Share Forge artifacts with the builder

Share Forge artifacts with the builder

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

Not deployed through the forge lane

No push, promotion, build, or deploy receipt references this commit (receipts are scanned over a bounded recent window). Changes shipped by full node replacement carry their proof in the release gate receipt instead.

Changed files

modified infra/staging/templates/fleet-startup.sh.tftpl
modified infra/staging/tests/safety.tftest.hcl

Diff

2 files changed, +12 -0

    --restart always \
    --env-file /run/openagents/builder.env \
    --volume "$state_root/workspace:$state_root/workspace" \
    --volume "$state_root/artifacts:$state_root/artifacts" \
    "$builder_image"
fi

    error_message = "Staging fleet nodes must not have public access configurations."
  }

  assert {
    condition = alltrue([
      for instance in values(google_compute_instance.fleet) :
      strcontains(
        instance.metadata["startup-script"],
        "--volume \"$state_root/artifacts:$state_root/artifacts\""
      )
    ])
    error_message = "The isolated Forge builder must share the artifact directory with the application."
  }

  assert {
    condition     = length(google_compute_instance.deployer.network_interface[0].access_config) == 0
    error_message = "The staging deployer must not have a public access configuration."

230	230		`--restart always \`
231	231		`--env-file /run/openagents/builder.env \`
232	232		`--volume "$state_root/workspace:$state_root/workspace" \`
	233	+	`--volume "$state_root/artifacts:$state_root/artifacts" \`
233	234		`"$builder_image"`
234	235		`fi`

22	22		`error_message = "Staging fleet nodes must not have public access configurations."`
23	23		`}`
24	24
	25	+	`assert {`
	26	+	`condition = alltrue([`
	27	+	`for instance in values(google_compute_instance.fleet) :`
	28	+	`strcontains(`
	29	+	`instance.metadata["startup-script"],`
	30	+	`"--volume \"$state_root/artifacts:$state_root/artifacts\""`
	31	+	`)`
	32	+	`])`
	33	+	`error_message = "The isolated Forge builder must share the artifact directory with the application."`
	34	+	`}`
	35	+
25	36		`assert {`
26	37		`condition = length(google_compute_instance.deployer.network_interface[0].access_config) == 0`
27	38		`error_message = "The staging deployer must not have a public access configuration."`