Submodule SHA-driven artifact fetch, rename ci.yml, fix Dockerfile

- Rename ci.yml → verify.yml (file matches workflow name)
- Rewrite setup-deps-tarball.sh to use Actions API: finds the
  publish workflow run matching the exact submodule commit SHA,
  downloads artifacts from that run. Falls back to snapshot-latest
  release if no run found.
- Both verify.yml and publish.yml now generate an app token
  (omoq-sync-bot) for cross-repo Actions API access to moxygen.
- Dockerfile: ubuntu:22.04 base with all runtime deps needed by
  the current dynamically-linked binary (stopgap until moxygen
  PR #58 lands static linking).
- Advance deps/moxygen submodule to df1d2f5 (includes sync #59).

Author: gmarzot

.github/workflows/publish.yml

@@ -27,16 +27,23 @@ jobs:
     runs-on: ${{ matrix.runner }}
 
     steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.OMOQ_APP_ID }}
+          private-key: ${{ secrets.OMOQ_APP_PRIV_KEY }}
+
       - uses: actions/checkout@v4
         with:
           submodules: true
 
       - name: Install system dependencies
         run: bash deps/moxygen/standalone/install-system-deps.sh
 
-      - name: Download moxygen release tarball
+      - name: Download moxygen artifacts
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: bash scripts/setup-deps-tarball.sh
 
       - name: Set up ccache

.github/workflows/ci.yml .github/workflows/verify.yml.github/workflows/ci.yml renamed to .github/workflows/verify.yml

@@ -31,16 +31,23 @@ jobs:
     name: ${{ matrix.name }}
     runs-on: ${{ matrix.runner }}
     steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.OMOQ_APP_ID }}
+          private-key: ${{ secrets.OMOQ_APP_PRIV_KEY }}
+
       - uses: actions/checkout@v4
         with:
           submodules: true
 
       - name: Install system dependencies
         run: bash deps/moxygen/standalone/install-system-deps.sh
 
-      - name: Download moxygen release tarball
+      - name: Download moxygen artifacts
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: bash scripts/setup-deps-tarball.sh
 
       - name: Configure

deps/moxygen

@@ -1,5 +1,16 @@
-FROM debian:bookworm-slim
-RUN apt-get update && apt-get install -y --no-install-recommends libssl3 && rm -rf /var/lib/apt/lists/*
+FROM ubuntu:22.04
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        libboost-context1.74.0 \
+        libdouble-conversion3 \
+        libevent-2.1-7 \
+        libfmt8 \
+        libgflags2.2 \
+        libgoogle-glog0v5 \
+        libsodium23 \
+        libssl3 \
+        libunwind8 \
+        libzstd1 \
+    && rm -rf /var/lib/apt/lists/*
 COPY install/bin/o_rly /usr/local/bin/o-rly
 COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh
 RUN chmod +x /usr/local/bin/entrypoint.sh

docker/Dockerfile

@@ -1,13 +1,15 @@
 #!/usr/bin/env bash
 # setup-deps-tarball.sh — Populate .scratch with prebuilt moxygen release artifacts.
 #
-# Downloads the snapshot-latest release tarball from openmoq/moxygen.
+# Uses the submodule commit SHA to find the exact publish workflow run
+# on openmoq/moxygen, then downloads the matching platform artifact.
 # Writes .scratch/cmake_prefix_path.txt for configure.sh.
 #
 # Usage:
 #   ./scripts/setup-deps-tarball.sh
 #
-# Requires: gh CLI authenticated, deps/moxygen submodule initialized.
+# Requires: gh CLI authenticated (with actions:read on openmoq/moxygen),
+#           deps/moxygen submodule initialized.
 
 set -euo pipefail
 
@@ -61,29 +63,40 @@ detect_platform() {
 PLATFORM=$(detect_platform)
 echo "==> Platform: $PLATFORM"
 
-# ── Download from snapshot-latest ─────────────────────────────────────────────
+# ── Find publish run matching submodule SHA ───────────────────────────────────
 
 SHA=$(git -C "$MOXYGEN_DIR" rev-parse HEAD)
-TAG="snapshot-latest"
 echo "==> Moxygen submodule SHA: ${SHA:0:7}"
-echo "==> Downloading from release: $TAG"
-
-if ! gh api "repos/openmoq/moxygen/releases/tags/$TAG" --jq '.tag_name' >/dev/null 2>&1; then
-    echo "Error: release $TAG not found in openmoq/moxygen." >&2
-    echo "  The publish workflow may not have run yet." >&2
-    exit 1
-fi
 
 TARBALL="moxygen-${PLATFORM}.tar.gz"
 DOWNLOAD_DIR="${SCRATCH}/downloads"
 mkdir -p "$DOWNLOAD_DIR"
 
-echo "==> Downloading $TARBALL..."
-rm -f "${DOWNLOAD_DIR}/${TARBALL}"
-gh release download "$TAG" \
-    --repo openmoq/moxygen \
-    --pattern "$TARBALL" \
-    --dir "$DOWNLOAD_DIR"
+echo "==> Searching for publish run at ${SHA:0:7}..."
+RUN_ID=$(gh api "repos/openmoq/moxygen/actions/workflows/omoq-publish-artifacts.yml/runs?head_sha=${SHA}&status=success&per_page=1" \
+    --jq '.workflow_runs[0].id // empty')
+
+if [[ -n "$RUN_ID" ]]; then
+    echo "==> Found publish run $RUN_ID, downloading $TARBALL..."
+    rm -f "${DOWNLOAD_DIR}/${TARBALL}"
+    gh run download "$RUN_ID" \
+        --repo openmoq/moxygen \
+        --name "$TARBALL" \
+        --dir "$DOWNLOAD_DIR"
+else
+    echo "==> No publish run for ${SHA:0:7}, trying snapshot-latest release..."
+    if ! gh api "repos/openmoq/moxygen/releases/tags/snapshot-latest" --jq '.tag_name' >/dev/null 2>&1; then
+        echo "Error: no artifacts found for SHA ${SHA:0:7} and no snapshot-latest release." >&2
+        echo "  The publish workflow may not have run yet for this commit." >&2
+        exit 1
+    fi
+    rm -f "${DOWNLOAD_DIR}/${TARBALL}"
+    gh release download "snapshot-latest" \
+        --repo openmoq/moxygen \
+        --pattern "$TARBALL" \
+        --dir "$DOWNLOAD_DIR"
+    echo "  Warning: using snapshot-latest (may not match submodule SHA)"
+fi
 
 # ── Extract ───────────────────────────────────────────────────────────────────