fix: rebuild 9 more Dockerfile.sg_only with correct ccb-repo base images

sjarmak · claude · sjarmak · commit a37edf155198 · 2026-02-22T14:16:23.000Z
These build/fix tasks had broken sg_only Dockerfiles using generic base images
(ubuntu:22.04, eclipse-temurin, golang, python:3.11-slim) instead of the
pre-built ccb-repo-* bases. Without the correct base, MCP runs have no
compiler, no source code, and no /repo_full backup — causing verifier
compilation failures while baseline passes.

Fixed tasks:
- k8s-dra-scheduler-event-fix-001 (golang → ccb-repo-k8s-11602f08)
- camel-fix-protocol-feat-001 (eclipse-temurin → ccb-repo-camel-1006f047)
- flink-pricing-window-feat-001 (eclipse-temurin → ccb-repo-flink-0cc95fcc)
- flipt-dep-refactor-001 (ubuntu → ccb-repo-flipt-3d5a345f)
- kafka-batch-accumulator-refac-001 (eclipse-temurin → ccb-repo-kafka-0753c489)
- strata-cds-tranche-feat-001 (eclipse-temurin → ccb-repo-strata-66225ca9)
- strata-fx-european-refac-001 (eclipse-temurin → ccb-repo-strata-66225ca9)
- django-modelchoice-fk-fix-001 (python:3.11-slim → ccb-repo-django-674eda1c)
- flipt-eval-latency-fix-001 (ubuntu → ccb-repo-flipt-3d5a345f)

Co-Authored-By: Claude Opus 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/benchmarks/ccb_build/camel-fix-protocol-feat-001/environment/Dockerfile.sg_only b/benchmarks/ccb_build/camel-fix-protocol-feat-001/environment/Dockerfile.sg_only
@@ -1,26 +1,20 @@
 # camel-fix-protocol-feat-001 — sg_only_env variant
-# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
-
-FROM eclipse-temurin:17-jdk
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    ca-certificates \
-    python3 \
-    curl \
-    && rm -rf /var/lib/apt/lists/*
+# Source files truncated so agent must use Sourcegraph MCP for code access.
+# Verifier wrapper restores full repo before running tests.
+
+FROM ccb-repo-camel-1006f047
+
+# --- sg_only_env: back up full repo, then truncate source ---
+RUN cp -a /workspace /repo_full
+RUN find /workspace -type f \( \
+    -name "*.java" -o -name "*.xml" -o -name "*.yaml" -o -name "*.yml" \
+    -o -name "*.json" -o -name "*.properties" -o -name "*.sh" -o -name "*.md" \
+    -o -name "*.txt" -o -name "*.toml" -o -name "*.gradle" -o -name "*.kt" \
+    -o -name "*.scala" -o -name "*.groovy" -o -name "*.py" \
+    \) ! -path "*/.git/*" -exec truncate -s 0 {} \;
+# Recommit truncated state so git history cannot recover full files.
+RUN cd /workspace && git add -A && git commit -m "sg_only truncation" --allow-empty --quiet
+RUN touch /tmp/.sg_only_mode && echo '/workspace' > /tmp/.sg_only_workdir
 
 WORKDIR /workspace
-
-# Empty git repo so agent can commit work
-RUN git init && \
-    git config user.email "agent@example.com" && \
-    git config user.name "Agent"
-
-RUN mkdir -p /logs/agent /logs/verifier
-
-RUN touch /tmp/.sg_only_mode
-
 ENTRYPOINT []
diff --git a/benchmarks/ccb_build/flink-pricing-window-feat-001/environment/Dockerfile.sg_only b/benchmarks/ccb_build/flink-pricing-window-feat-001/environment/Dockerfile.sg_only
@@ -1,26 +1,20 @@
 # flink-pricing-window-feat-001 — sg_only_env variant
-# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
-
-FROM eclipse-temurin:17-jdk
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    ca-certificates \
-    python3 \
-    curl \
-    && rm -rf /var/lib/apt/lists/*
+# Source files truncated so agent must use Sourcegraph MCP for code access.
+# Verifier wrapper restores full repo before running tests.
+
+FROM ccb-repo-flink-0cc95fcc
+
+# --- sg_only_env: back up full repo, then truncate source ---
+RUN cp -a /workspace /repo_full
+RUN find /workspace -type f \( \
+    -name "*.java" -o -name "*.xml" -o -name "*.yaml" -o -name "*.yml" \
+    -o -name "*.json" -o -name "*.properties" -o -name "*.sh" -o -name "*.md" \
+    -o -name "*.txt" -o -name "*.toml" -o -name "*.gradle" -o -name "*.kt" \
+    -o -name "*.scala" -o -name "*.groovy" -o -name "*.py" \
+    \) ! -path "*/.git/*" -exec truncate -s 0 {} \;
+# Recommit truncated state so git history cannot recover full files.
+RUN cd /workspace && git add -A && git commit -m "sg_only truncation" --allow-empty --quiet
+RUN touch /tmp/.sg_only_mode && echo '/workspace' > /tmp/.sg_only_workdir
 
