feat(init_mega): ship mega-init image (#2159)

* chore(moon): migrate off @shopify/react-shortcuts and upgrade jsdom/scrollbar-hide

* feat(moon): add admin VM terminal UI on /oc

Wire an xterm panel and WebSocket client for the future mono terminal
proxy so admins can open an interactive shell next to View logs.

* feat(orion-scheduler): add VM terminal WebSocket and retain_antares_mounts

Expose /vms/{id}/terminal via qlean InteractiveShell, proxy it through
mono for the moon UI, and allow webhook/config to set ORION_RETAIN_ANTARES_MOUNTS.

* feat(init_mega): ship mega-init image and drop libra import

Add Dockerfile and deploy workflow for buckal-bundles sync only,
and remove the optional --with-libra / import-buck2-deps path from
init_mega so the Job stays focused on toolchains sync.

* fix(moon): clear ESLint errors blocking test-web-ui

Satisfy padding-line-between-statements in MergedItem and drop unused catch bindings flagged on PR CI.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: benjamin-747

.dockerignore

@@ -13,7 +13,13 @@ tools/**
 
 docs
 
-scripts
+# Exclude scripts by default (large / unused in most images), but keep the
+# paths required by scripts/init_mega/Dockerfile (mega-init image).
+scripts/*
+!scripts/init_mega/
+!scripts/init_mega/**
+!scripts/import-buck2-deps/
+!scripts/import-buck2-deps/**
 
 tests
 

.github/workflows/base.yml

@@ -24,6 +24,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   format:
     if: ${{ !(github.repository == 'gitmono-dev/mega' && github.event_name == 'push') }}

.github/workflows/mega-init-deploy.yml

@@ -0,0 +1,53 @@
+name: Mega Init deploy
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/mega-init-deploy.yml"
+      - "scripts/init_mega/**"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  REPOSITORY: mega/mega-init
+  IMAGE_TAG: latest
+  HARBOR_REGISTRY: registry.xuanwu.openatom.cn
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.HARBOR_REGISTRY }}
+          username: ${{ secrets.HARBOR_USERNAME }}
+          password: ${{ secrets.HARBOR_PASSWORD }}
+
+      - name: Build, tag, and push docker image to Harbor
+        run: |
+          set -euo pipefail
+
+          HARBOR_IMAGE_BASE="${{ env.HARBOR_REGISTRY }}/${{ env.REPOSITORY }}"
+          IMAGE_TAG="${{ env.IMAGE_TAG }}"
+          SHORT_SHA="${GITHUB_SHA:0:7}"
+
+          docker build \
+            -f scripts/init_mega/Dockerfile \
+            -t "$HARBOR_IMAGE_BASE:$IMAGE_TAG" \
+            -t "$HARBOR_IMAGE_BASE:$SHORT_SHA" \
+            .
+
+          docker push "$HARBOR_IMAGE_BASE:$IMAGE_TAG"
+          docker push "$HARBOR_IMAGE_BASE:$SHORT_SHA"

.github/workflows/release.yml

@@ -27,6 +27,10 @@ jobs:
             context: .
             dockerfile: orion-server/Dockerfile
 
+          - name: mega-init
+            context: .
+            dockerfile: scripts/init_mega/Dockerfile
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/services.yml

@@ -15,6 +15,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   # Label of the runner job
   runner-job:

.github/workflows/web-sync-server-deploy.yml

@@ -15,6 +15,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 env:
   REGISTRY_ALIAS: m8q5m4u3
   REPOSITORY: mega/web-sync-server

.github/workflows/web-test.yml

@@ -8,6 +8,9 @@ on:
       - '.github/workflows/web-deploy.yml'
       - 'moon/**'
 
+permissions:
+  contents: read
+
 env:
   TIPTAP_PRIVATE_REGISTRY_KEY: CjqFil0n7z4GGur+RPric21fBBeSB4R4FoNdRYOE1bQEz6AXLCoANCc+o9rLIg6Q