ci: move package image builds to Depot

[ndizazzo]

Summary

• route native-package, dry-image, and staging-image BuildKit work through the MeshLLM Depot project
• remove GitHub Actions BuildKit cache import/export; Depot now owns the persistent remote cache
• retain only the required runner transfers: package output for package QA and a dry image for runtime QA
• preserve direct staging push, digest-bound QA, and digest-only promotion

Validation

• actionlint
• node --experimental-strip-types --test tests/*.test.ts (85 passing)
• image-matrix coverage at 100%
• Dockerfile buildx --check for native-package-artifact and runtime
• YAML and diff checks

Follow-up

• GitHub Actions and CodeRabbit feedback are being monitored before review readiness.

Summary by CodeRabbit

• Chores

  • Updated package, dry-run, and staging image builds to use remote build infrastructure with persistent caching.
  • Staging images are now pushed directly to the registry for digest-based testing, while package and dry-run outputs remain available locally.
  • Improved package provenance handling and verification for more reliable release artifacts.

• Tests

  • Expanded release workflow validation for caching, build outputs, authentication permissions, provenance, and secure action configuration.

• Documentation

  • Added a TODO item covering remote builder adoption and cache validation requirements.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 317dc4a7-e55a-40c5-925a-ac7c4159eb25

📥 Commits

Reviewing files that changed from the base of the PR and between 6d07460 and ad2b0c4.

📒 Files selected for processing (4)

• .github/workflows/package-image-row.yml
• TODO.md
• tests/release-workflow.test.ts
• tests/workflow-provenance.test.ts

---

📝 Walkthrough

Walkthrough

The release workflow replaces Docker Buildx with pinned Depot actions for package, dry-run, and staging builds. Jobs use OIDC authentication and a shared Depot project. Package provenance is preserved or generated as a verified Depot receipt. Tests validate workflow configuration and provenance behavior.

Changes

Depot release build migration

Layer / File(s)	Summary
Depot build wiring .github/workflows/package-image-row.yml	Package, dry-run, and staging jobs use pinned Depot setup and build actions. Package output remains local, dry-run images load locally, and staging images push directly to the registry with a returned digest.
Package provenance verification .github/workflows/package-image-row.yml, tests/workflow-provenance.test.ts	The workflow preserves matching exporter provenance or creates a Depot receipt bound to the package digest and build identifiers. Tests cover valid, mismatched, and malformed provenance data.
Workflow contract validation tests/release-workflow.test.ts, TODO.md	Tests verify Depot project usage, pinned action references, output behavior, OIDC permissions, and removal of Docker Buildx and GHA cache settings. The TODO records related production-readiness checks.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant Depot
  participant Registry
  participant ReleaseQA
  GitHubActions->>Depot: Authenticate with OIDC and select project
  GitHubActions->>Depot: Build package and dry-run artifacts
  Depot-->>GitHubActions: Return package output and load dry-run image
  GitHubActions->>ReleaseQA: Run package and dry-run QA
  GitHubActions->>Depot: Build staging image
  Depot->>Registry: Push staging image
  Depot-->>GitHubActions: Return image digest
  GitHubActions->>ReleaseQA: Test staging image by digest

Loading

Possibly related PRs

• Mesh-LLM/mesh-packaging#14: Changes the product-v2 bundle format and provenance inputs consumed by these workflows.
• Mesh-LLM/mesh-packaging#15: Updates the related provenance workflow and provenance tests.
• Mesh-LLM/mesh-packaging#16: Modifies the related image build and digest-based testing workflow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: moving package image builds from GitHub Actions BuildKit to Depot.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/depot-remote-buildkit

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ndizazzo]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

tests/release-workflow.test.ts (1)

51-67: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Assert that staging still pushes and emits a digest.

The negative checks at Line [65] only reject local output and load. They also pass if push: true is removed, while downstream QA still reads steps.stage.outputs.digest. Add positive assertions for push: true, the staging tag, and the digest-bound QA reference.

Proposed test hardening

   assert.doesNotMatch(stage, /outputs: type=local|load: true/);
+  assert.match(stage, /push:\s+true/);
+  assert.match(stage, /tags: .*staging-/);
+  assert.match(stage, /steps\.stage\.outputs\.digest/);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/release-workflow.test.ts` around lines 51 - 67, Strengthen the test
around the stage job in test("package and image BuildKit work uses the Depot
project cache") by positively asserting push: true, the expected staging image
tag, and QA’s image reference bound to steps.stage.outputs.digest. Keep the
existing negative output/load checks and scope the new assertions to stage or
the downstream QA section as appropriate.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/release-workflow.test.ts`:
- Around line 69-77: Harden the release workflow test around the
action-reference validation by parsing every external `uses:` line in the
workflow and requiring its reference to be exactly a 40-character hexadecimal
commit SHA. Replace the current version-prefix assertion and incomplete explicit
action list in the test “new reusable and image-index actions use immutable
commits,” while preserving support for the pinned action variables.

---

Nitpick comments:
In `@tests/release-workflow.test.ts`:
- Around line 51-67: Strengthen the test around the stage job in test("package
and image BuildKit work uses the Depot project cache") by positively asserting
push: true, the expected staging image tag, and QA’s image reference bound to
steps.stage.outputs.digest. Keep the existing negative output/load checks and
scope the new assertions to stage or the downstream QA section as appropriate.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1442c345-4c2c-46fc-a21a-458e4ea0bfb9

📥 Commits

Reviewing files that changed from the base of the PR and between 76c619b and 6d07460.

📒 Files selected for processing (3)

• .github/workflows/package-image-row.yml
• TODO.md
• tests/release-workflow.test.ts

[ndizazzo]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.