 WORKDIR /workspace
-
-# Empty git repo so agent can commit work
-RUN git init && \
-    git config user.email "agent@example.com" && \
-    git config user.name "Agent"
-
-RUN mkdir -p /logs/agent /logs/verifier
-
-RUN touch /tmp/.sg_only_mode
-
 ENTRYPOINT []
diff --git a/benchmarks/ccb_build/flipt-dep-refactor-001/environment/Dockerfile.sg_only b/benchmarks/ccb_build/flipt-dep-refactor-001/environment/Dockerfile.sg_only
@@ -1,27 +1,19 @@
 # flipt-dep-refactor-001 — sg_only_env variant
-# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
-
-FROM ubuntu:22.04
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    ca-certificates \
-    python3 \
-    curl \
-    && rm -rf /var/lib/apt/lists/*
+# Source files truncated so agent must use Sourcegraph MCP for code access.
+# Verifier wrapper restores full repo before running tests.
+
+FROM ccb-repo-flipt-3d5a345f
+
+# --- sg_only_env: back up full repo, then truncate source ---
+RUN cp -a /workspace /repo_full
+RUN find /workspace -type f \( \
+    -name "*.go" -o -name "*.py" -o -name "*.yaml" -o -name "*.yml" \
+    -o -name "*.json" -o -name "*.proto" -o -name "*.sh" -o -name "*.md" \
+    -o -name "*.txt" -o -name "*.toml" -o -name "*.cfg" \
+    \) ! -path "*/.git/*" ! -path "*/vendor/*" -exec truncate -s 0 {} \;
+# Recommit truncated state so git history cannot recover full files.
+RUN cd /workspace && git add -A && git commit -m "sg_only truncation" --allow-empty --quiet
+RUN touch /tmp/.sg_only_mode && echo '/workspace' > /tmp/.sg_only_workdir
 
 WORKDIR /workspace
-
-# Empty git repo so agent can commit work
-RUN git init && \
-    git config user.email "agent@example.com" && \
-    git config user.name "Agent"
-
-RUN mkdir -p /logs/agent /logs/verifier
-
-# Mark sg_only mode so verifiers can skip local-path checks
-RUN touch /tmp/.sg_only_mode
-
 ENTRYPOINT []
diff --git a/benchmarks/ccb_build/kafka-batch-accumulator-refac-001/environment/Dockerfile.sg_only b/benchmarks/ccb_build/kafka-batch-accumulator-refac-001/environment/Dockerfile.sg_only
@@ -1,26 +1,20 @@
 # kafka-batch-accumulator-refac-001 — sg_only_env variant
-# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
-
-FROM eclipse-temurin:17-jdk
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    ca-certificates \
-    python3 \
-    curl \
-    && rm -rf /var/lib/apt/lists/*
+# Source files truncated so agent must use Sourcegraph MCP for code access.
+# Verifier wrapper restores full repo before running tests.
+
+FROM ccb-repo-kafka-0753c489
+
+# --- sg_only_env: back up full repo, then truncate source ---
+RUN cp -a /workspace /repo_full
+RUN find /workspace -type f \( \
+    -name "*.java" -o -name "*.xml" -o -name "*.yaml" -o -name "*.yml" \
+    -o -name "*.json" -o -name "*.properties" -o -name "*.sh" -o -name "*.md" \
+    -o -name "*.txt" -o -name "*.toml" -o -name "*.gradle" -o -name "*.kt" \
+    -o -name "*.scala" -o -name "*.groovy" -o -name "*.py" \
+    \) ! -path "*/.git/*" -exec truncate -s 0 {} \;
+# Recommit truncated state so git history cannot recover full files.
+RUN cd /workspace && git add -A && git commit -m "sg_only truncation" --allow-empty --quiet
+RUN touch /tmp/.sg_only_mode && echo '/workspace' > /tmp/.sg_only_workdir
 
