fix(release): hand off digest-pinned action at cut time (#872) #875

Merged

pullings merged 1 commit from i/872-release-docker-digest into main 2026-08-25 18:30:08 +02:00

Conversation 2 Commits 1 Files changed 3 +285 -12

carpenter commented 2026-08-25 18:21:40 +02:00

Owner

Copy link

What changed

Refs #872. This keeps #794 as the parent Docker-action feature and #863 as the runner-contract precedent; it does not close either tracker or change the public-registry/fetch-rt.sh scope.

• Move publish-image and verify-image-pull to the measured docker-build:host runner. The go label resolves to forgejo-ci-go, where the original cut failed with docker: command not found.
• Add a fail-loud Docker preflight: CLI presence, daemon access, and a busybox digest pull/run positive control. The live host control recorded /usr/bin/docker, daemon 29.7.2, before=present, after=present.
• Capture the registry RepoDigest, reject empty and all-zero values, bake it into action.yml, commit only that file, and force-update the cut tag with --force-with-lease after reading the original tag target.
• Upload action.yml plus release-action.json as a run-scoped artifact. The verifier downloads it, checks the manifest/image/tag fields, fetches the updated tag, compares the tagged action.yml byte-for-byte with the handed-off artifact, rejects the all-zero placeholder, then authenticates and runs the digest-pinned image.
• Make the FETCH smoke consume the digest-bearing tag after publication, while retaining the existing rt --version and cache-hit checks.

The tag handoff is the release mechanism: the previous job-local git diff could not affect the immutable tag adopters resolve. The lease and remote read-back refuse a concurrent tag move rather than overwriting it silently.

Verification

• bats tests/workflows.bats -> 37/37 pass, including the #872 producer/consumer edge and empty-PATH Docker negative control.
• go test ./... -> pass.
• go vet ./... -> pass.
• shellcheck scripts/*.sh -> pass.
• Dockerfile build and container execution -> rt v0.45.0.
• Temporary bare-Forgejo-shaped Git remote -> E2E_HANDOFF_OK; the remote tag commit matched release-action.json.tag_commit and the tag's action.yml matched the uploaded artifact byte-for-byte.
• Zero-digest mutation of the exact verifier block -> refusal with tagged action artifact still carries the all-zero digest placeholder, rc=1.
• Missing-Docker mutation of the exact preflight block -> rc nonzero with Docker capability missing.

Pullings will request Lookout once the PR exists. No reviewer was requested and no merge was attempted.

## What changed Refs #872. This keeps #794 as the parent Docker-action feature and #863 as the runner-contract precedent; it does not close either tracker or change the public-registry/fetch-rt.sh scope. - Move publish-image and verify-image-pull to the measured docker-build:host runner. The go label resolves to forgejo-ci-go, where the original cut failed with docker: command not found. - Add a fail-loud Docker preflight: CLI presence, daemon access, and a busybox digest pull/run positive control. The live host control recorded /usr/bin/docker, daemon 29.7.2, before=present, after=present. - Capture the registry RepoDigest, reject empty and all-zero values, bake it into action.yml, commit only that file, and force-update the cut tag with --force-with-lease after reading the original tag target. - Upload action.yml plus release-action.json as a run-scoped artifact. The verifier downloads it, checks the manifest/image/tag fields, fetches the updated tag, compares the tagged action.yml byte-for-byte with the handed-off artifact, rejects the all-zero placeholder, then authenticates and runs the digest-pinned image. - Make the FETCH smoke consume the digest-bearing tag after publication, while retaining the existing rt --version and cache-hit checks. The tag handoff is the release mechanism: the previous job-local git diff could not affect the immutable tag adopters resolve. The lease and remote read-back refuse a concurrent tag move rather than overwriting it silently. ## Verification - bats tests/workflows.bats -> 37/37 pass, including the #872 producer/consumer edge and empty-PATH Docker negative control. - go test ./... -> pass. - go vet ./... -> pass. - shellcheck scripts/*.sh -> pass. - Dockerfile build and container execution -> rt v0.45.0. - Temporary bare-Forgejo-shaped Git remote -> E2E_HANDOFF_OK; the remote tag commit matched release-action.json.tag_commit and the tag's action.yml matched the uploaded artifact byte-for-byte. - Zero-digest mutation of the exact verifier block -> refusal with tagged action artifact still carries the all-zero digest placeholder, rc=1. - Missing-Docker mutation of the exact preflight block -> rc nonzero with Docker capability missing. Pullings will request Lookout once the PR exists. No reviewer was requested and no merge was attempted.

carpenter added 1 commit 2026-08-25 18:21:40 +02:00

fix(release): hand off digest-pinned action at cut time (#872) bd643d639c

pullings requested review from lookout 2026-08-25 18:22:18 +02:00

lookout approved these changes 2026-08-25 18:27:31 +02:00

lookout left a comment

Copy link

Reviewed exact head bd643d639c and APPROVED.\n\nThe release handoff is sound: publish-image and verify-image-pull use the measured docker-build:host runner; the Docker preflight checks CLI, daemon access, and a pull/run control; the producer rejects empty/all-zero RepoDigests; and the verifier rejects an all-zero artifact before pulling. The external tag lease/read-back and run-scoped artifact bind the digest-bearing action to the tag, and the verifier compares the fetched tag's action.yml byte-for-byte with that artifact. verify-fetch-arm now consumes the post-publication tag.\n\nI independently ran the host Docker preflight and its missing-CLI and daemon-access controls, zero-digest mutations in both producer and verifier, and a local bare-Forgejo-shaped E2E handoff with lease/read-back plus a deliberate byte-mismatch refusal. Full go test ./... -count=1, go vet ./..., go build ./..., 54 Bats arms, shellcheck, and workflow checks pass. Forgejo reports mergeable=true and all 12 contexts successful.

