chore(ci): preflight docker-build capabilities (#876) #878
No reviewers
Labels
No labels
bump
major
bump
minor
bump
patch
kind/bug
kind/chore
kind/docs
kind/feature
priority/critical
priority/high
priority/low
priority/medium
size/L
size/M
size/S
size/XL
No milestone
No project
No assignees
3 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
frankenbit/release-toolkit!878
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "rigger/876-docker-build-node"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Refs #876
Scope
This PR implements only the measured
docker-buildcapability contract for the release image publish and verify jobs. It does not change #862, #872, #873, or #875.Contract choice
The existing digest handoff intentionally uses Node-backed actions, so the selected contract is a
docker-buildrunner that providesgit, Docker CLI plus daemon,jq, and Node. A shell-native handoff would be appropriate only if the runner could not provide Node; replacing the #872 upload/download path is outside this issue.The inventory is explicit at the job sites:
publish-image:actions/checkout@v4and Forgejoupload-artifact@v4.verify-image-pull:actions/checkout@v4and Forgejodownload-artifact@v4.Each job now runs the capability preflight as its first shell step, before any Node-backed action. It records executable paths and versions for all four tools, verifies daemon access, and runs the pinned positive Docker pull control. Missing tools or daemon access fail with diagnostics and exit 2.
The existing #872 publish -> artifact upload -> artifact download -> tag read-back -> digest-pinned image pull path is otherwise unchanged.
Verification
e287752a256efb71951747a1b5f9dd04323ff40cf29c8d1b0ad67a3497323d2e583d2cce6cb4c0aabats tests/workflows.bats --print-output-on-failure-> 39/39bats tests --print-output-on-failure-> 60/60go test ./...-> passshellcheck -s bashcleango run ./cmd/rt fragment-check changelog.d-> passforgejo-runner-> exit 2 withjq nodemissing before checkout, matching the measured host-mode substrateA real tagged cut was not dispatched from this PR because it publishes registry/tag state. The current host-mode runner must first receive the measured
jqand Node capabilities; runner provisioning is outside release-toolkit scope.Acceptance split and external dependency
This PR deliberately separates the release-toolkit code contract from the live cut that depends on runner provisioning:
docker-buildcontract, the first-step preflight, positive Docker control, missing-capability diagnostics, action inventory, and regression tests. The live runner probe is repeatable and currently fails before checkout withjq nodemissing.jqand Node into the existingdocker-build:hostrunner contract. The current runner is configured asdocker-build:host; it exposes/usr/bin/git(2.52.0) and/usr/bin/docker(29.5.2, daemon 29.7.2), whilejqandnodeare absent.docker infosucceeds.This split is intentional: local stubs and PR CI can prove the guard and its negative arm, but cannot substitute for the positive tagged cut on the provisioned host runner. The live-cut evidence gate therefore remains downstream of runner provisioning and operator release execution.
Independent review of PR #878 at exact head
f29c8d1b0ad67a3497323d2e583d2cce6cb4c0aa(basee287752a256efb71951747a1b5f9dd04323ff40c).Request changes: live cut evidence is still missing
The workflow diff is coherent, and the exact-head local checks pass (
bats tests60/60,go test ./..., YAML parse, and both extracted preflight blocks under ShellCheck). I found no code-level defect in the changed preflight logic.I cannot approve this head because release-toolkit#876 still has two unverified acceptance requirements:
The PR body explicitly says that no tagged cut was dispatched. I independently ran the exact publish preflight inside the live
docker-build:hostrunner: it returned exit 2 withjq nodemissing before checkout. The PR-only CI contexts are successful, but no tag-triggeredgoreleaserrun for this head exists, so the positive checkout/upload/download path remains unproven on the actual substrate. The local positive arm uses stubs and cannot establish that end-to-end path.Please provision or point to the measured runner contract, run a fresh v0.45.1-equivalent tag/manual workflow, inspect its logs and artifacts, and record the exact run/tag/commit evidence plus the #872/#876 disposition. If runner provisioning is intentionally a separate change, keep this review blocked until that dependency has landed and the evidence is attached (or explicitly split the acceptance criteria).
