Reproducibility

oren install

Resolves contracts, implementations and images, and writes oren.lock:

{
  "id": "analyze",
  "task": "techlite/analyze-commits@1.0.0",
  "implementation": "techlite/analyze-commits-alpine@1.0.0",
  "source": {
    "kind": "image",
    "ref": "docker.io/library/alpine:3.20@sha256:d9e853e87e55..."
  },
  "entrypoint": ["/worker/entrypoint.sh"]
}

Commit this file. It is what makes everyone run the same code.

The problem it solves

alpine:3.20 is a tag, and tags are mutable. Republishing it with different content would make the same pipeline run different code — with no signal at all.

This is not only a matter of reproducibility. Access authorisation is anchored to the worker’s identity: without the lockfile, the consent you gave to one image would pass silently to another that nobody reviewed.

With a digest, a different image is a different identity, and Oren asks again.

Without a lockfile

It works, but warns:

! no oren.lock: images resolve by tag, which can change. Run `oren install`.

Workers under development

An implementation that builds from a local directory is pinned too — by the content digest:

"source": { "kind": "build", "context": "/home/worker", "digest": "sha256:26ca9d..." }

Moving the directory does not change the identity; changing the content does.