Mark obuilder as vendored

[shonfeder]

To address #250 (comment)

[MisterDA]

You'll need to update the hashes of the base docker images, and of the opam-repository as well. Try something like:

function docker_inspect_ocaml_opam() {
    local img=ocaml/opam:debian-12-ocaml-4.14
    docker pull "$img"
    local id=$(docker inspect --format='{{index .RepoDigests 0}}' "$img")
    printf "FROM %s:%s AS build" "$img" "${id##*:}"
}

function opam_repo_docker_head() {
    local img=ocaml/opam:debian-12-ocaml-4.14
    docker pull "$img"
    local id=$(docker run --rm --entrypoint bash "$img" --login -c 'cd opam-repository && git --no-pager rev-parse HEAD')
    printf "RUN cd ~/opam-repository && git fetch -q origin master && git reset --hard %s && opam update" "$id"
}

[shonfeder]

Thanks for the review. I'm not clear on your comment tho, are you advising that as necessary on this PR or as updates to other parts of the infra?

[MisterDA]

ocurrent-deployer builds all PRs to the ocurrent services using the Docker images in their git repositories. You can see that the deployability CI job failed on this PR, because I've raised the lower-bounds in OBuilder of Lwt and Dune, and the ocluster Dockerfile hard-codes a hash of the base OCaml Docker image, and the opam repository it uses. At that time, Lwt 5.7 and Dune had not been released.
The scripts I've shared allow to retrieve the sha of the latest OCaml Docker image, and the opam repository sha it embeds. You need to update at least the opam-repository sha (preferably both) to allow the deployer to build again this service.

[shonfeder]

Ah yes, I see the failing deployability check. Missed that before. This is a more fiddly update than I expected. I will drop the obuilder update and instead just add the vendored dirs declaration.

I will drop the obuilder update, and instead opt for https://github.com/tarides/infrastructure/issues/389, applying the deployment update there as needed.

Thanks for the guidance :)