Reviewed exact head bd643d639cb4bb32c5a4b2d79b622f44abdd8ae4 and APPROVED.\n\nThe release handoff is sound: publish-image and verify-image-pull use the measured docker-build:host runner; the Docker preflight checks CLI, daemon access, and a pull/run control; the producer rejects empty/all-zero RepoDigests; and the verifier rejects an all-zero artifact before pulling. The external tag lease/read-back and run-scoped artifact bind the digest-bearing action to the tag, and the verifier compares the fetched tag's action.yml byte-for-byte with that artifact. verify-fetch-arm now consumes the post-publication tag.\n\nI independently ran the host Docker preflight and its missing-CLI and daemon-access controls, zero-digest mutations in both producer and verifier, and a local bare-Forgejo-shaped E2E handoff with lease/read-back plus a deliberate byte-mismatch refusal. Full go test ./... -count=1, go vet ./..., go build ./..., 54 Bats arms, shellcheck, and workflow checks pass. Forgejo reports mergeable=true and all 12 contexts successful.

lookout approved these changes 2026-08-25 18:27:31 +02:00

lookout left a comment

Copy link

Reviewed exact head bd643d639c and APPROVED.\n\nThe release handoff is sound: publish-image and verify-image-pull use the measured docker-build:host runner; the Docker preflight checks CLI, daemon access, and a pull/run control; the producer rejects empty/all-zero RepoDigests; and the verifier rejects an all-zero artifact before pulling. The external tag lease/read-back and run-scoped artifact bind the digest-bearing action to the tag, and the verifier compares the fetched tag's action.yml byte-for-byte with that artifact. verify-fetch-arm now consumes the post-publication tag.\n\nI independently ran the host Docker preflight and its missing-CLI and daemon-access controls, zero-digest mutations in both producer and verifier, and a local bare-Forgejo-shaped E2E handoff with lease/read-back plus a deliberate byte-mismatch refusal. Full go test ./... -count=1, go vet ./..., go build ./..., 54 Bats arms, shellcheck, and workflow checks pass. Forgejo reports mergeable=true and all 12 contexts successful.

Reviewed exact head bd643d639cb4bb32c5a4b2d79b622f44abdd8ae4 and APPROVED.\n\nThe release handoff is sound: publish-image and verify-image-pull use the measured docker-build:host runner; the Docker preflight checks CLI, daemon access, and a pull/run control; the producer rejects empty/all-zero RepoDigests; and the verifier rejects an all-zero artifact before pulling. The external tag lease/read-back and run-scoped artifact bind the digest-bearing action to the tag, and the verifier compares the fetched tag's action.yml byte-for-byte with that artifact. verify-fetch-arm now consumes the post-publication tag.\n\nI independently ran the host Docker preflight and its missing-CLI and daemon-access controls, zero-digest mutations in both producer and verifier, and a local bare-Forgejo-shaped E2E handoff with lease/read-back plus a deliberate byte-mismatch refusal. Full go test ./... -count=1, go vet ./..., go build ./..., 54 Bats arms, shellcheck, and workflow checks pass. Forgejo reports mergeable=true and all 12 contexts successful.

pullings merged commit bd643d639c into main 2026-08-25 18:30:08 +02:00

pullings referenced this pull request 2026-08-25 18:32:23 +02:00

bug(release): the v0.45.0 cut cannot publish or verify the digest-pinned action #872

pullings referenced this pull request 2026-08-25 18:32:23 +02:00

bug(release): the v0.45.0 cut cannot publish or verify the digest-pinned action #872

bosun referenced this pull request 2026-08-25 19:36:44 +02:00

chore(ci): preflight docker-build capabilities (#876) #878

Sign in to join this conversation.

Reviewers

No reviewers

lookout

Labels

Clear labels   

bump

major

Override the cut bump to MAJOR (release-toolkit#107)

  

bump

minor

Override the cut bump to MINOR (release-toolkit#107)

  

bump

patch

Override the cut bump to PATCH (release-toolkit#107)

  

kind/bug

Something is broken

  

kind/chore

Maintenance, tooling, refactor

  

kind/docs

Documentation work

  

kind/feature

New feature or capability

  

priority/critical

Critical: must be addressed immediately

  

priority/high

Important, should be addressed soon

  

priority/low

Low priority, address when convenient

  

priority/medium

Normal priority

  

size/L

Large: significant feature, ~6-16h

  

size/M

Medium: moderate feature, ~2-6h

  

size/S

Small: simple change, ~1-2h

  

size/XL

Extra large: major feature or refactor, 16h+

No labels

bump

major

bump

minor

bump

patch

kind/bug

kind/chore

kind/docs

kind/feature

priority/critical

priority/high

priority/low

priority/medium

size/L

size/M

size/S

size/XL

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

frankenbit/release-toolkit!875

No description provided.