 WORKDIR /workspace
-
-# Empty git repo so agent can commit work
-RUN git init && \
-    git config user.email "agent@example.com" && \
-    git config user.name "Agent"
-
-RUN mkdir -p /logs/agent /logs/verifier
-
-RUN touch /tmp/.sg_only_mode
-
 ENTRYPOINT []
diff --git a/benchmarks/ccb_build/strata-cds-tranche-feat-001/environment/Dockerfile.sg_only b/benchmarks/ccb_build/strata-cds-tranche-feat-001/environment/Dockerfile.sg_only
@@ -1,26 +1,20 @@
 # strata-cds-tranche-feat-001 — sg_only_env variant
-# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
-
-FROM eclipse-temurin:17-jdk
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    ca-certificates \
-    python3 \
-    curl \
-    && rm -rf /var/lib/apt/lists/*
+# Source files truncated so agent must use Sourcegraph MCP for code access.
+# Verifier wrapper restores full repo before running tests.
+
+FROM ccb-repo-strata-66225ca9
+
+# --- sg_only_env: back up full repo, then truncate source ---
+RUN cp -a /workspace /repo_full
+RUN find /workspace -type f \( \
+    -name "*.java" -o -name "*.xml" -o -name "*.yaml" -o -name "*.yml" \
+    -o -name "*.json" -o -name "*.properties" -o -name "*.sh" -o -name "*.md" \
+    -o -name "*.txt" -o -name "*.toml" -o -name "*.gradle" -o -name "*.kt" \
+    -o -name "*.scala" -o -name "*.groovy" -o -name "*.py" \
+    \) ! -path "*/.git/*" -exec truncate -s 0 {} \;
+# Recommit truncated state so git history cannot recover full files.
+RUN cd /workspace && git add -A && git commit -m "sg_only truncation" --allow-empty --quiet
+RUN touch /tmp/.sg_only_mode && echo '/workspace' > /tmp/.sg_only_workdir
 
 WORKDIR /workspace
-
-# Empty git repo so agent can commit work
-RUN git init && \
-    git config user.email "agent@example.com" && \
-    git config user.name "Agent"
-
-RUN mkdir -p /logs/agent /logs/verifier
-
-RUN touch /tmp/.sg_only_mode
-
 ENTRYPOINT []
diff --git a/benchmarks/ccb_build/strata-fx-european-refac-001/environment/Dockerfile.sg_only b/benchmarks/ccb_build/strata-fx-european-refac-001/environment/Dockerfile.sg_only
@@ -1,26 +1,20 @@
 # strata-fx-european-refac-001 — sg_only_env variant
-# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
-
-FROM eclipse-temurin:17-jdk
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    ca-certificates \
-    python3 \
-    curl \
-    && rm -rf /var/lib/apt/lists/*
+# Source files truncated so agent must use Sourcegraph MCP for code access.
+# Verifier wrapper restores full repo before running tests.
+
+FROM ccb-repo-strata-66225ca9
+
+# --- sg_only_env: back up full repo, then truncate source ---
+RUN cp -a /workspace /repo_full
+RUN find /workspace -type f \( \
+    -name "*.java" -o -name "*.xml" -o -name "*.yaml" -o -name "*.yml" \
+    -o -name "*.json" -o -name "*.properties" -o -name "*.sh" -o -name "*.md" \
+    -o -name "*.txt" -o -name "*.toml" -o -name "*.gradle" -o -name "*.kt" \
+    -o -name "*.scala" -o -name "*.groovy" -o -name "*.py" \
+    \) ! -path "*/.git/*" -exec truncate -s 0 {} \;
+# Recommit truncated state so git history cannot recover full files.
+RUN cd /workspace && git add -A && git commit -m "sg_only truncation" --allow-empty --quiet
+RUN touch /tmp/.sg_only_mode && echo '/workspace' > /tmp/.sg_only_workdir
 
 WORKDIR /workspace
-
-# Empty git repo so agent can commit work
-RUN git init && \
-    git config user.email "agent@example.com" && \
-    git config user.name "Agent"
-
-RUN mkdir -p /logs/agent /logs/verifier
-
-RUN touch /tmp/.sg_only_mode
-
 ENTRYPOINT []
diff --git a/benchmarks/ccb_fix/django-modelchoice-fk-fix-001/environment/Dockerfile.sg_only b/benchmarks/ccb_fix/django-modelchoice-fk-fix-001/environment/Dockerfile.sg_only
@@ -1,26 +1,20 @@
 # django-modelchoice-fk-fix-001 — sg_only_env variant
-# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
-
-FROM python:3.11-slim
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    ca-certificates \
-    python3 \
-    curl \
-    && rm -rf /var/lib/apt/lists/*
+# Source files truncated so agent must use Sourcegraph MCP for code access.
+# Verifier wrapper restores full repo before running tests.
+
+FROM ccb-repo-django-674eda1c
+
+# --- sg_only_env: back up full repo, then truncate source ---
+RUN cp -a /workspace /repo_full
+RUN find /workspace -type f \( \
+    -name "*.py" -o -name "*.html" -o -name "*.css" -o -name "*.js" \
+    -o -name "*.yaml" -o -name "*.yml" -o -name "*.json" -o -name "*.cfg" \
+    -o -name "*.ini" -o -name "*.sh" -o -name "*.md" -o -name "*.txt" \
+    -o -name "*.toml" -o -name "*.rst" \
+    \) ! -path "*/.git/*" ! -path "*/site-packages/*" -exec truncate -s 0 {} \;
+# Recommit truncated state so git history cannot recover full files.
+RUN cd /workspace && git add -A && git commit -m "sg_only truncation" --allow-empty --quiet
+RUN touch /tmp/.sg_only_mode && echo '/workspace' > /tmp/.sg_only_workdir
 
