feat(workflow): add digest-bearing image publication workflows#17
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
josh-tracey
changed the title
Adds a safe, non-mutating stage for planning image pushes. Introduces the ImagePushPlan model and wiring in the WorkflowPlanner. Verifies safe step configurations for profiles.
Replace the intermediate ImagePushPlan/ImagePushPlanReport indirection with a flat ImagePushPlanReport that owns environment, mutates_registry, and a vec of ImagePushPlanItem (with action, image_ref fields). - Rename WorkflowPlan.push_plan to image_push_plan (ImagePushPlanReport) - Compute ImagePushPlanReport during planning, attach to WorkflowPlan - Write image_push_plan into JSON report via write_workflow_report - Add render_image_push_plan_text for CLI output - Add ImageArtifact::from_push_plan_item helper - Fix tests: set profile.name manually (field is #[serde(skip)]) - Use tempdir in runner report test to avoid project-dir side effects
…tion This commit implements the first registry-mutating workflow, `ci-build-push`, proving that Sailr can safely build, push, and capture immutable image artifacts in a CI pipeline. Key changes: - **Profiles**: Added `ci-build-push` profile to `sailr.workflow.toml` and `default_config.toml` configured with `push=run` and `apply=true`. - **Registry Configs**: Refactored `Environment.registry` to parse either a string or a detailed `RegistryConfig`, enabling dynamic namespace configuration instead of relying on hardcoded defaults. - **Push Execution**: Generated `ServicePush` and `ImageReport` tasks in `planner.rs` to orchestrate `docker push`. - **Digest Capture**: Implemented `parse_pushed_digest` for safe, regex-free substring scanning to capture immutable image digests from Docker output. - **Workflow Accumulator**: Introduced the Sailr-owned `WorkflowReportAccumulator` to securely collect pushed `ImageArtifact` records at runtime and plumb them back into the final JSON execution report without polluting `runkernel`. - **Safety Gates**: Enforced strict safety validations in `runner.rs`, mandating `--apply` and `approval=external` to execute `push=run`. - **Workflows**: Added a manual `.github/workflows/image-push.yml` GitHub action to test the pipeline. Implements Stage 3 of PR #17.
- Splitting format, lint, and test into parallel jobs - Fixing formatting in src/ - Fixing test panics for planner.rs
…hen normalizing a mutating build profile
josh-tracey
changed the title
- Fix test environments to pass RegistryConfig.host() checks - Refactor test_write_workflow_report to JSON fixture validation - Resolve identical blocks, unused mut, and unused field assignments flagged by clippy - Expand inspect() to correctly surface image target refs and resolved registry
Refactor finalizer lifecycle into discrete BeforeReport and ReportSink phases. This guarantees all runtime logic, like writing build caches, completes prior to generating the workflow report, preventing side-effects from missing the report status or hiding failures. Success logic is unified: pipeline failure OR finalizer failure halts execution and results in a failed workflow run. Tests have been updated to reflect the new WorkflowReportFinalizers representation without altering older fixtures directly.
josh-tracey
marked this pull request as ready for review
July 12, 2026 20:12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR #17 implements:
Non-Goals for this PR:
Stage 1: image publication contract
Status: complete
Includes:
Stage 2: ci-build-push-plan
Status: complete
Includes:
Stage 3: ci-build-push
Status: complete
Includes:
Provenance policy:
Stage 3.5: external repository validation
Status: tracked separately
Separate pilot goals:
Stage 4: target-neutral promotion planning
Status: follow-up PR
Goals: