M7.6: nisse-review's image

A `review` target in the Dockerfile: its own user (nisse-review, uid
10002), git for its clones, state and clones in /var/lib/nisse-review,
configuration at /etc/nisse-review, and only its own agent installed.
release.yml publishes gitea.dongar.net/dev/nisse-review beside nisse-dev,
at the same version. review-bringup.sh builds and runs the image, as
bringup.sh runs nisse-dev's.

The test stage adds an agent package its base lacks, without its
dependencies, since the suite's own code imports every agent's. Without
that, the tests over nisse-dev's image no longer import since
test_review_live arrived. tests/deploy/test_images.py checks the image and
that the test stage leaves what it installed as it was.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

scripts/review-bringup.sh

@@ -1,45 +1,72 @@
 #!/usr/bin/env bash
 # Bring-up runs of nisse-review on this development VM (Development Plan M7.3).
 #
-# It runs from the exported code under test, in a virtualenv of its own, as a
-# transient systemd unit, so it outlives the shell that started it. It runs
-# from its image after M7.6, and on the agent host after M7.7.
+# It runs as its container image (M7.6), built from the code under test, as
+# a transient systemd unit, so it outlives the shell that started it. It runs
+# on the agent host after M7.7.
 #
-#   scripts/review-bringup.sh start [REF]   export REF (default HEAD), install
-#                                           it, and start the reviewer
+# $REVIEW is mounted at the same path inside the container, so the config's
+# paths (state_db, the vault) mean the same there; for that it runs as root
+# here, as bringup.sh runs nisse-dev. In production the image runs as its
+# own user with a state volume (Dockerfile).
+#
+#   scripts/review-bringup.sh start [REF]   export REF (default HEAD), build it
+#                                           into an image, start the reviewer
+#   scripts/review-bringup.sh plan [REF]    print what start would build and run
 #   scripts/review-bringup.sh stop          stop it cleanly (SIGTERM)
 #   scripts/review-bringup.sh status        the unit, and its items
 #   scripts/review-bringup.sh logs          follow its log
 #
 # Layout, under $REVIEW (default /root/nisse-review):
 #   nisse-review.yaml, .env   the config and its secrets (made by hand once)
-#   code/, venv/              the exported code and its install
-#   state.db, scratch/        its state, and repository trees while reviewing
+#   code/                     the exported code, built into the image
+#   state.db, scratch/        its state, and repository clones kept between runs
 #   vault/                    its memory (memory/nisse-review)
 set -euo pipefail
 
 REVIEW=${NISSE_REVIEW:-/root/nisse-review}
 SRC=${NISSE_SRC:-/root/nisse}
 UNIT=nisse-review-bringup
-export PATH="$HOME/.local/bin:$PATH"
+IMAGE=nisse-review:bringup
 
 die() { echo "review-bringup: $*" >&2; exit 1; }
 running() { systemctl is-active --quiet "$UNIT"; }
 
+# The container the unit runs: host networking (Gitea, LiteLLM as here),
+# $REVIEW at its own path, the config and secrets from it.
+docker_run() {
+    echo docker run --rm --name "$UNIT" --network host --user 0 \
+        -v "$REVIEW:$REVIEW" -w "$REVIEW" \
+        -e NISSE_CONFIG="$REVIEW/nisse-review.yaml" -e NISSE_ENV="$REVIEW/.env" \
+        "$IMAGE"
+}
+
+cmd_plan() {
+    local ref=${1:-HEAD} sha
+    sha=$(git -C "$SRC" rev-parse --verify "$ref^{commit}") || die "unknown ref $ref"
+    echo "git -C $SRC archive $sha | tar -x -C $REVIEW/code"
+    echo "docker build --target review -t $IMAGE $REVIEW/code"
+    echo "systemd-run --unit=$UNIT ... $(docker_run)"
+}
+
 cmd_start() {
     local ref=${1:-HEAD} sha
     [ -f "$REVIEW/nisse-review.yaml" ] && [ -f "$REVIEW/.env" ] || die "no config in $REVIEW"
     running && die "already running; stop it first"
     sha=$(git -C "$SRC" rev-parse --verify "$ref^{commit}") || die "unknown ref $ref"
+    # Export the code under test, so edits to the working tree can't change a
+    # running reviewer. Uncommitted changes are not part of a run.
     rm -rf "$REVIEW/code" && mkdir -p "$REVIEW/code" "$REVIEW/vault/memory/nisse-review"
     git -C "$SRC" archive "$sha" | tar -x -C "$REVIEW/code"
-    UV_PROJECT_ENVIRONMENT="$REVIEW/venv" uv sync -q --frozen --no-dev \
-        --package nisse-review --no-editable --project "$REVIEW/code"
+    docker build --quiet --target review -t "$IMAGE" "$REVIEW/code" > /dev/null
     echo "$sha" > "$REVIEW/run-info"
-    systemd-run --unit="$UNIT" --collect \
-        -p WorkingDirectory="$REVIEW" \
-        -E NISSE_CONFIG="$REVIEW/nisse-review.yaml" -E NISSE_ENV="$REVIEW/.env" \
-        "$REVIEW/venv/bin/nisse-review"
+    systemctl reset-failed "$UNIT" 2>/dev/null || true
+    # SIGTERM reaches the reviewer through docker run's signal proxy; a stop
+    # breaks off its run, which is redone on the next start.
+    # shellcheck disable=SC2046
+    systemd-run --quiet --unit="$UNIT" --collect \
+        --property=KillSignal=SIGTERM --property=TimeoutStopSec=120 \
+        $(docker_run)
     echo "started $UNIT at $sha"
 }
 
@@ -55,8 +82,9 @@ cmd_logs() { journalctl -u "$UNIT" -f; }
 
 case "${1:-}" in
     start) shift; cmd_start "$@" ;;
+    plan) shift; cmd_plan "$@" ;;
     stop) cmd_stop ;;
     status) cmd_status ;;
     logs) cmd_logs ;;
-    *) die "usage: $0 start [REF] | stop | status | logs" ;;
+    *) die "usage: $0 start [REF] | plan [REF] | stop | status | logs" ;;
 esac