ci: build once, test exact outputs, and promote by digest - #16
Merged
Conversation
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (29)
📝 WalkthroughWalkthroughThe release system now uses typed plans and exact selectors, a reusable package-image workflow, verified upstream Node addon archives, SPDX subject validation, canonical image indexes, and immutable digest promotion with conditional readiness checks. ChangesRelease packaging workflow
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant ReleaseWorkflow
participant ReleasePlan
participant PackageImageRow
participant ReleaseIndex
participant Registry
ReleaseWorkflow->>ReleasePlan: build typed plan from selectors
ReleasePlan-->>ReleaseWorkflow: return enabled rows and publication flags
ReleaseWorkflow->>PackageImageRow: execute selected packaging rows
PackageImageRow->>Registry: stage and test image digest
PackageImageRow-->>ReleaseWorkflow: upload image result evidence
ReleaseWorkflow->>ReleaseIndex: validate staged results and assemble index
ReleaseIndex->>Registry: promote verified digests without rebuilding
Possibly related PRs
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
ndizazzo
changed the title
ndizazzo
marked this pull request as ready for review
July 31, 2026 01:04
This was referenced Aug 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This applies the composable Mesh-LLM CI model to packaging:
Producer/composer contract
upstream product-v2 -> native package -> final runtime image -> exact QA -> index -> tag promotionThe reusable per-row workflow owns package and image production. Dry validation has only
contents: readand performs no registry login or push. Publishing receives explicit staging permissions without broad secret inheritance, builds one staging image, pulls its exact digest for command/readiness QA, and records exact package, host, runtime, base-image, upstream, and source identities. Promotion consumes only the verified index and contains no Docker build.Node addon ownership is upstream in merged Mesh-LLM PR #1113. Packaging downloads versioned release archives and checksum sidecars, accepts only the exact target directory plus addon/manifest files, rejects links and extra paths, verifies the inner SHA-256, and assembles npm without Cargo or
build:native.Dispatch policy
Manual runs use
validate_native,validate_homebrew, andvalidate_npm, plus exact native/npm selectors. Selectors accept onlyallor checked-in IDs. Aliases, empty/duplicate tokens, unknown IDs, and all-disabled plans fail closed.Image publication requires every native row; package release publication requires every native row plus Homebrew; npm publication requires all five addon lanes. Dry-run mode forces publication off without broadening the selected graph.
Validation and execution evidence
ffd240c099d38dc1e16cb252f30b347a6d835399.git diff --check, and rendered Homebrewbrew style: clean.Earlier rehearsal failures exposed and fixed real integration gaps: prerelease npm tagging, CUDA flavor normalization, public-discovery-dependent readiness, current Homebrew style/audit behavior, and canonical Syft package-root representations for Arch and Debian. The final run exercises those fixes against the immutable upstream
v0.75.0-rc1release graph.No package, image, npm, release asset, or production tag was published by these validations.
Rollback
Reverting this PR restores the previous workflow. For future promotion failures, the uploaded rollback ledger records each moving tag's prior digest; immutable version tags are never overwritten on a digest mismatch.
Summary by CodeRabbit