Implement guarded GHCR server image delivery lane (#186) #231
No reviewers
Labels
No labels
accessibility
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
P1
P2
P3
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
Creatidy/scarcity-router!231
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "issue-186-ghcr-distribution"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Refs #186. Independently executable GHCR code/build unit under D-083, not a release or full platform-acceptance claim. HEAD5e8f747 (exact SHA in review record); base04f40ddf59ea1abba6719208166daa94aeeddb1a.
Changes: build-server-image builds the exact-source linux/amd64 image, verifies version/revision/platform, exercises existing /healthz inside an isolated non-root/read-only container with uid10001-writable tmpfs/data and no published ports, then archives tested image+checksum+same-run provenance. Dedicated tag-only publish-ghcr validates event, stable version, checksum, provenance/image identity BEFORE registry contact; packages:write only there, run token via stdin and exported private temporary DOCKER_CONFIG removed on success/failure. No new action/dependency; existing actions remain SHA-pinned. All public artifact builds and finalized Windows ZIP must succeed before any publishing job; PyPI last.
Release safety: immutable X.Y.Z refuses different content; fixed publication concurrency group plus strict remote version-label checks prevent old retries regressing X.Y/latest. Exact missing-manifest diagnostics only; auth/transport/TLS errors never assumed absent. Retry repairs missing/stale aliases, preserves newer stable aliases. Publication itself is not claimed atomic across channels. Image archive stays separate from the exact3-entry GitHub SHA256SUMS and PyPI distributions. Existing Windows signing/MSIX fail-closed seam unchanged.
Proof: added offline execution of the workflow's actual shell scripts with fake Docker/synthetic token, covering candidate/non-tag/bad provenance/checksum/labels/platform refusal, token/config lifecycle, registry errors, immutable conflict, partial retry and newer-alias preservation, container smoke flags/cleanup. No Docker/registry operation or workflow actually executed by this delivery. Existing release/Windows/package tests extended; docs mark workflow CODE implemented but LIVE_GHCR_PUBLICATION, Windows/live/signing/owner activation gates open.
Validation in env-i/synthetic HOME: uv sync --only-dev; full make check3113 OK/18 skips(707.250s) plus basedpyright0/0/0; make package-check all checks passed on identical production/workflow source (final subsequent change corrected test fake version matching; focused117 and full3113 rerun green); actionlint and all shell syntax clean; git diff/staged diff --check clean. No live providers, credentials, tag, signing, public upload, release or deployment.
Remaining #186 scope (not erased): full platform installation/upgrade/recovery acceptance, real Windows/portable runner evidence, signed MSIX implementation/signing resources, first real GHCR/PyPI owner activation/publication. #224 owns transport/TLS and #227 downstream composed acceptance. Issue remains open; no closing keywords.
Imminent independent whole-PR review invocation1/10 (default finite186 delivery budget), fresh native local Kilo pr-reviewer session explicitly GLM-5.3/zai-coding-plan. Frozen HEAD5e8f74773509d0eaa1e595aabb281fe1f20b9596,base=merge-base04f40ddf59ea1abba6719208166daa94aeeddb1a; primary verified canonicalmetadata, Git objects, complete6-file scoped delta and clean checkout. Scope includes correctness/security/UX of GHCR code, token boundary, tag/retry concurrency, offline test fidelity and documentation honesty. No source writes/switches/pushes while review active. This review covers the whole PR; it is not final project-level Daybreak or any publication authorization.
Invocation1 actual fresh native reviewer verified in Agent Manager overview: ses_e7d344d86ffeMLXRlyZW4Df754 (busy), requestam-1793195749961-fdvdn4, resolvedGLM-5.3/zai-coding-plan, pr-reviewer read-only role. Exact frozen HEAD5e8f74773509d0eaa1e595aabb281fe1f20b9596 / base=merge-base04f40ddf59ea1abba6719208166daa94aeeddb1a. Security/correctness/UX whole-PR source review; results will be retrieved directly from this session. No extra worktree or manual prompt/result relay.
Independent native GLM-5.3 security/correctness/UX invocation1/10 FINAL APPROVE/findings[] received directly from ses_e7d344d86ffeMLXRlyZW4Df754. Exact reviewed HEAD5e8f74773509d0eaa1e595aabb281fe1f20b9596/base=merge-base04f40ddf59ea1abba6719208166daa94aeeddb1a. Full6-file diff/source reviewed; scope/graph/credentials/container/registry/alias-concurrency/testfidelity/docs assessed. One targeted continuation completed initially idle unfinished review; later same-invocation schema clarification correctly classified two expressly intentional, no-remediation observations (exact missing-manifest fail-closed matching; rebuilt image immutability) as limitations, not defects; no source change/newreview. Reviewer Bash denied by role; used fresh canonical getters+full local reads; primary independently verified actual Git objects/clean/currentness. No actual Docker/registry/workflow run; LIVE_GHCR_PUBLICATION staysopen. Source/gates unchanged:3113OK/18skips707.250s,basedpyright0/0/0,packagecheckpass,actionlint/shellsyntax/whitespaceclean. Candidate merge-tree1b05714857bef48d84f9ee93f156e94bb2a687b5 equals approvedHEAD tree. No material unresolved finding; proceed supported authorized merge to develop, not release or full186closure.