 WORKDIR /workspace
-
-# Empty git repo so agent can commit work
-RUN git init && \
-    git config user.email "agent@example.com" && \
-    git config user.name "Agent"
-
-RUN mkdir -p /logs/agent /logs/verifier
-
-RUN touch /tmp/.sg_only_mode
-
 ENTRYPOINT []
diff --git a/benchmarks/ccb_fix/flipt-eval-latency-fix-001/environment/Dockerfile.sg_only b/benchmarks/ccb_fix/flipt-eval-latency-fix-001/environment/Dockerfile.sg_only
@@ -1,27 +1,19 @@
 # flipt-eval-latency-fix-001 — sg_only_env variant
-# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
-
-FROM ubuntu:22.04
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    ca-certificates \
-    python3 \
-    curl \
-    && rm -rf /var/lib/apt/lists/*
+# Source files truncated so agent must use Sourcegraph MCP for code access.
+# Verifier wrapper restores full repo before running tests.
+
+FROM ccb-repo-flipt-3d5a345f
+
+# --- sg_only_env: back up full repo, then truncate source ---
+RUN cp -a /workspace /repo_full
+RUN find /workspace -type f \( \
+    -name "*.go" -o -name "*.py" -o -name "*.yaml" -o -name "*.yml" \
+    -o -name "*.json" -o -name "*.proto" -o -name "*.sh" -o -name "*.md" \
+    -o -name "*.txt" -o -name "*.toml" -o -name "*.cfg" \
+    \) ! -path "*/.git/*" ! -path "*/vendor/*" -exec truncate -s 0 {} \;
+# Recommit truncated state so git history cannot recover full files.
+RUN cd /workspace && git add -A && git commit -m "sg_only truncation" --allow-empty --quiet
+RUN touch /tmp/.sg_only_mode && echo '/workspace' > /tmp/.sg_only_workdir
 
 WORKDIR /workspace
-
-# Empty git repo so agent can commit work
-RUN git init && \
-    git config user.email "agent@example.com" && \
-    git config user.name "Agent"
-
-RUN mkdir -p /logs/agent /logs/verifier
-
-# Mark sg_only mode so verifiers can skip local-path checks
-RUN touch /tmp/.sg_only_mode
-
 ENTRYPOINT []
diff --git a/benchmarks/ccb_fix/k8s-dra-scheduler-event-fix-001/environment/Dockerfile.sg_only b/benchmarks/ccb_fix/k8s-dra-scheduler-event-fix-001/environment/Dockerfile.sg_only
@@ -1,26 +1,19 @@
 # k8s-dra-scheduler-event-fix-001 — sg_only_env variant
-# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
-
-FROM golang:1.23-bookworm
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    ca-certificates \
-    python3 \
-    curl \
-    && rm -rf /var/lib/apt/lists/*
+# Source files truncated so agent must use Sourcegraph MCP for code access.
+# Verifier wrapper restores full repo before running tests.
+
+FROM ccb-repo-k8s-11602f08
+
+# --- sg_only_env: back up full repo, then truncate source ---
+RUN cp -a /workspace /repo_full
+RUN find /workspace -type f \( \
+    -name "*.go" -o -name "*.py" -o -name "*.yaml" -o -name "*.yml" \
+    -o -name "*.json" -o -name "*.proto" -o -name "*.sh" -o -name "*.md" \
+    -o -name "*.txt" -o -name "*.toml" -o -name "*.cfg" \
+    \) ! -path "*/.git/*" ! -path "*/vendor/*" -exec truncate -s 0 {} \;
+# Recommit truncated state so git history cannot recover full files.
+RUN cd /workspace && git add -A && git commit -m "sg_only truncation" --allow-empty --quiet
+RUN touch /tmp/.sg_only_mode && echo '/workspace' > /tmp/.sg_only_workdir
 
 WORKDIR /workspace
-
-# Empty git repo so agent can commit work
-RUN git init && \
-    git config user.email "agent@example.com" && \
-    git config user.name "Agent"
-
-RUN mkdir -p /logs/agent /logs/verifier
-
-RUN touch /tmp/.sg_only_mode
-
 ENTRYPOINT []