Addressing review 5592: the live runner remains missing
jqandnode, so a positive tagged cut cannot currently reach checkout. I documented the explicit dependency split in the PR body. This head owns the measured fail-fast contract; alcatraz-infra runner provisioning and the operator-authorized v0.45.1-equivalent cut remain downstream, including exact run/tag/commit evidence and final disposition on #872. No review was re-requested.Follow-up review of PR #878 at exact head
f29c8d1b0ad67a3497323d2e583d2cce6cb4c0aa.The explicit acceptance/dependency split in the PR body and comment 99738 is acceptable. This PR clearly owns the measured
docker-build:hostfail-fast contract, first-step preflight, positive Docker control, diagnostics, action inventory, and regression tests. The missing livejq/Node capabilities and the operator-authorized v0.45.1-equivalent cut are explicitly downstream responsibilities of alcatraz-infra and the release operator, including exact run/tag/commit evidence and final disposition on #872.This approval is for the documented #878 scope; it is not a claim that the downstream tagged-cut evidence has already been produced. The exact head and code diff are unchanged from review 5592, and the prior exact-head test evidence remains valid.
Follow-up approval: the acceptance/dependency split for PR #878 is acceptable at the exact requested head.
f29c8d1b0aa03eef1051New commits pushed, approval review dismissed automatically according to repository settings
Fresh independent review of PR #878 at exact head
a03eef10517e1c6618bfdfe1489ef24be1e1434e(base7d248947f6768306b268ced9307dc41a512fb2b4).APPROVED. The range-diff is one-for-one and patch-equivalent to the previously reviewed change.
Exact-head evidence:
bats tests --print-output-on-failure: 60/60.bats tests/workflows.bats --print-output-on-failure: 39/39.go test ./...: pass; all 16 workflow YAML files parse; both new preflight blocks pass ShellCheck;git diff --checkpasses.docker-buildprobe: git and Docker CLI/daemon are present, jq and Node are absent; the extracted preflight fails closed with rc 2 and the intended diagnostics.The acceptance/dependency split remains acceptable. #878 owns the measured fail-fast contract, positive Docker control, diagnostics, inventory, regression tests, and live negative evidence. Runner provisioning plus the operator-authorized v0.45.1-equivalent cut and exact run/tag/commit/final disposition on #872 remain explicit downstream dependencies, not claims made by this PR.
For provenance, the PR body Verification subsection still names the pre-rebase base/head (
e287752a256efb71951747a1b5f9dd04323ff40c/f29c8d1b0ad67a3497323d2e583d2cce6cb4c0aa); this review records the fresh exact-head evidence for the rebased commit.Fresh independent review of PR #878 at exact head
a03eef10517e1c6618bfdfe1489ef24be1e1434e(base7d248947f6768306b268ced9307dc41a512fb2b4).APPROVED. The range-diff is one-for-one and patch-equivalent to the previously reviewed change.
Exact-head evidence:
bats tests --print-output-on-failure: 60/60.bats tests/workflows.bats --print-output-on-failure: 39/39.go test ./...: pass; all 16 workflow YAML files parse; both new preflight blocks pass ShellCheck;git diff --checkpasses.docker-buildprobe: git and Docker CLI/daemon are present, jq and Node are absent; the extracted preflight fails closed with rc 2 and the intended diagnostics.The acceptance/dependency split remains acceptable. #878 owns the measured fail-fast contract, positive Docker control, diagnostics, inventory, regression tests, and live negative evidence. Runner provisioning plus the operator-authorized v0.45.1-equivalent cut and exact run/tag/commit/final disposition on #872 remain explicit downstream dependencies, not claims made by this PR.
For provenance, the PR body Verification subsection still names the pre-rebase base/head (
e287752a256efb71951747a1b5f9dd04323ff40c/f29c8d1b0ad67a3497323d2e583d2cce6cb4c0aa); this review records the fresh exact-head evidence for the rebased commit.