Function build_commit 

pub fn build_commit(
    stores: &ServerStores,
    repo: &RepoRef,
    commit: ObjectId,
    workspace: &Path,
    builder: &str,
    allow_network: bool,
) -> Result<Built>

Build one commit and attest to what came out.

allow_network is the explicit opt-out from hermeticity, and it goes into the signed record. Without it a runner that cannot enter the sandbox fails rather than building: a record that says network: false must mean it on every machine, or it means nothing on any of them.