0 selector. The image build uses this version successfully.

@stackrox-openshell-workflow stackrox-openshell-workflow Bot Sep 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The specified gopls version, 0.20.0, is not a valid version for golang.org/x/tools/gopls and has not been released. The go install command on line 71 will fail as a result. Please use a valid, published version.

@robbycochran robbycochran Sep 12, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skipped: this repeated finding is incorrect. v0.20.0 is a published golang.org/x/tools/gopls module version, and the Dockerfile constructs the required @v0.20.0 selector. The image build uses this version successfully.

@stackrox-openshell-workflow stackrox-openshell-workflow Bot Sep 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The specified gopls version, 0.20.0, is not a valid version for golang.org/x/tools/gopls and has not been released. The go install command on line 71 will fail as a result. Please use a valid, published version.

@robbycochran robbycochran Sep 12, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skipped: this repeated finding is incorrect. v0.20.0 is a published golang.org/x/tools/gopls module version, and the Dockerfile constructs the required @v0.20.0 selector. The image build uses this version successfully.

@stackrox-openshell-workflow stackrox-openshell-workflow Bot Sep 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The specified gopls version, 0.20.0, is not a valid version for golang.org/x/tools/gopls and has not been released. The go install command on line 71 will fail as a result. Please use a valid, published version.

@robbycochran robbycochran Sep 12, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skipped: this repeated finding is incorrect. v0.20.0 is a published golang.org/x/tools/gopls module version, and the Dockerfile constructs the required @v0.20.0 selector. The image build uses this version successfully.

@stackrox-openshell-workflow stackrox-openshell-workflow Bot Sep 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The specified gopls version, 0.20.0, is not a valid version for golang.org/x/tools/gopls and has not been released. The go install command on line 71 will fail as a result. Please use a valid, published version.

@robbycochran robbycochran Sep 12, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skipped: this repeated finding is incorrect. v0.20.0 is a published golang.org/x/tools/gopls module version, and the Dockerfile constructs the required @v0.20.0 selector. The image build uses this version successfully.

@stackrox-openshell-workflow stackrox-openshell-workflow Bot Sep 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The specified gopls version, 0.20.0, is not a valid version for golang.org/x/tools/gopls and has not been released. The go install command on line 71 will fail as a result. Please use a valid, published version.

@robbycochran robbycochran Sep 12, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skipped: this repeated finding is incorrect. v0.20.0 is a published golang.org/x/tools/gopls module version, and the Dockerfile constructs the required @v0.20.0 selector. The image build uses this version successfully.

amd64) go_arch=amd64; go_sha256="$GO_SHA256_AMD64" ;; \
arm64) go_arch=arm64; go_sha256="$GO_SHA256_ARM64" ;; \
*) echo "unsupported architecture: $(dpkg --print-architecture)" >&2; exit 1 ;; \
esac; \
curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${go_arch}.tar.gz" -o /tmp/go.tgz; \
echo "${go_sha256} /tmp/go.tgz" | sha256sum -c -; \
tar -C /usr/local -xzf /tmp/go.tgz; \
GOBIN=/usr/local/bin /usr/local/go/bin/go install "golang.org/x/tools/gopls@v${GOPLS_VERSION}"; \
rm -rf /tmp/go.tgz /root/go /root/.cache/go-build

# Google Workspace CLI (Gmail, Calendar, Drive, Docs, Sheets)
# https://github.com/googleworkspace/cli
RUN ARCH=$(uname -m | sed 's/arm64/aarch64/') && \
Expand All @@ -55,7 +77,11 @@ RUN ARCH=$(uname -m | sed 's/arm64/aarch64/') && \

# OpenCode AI coding agent
# https://github.com/opencode-ai/opencode
RUN npm install -g opencode-ai@1.18.30
# JSON Schema validation used by the ACS triage workflow.
RUN npm install -g opencode-ai@1.18.30 ajv-cli@5.0.0 && \
npm cache clean --force

ENV PATH="/sandbox/.venv/bin:/usr/local/go/bin:${PATH}"

# Sandbox policy (network egress rules — provider profiles contribute
# additional endpoints at runtime via providers v2 composition)
Expand Down
5 changes: 5 additions & 0 deletions profiles/stackrox/image/sandbox-default/mcp.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,11 @@
"env": {
"READ_ONLY_MODE": "true"
}
},
"gopls-mcp": {
"type": "stdio",
"command": "/usr/local/bin/gopls",
"args": ["mcp"]
}
}
}
5 changes: 5 additions & 0 deletions profiles/stackrox/image/sandbox-default/opencode.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,11 @@
"environment": {
"READ_ONLY_MODE": "true"
}
},
"gopls-mcp": {
"type": "local",
"command": ["/usr/local/bin/gopls", "mcp"],
"enabled": true
}
}
}
11 changes: 11 additions & 0 deletions profiles/stackrox/image/sandbox-default/policy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,17 @@ network_policies:
- { path: /usr/local/bin/uv }
- { path: "/sandbox/.uv/python/**" }

# Go module downloads used by gopls while analyzing checked-out repositories.
go_modules:
name: go-modules
endpoints:
- { host: proxy.golang.org, port: 443 }
- { host: sum.golang.org, port: 443 }
Comment thread
coderabbitai[bot] marked this conversation as resolved.
- { host: go.dev, port: 443 }
binaries:
- { path: /usr/local/go/bin/go }
- { path: /usr/local/bin/gopls }

# Node packages
npm:
name: npm
Expand Down
Loading