내부 builder 인증과 실행 허용 목록 및 자원 경계를 적용한다

test/validate-compose-model.test.mjs

@@ -6,6 +6,7 @@ import { validateComposeModel } from '../runtime/validate-compose-model.mjs';
 const safeRuntime = {
   environment: {
     CORE_SOURCE_MODE: 'clone',
+    RELEASE_BUILDER_TOKEN_FILE: '/run/secrets/release_builder_token',
     NODE_OPTIONS: '--max-old-space-size=1536',
     TURN_DAEMON_NODE_OPTIONS: '--max-old-space-size=3072',
     RAYON_NUM_THREADS: '2',
@@ -28,6 +29,7 @@ const safeRuntime = {
     GATEWAY_ACTIVE_RELEASE_GIT_REF: 'refs/sammo/active-gateway',
   },
   volumes: [
+    { type: 'bind', source: '/secrets/release_builder_token', target: '/run/secrets/release_builder_token', read_only: true },
     {
       type: 'bind',
       source: '/secrets/image_upload_core2026_secret',
@@ -61,7 +63,9 @@ const safeRuntime = {
 };
 
 const safeBuilder = {
+  volumes: [{ type: 'bind', source: '/secrets/release_builder_token', target: '/run/secrets/release_builder_token', read_only: true }],
   environment: {
+    RELEASE_BUILDER_TOKEN_FILE: '/run/secrets/release_builder_token',
     NODE_OPTIONS: '--max-old-space-size=3072',
     RAYON_NUM_THREADS: '2',
   },
@@ -145,7 +149,8 @@ test('rejects missing or excessive build memory and parallelism limits', () => {
     ...safeRuntime,
     environment: {
       CORE_SOURCE_MODE: 'clone',
-      NODE_OPTIONS: '--max-old-space-size=4096',
+      RELEASE_BUILDER_TOKEN_FILE: '/run/secrets/release_builder_token',
+    NODE_OPTIONS: '--max-old-space-size=4096',
       TURN_DAEMON_NODE_OPTIONS: '--max-old-space-size=8192',
       RAYON_NUM_THREADS: '8',
     },