Add measured Depot base-image caching

[ndizazzo]

What changed

• map every declared package/runtime base repository to a Depot pull-through repository
• select mirrors only for exact trusted main release invocations
• preserve and verify the resolved upstream manifest digest
• authenticate each build job with a short-lived OIDC-backed Depot pull token
• document dashboard setup, measurement thresholds, scope, and rollback
• extend matrix and workflow policy tests

Why

Ubuntu, CUDA, ROCm, and Arch bases are large and frequently pulled. Pull-through caching may reduce cold transfer and registry throttling, but remains disabled until the fresh-runner canary demonstrates identical digests plus at least 20% and 10 seconds of median improvement.

Validation

• image matrix validation and representative Ubuntu/CUDA/ROCm/Arch expansion
• 100% coverage matrix suite
• full 90-test TypeScript suite
• actionlint and shellcheck
• git diff --check

The optional local Docker frontend check could not connect to the local Docker endpoint (failed to build: EOF).

Summary by CodeRabbit

• New Features

  • Added optional Depot Registry pull-through caching for supported Ubuntu, CUDA, ROCm, Alpine, and Arch Linux base images.
  • Trusted release workflows can use configured mirrors while preserving image tags and digests.
  • Added short-lived, read-only authentication and manifest verification for cached images.
  • Non-release and untrusted workflows continue using public image references.

• Documentation

  • Documented configuration, repository mappings, rollout guidance, validation requirements, and rollback procedures.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 80b4ec31-4a96-4f0c-b6d1-26174e3e6c7b

📥 Commits

Reviewing files that changed from the base of the PR and between 5449d49 and d521b57.

📒 Files selected for processing (9)

• .github/workflows/package-image-row.yml
• README.md
• TODO.md
• docs/matrix.md
• docs/publishing.md
• packaging/images.json
• scripts/image-matrix.ts
• tests/image-matrix.test.ts
• tests/release-workflow.test.ts

---

📝 Walkthrough

Walkthrough

The change adds Depot Registry pull-through mappings for supported base images. Matrix generation validates and records cache repositories. Trusted release workflows rewrite and verify digest-pinned references, authenticate downstream jobs, and document activation and rollback rules.

Changes

Depot Registry pull-through cache

Layer / File(s)	Summary
Base-image mapping and validation scripts/image-matrix.ts, packaging/images.json, tests/image-matrix.test.ts, docs/matrix.md	The matrix canonicalizes base references, validates configured Depot repositories, and adds package and runtime cache repository fields to matrix rows.
Trusted workflow cache activation .github/workflows/package-image-row.yml	The package job enables Depot mirrors only for approved release contexts, preserves digests, validates inputs, authenticates, verifies manifests, and exports cache state.
Downstream image authentication and verification .github/workflows/package-image-row.yml, tests/release-workflow.test.ts	Dry-image and stage-image jobs authenticate to the selected runtime-base registry. Tests cover gating, digest verification, token handling, and image propagation.
Configuration and operating policy README.md, docs/publishing.md, TODO.md	Documentation describes supported repositories, activation rules, short-lived credentials, verification, rollback, and validation results.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PackageJob
  participant BaseImageResolution
  participant DepotRegistry
  participant DryImageJob
  participant StageImageJob
  PackageJob->>BaseImageResolution: provide cache settings and workflow context
  BaseImageResolution->>DepotRegistry: authenticate and resolve configured repositories
  DepotRegistry-->>BaseImageResolution: return manifest digests
  BaseImageResolution-->>PackageJob: return rewritten immutable base references
  PackageJob->>DryImageJob: export cache selection and registry host
  PackageJob->>StageImageJob: export cache selection and registry host
  DryImageJob->>DepotRegistry: authenticate for runtime-base pulls
  StageImageJob->>DepotRegistry: authenticate for runtime-base pulls

Loading

Possibly related PRs

• Mesh-LLM/mesh-packaging#15: Both changes modify scripts/image-matrix.ts and matrix row generation.
• Mesh-LLM/mesh-packaging#16: Both changes modify the reusable packaging workflow and image-matrix handling.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/depot-pull-through-cache

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}