Require image smoke before release tags

Author: eldryoth

CHANGELOG.md

@@ -26,6 +26,10 @@ behavior when the change improves security or project direction.
 - Add a release-gate freshness check for compatible non-Pingora crate updates
   and strengthen release metadata validation for release notes, README,
   build/container docs, and RPM version alignment.
+- Copy workspace crates into all container build stages so release images build
+  correctly after the workspace split.
+- Make `scripts/stable_release_gate.sh release` require the root image smoke
+  plus representative Debian and Alpine variant image smokes before tagging.
 - Fix the OpenSSL FIPS support build-script hex literal grouping so Rust 1.96
   clippy accepts the vendored support crate under `-D warnings`.
 - Keep all feature profiles, binaries, release scripts, RPM/container behavior,

docs/release-checklist.md

@@ -170,9 +170,22 @@ scripts/validate-owasp-top10-2025.sh run
 ```
 
 The stable gate includes the promoted cache and observability smoke tests for
-the `1.2` line. Optional gates below still cover slower or environment-specific
-checks such as TLS backend matrices, load testing, fuzz target compilation, and
-Podman image smoke tests.
+the `1.2` line. In `release` mode it also requires a local container image
+smoke before tagging: the root `Containerfile` plus representative Debian and
+Alpine variant builds. This catches workspace, packaging, and image build
+context mistakes before an immutable tag is pushed.
+
+If a release builder cannot run Podman, do not skip this silently. Run the
+image gate on another builder and attach the evidence before tagging. The
+emergency-only bypass is:
+
+```bash
+FLUXHEIM_SKIP_IMAGE_GATE=1 scripts/stable_release_gate.sh release
+```
+
+Optional gates below still cover slower or environment-specific checks such as
+TLS backend matrices, load testing, fuzz target compilation, and full Podman
+variant image smoke tests.
 
 For release-candidate validation, run the deeper local gate. It enables the TLS
 backend matrix, OpenSSL FIPS-capable validation, rustls/AWS-LC FIPS-capable
@@ -202,7 +215,7 @@ FLUXHEIM_GATE_TLS_SCAN=1 scripts/stable_release_gate.sh release
 FLUXHEIM_GATE_LOAD=1 scripts/stable_release_gate.sh release
 FLUXHEIM_GATE_FRAMING=1 scripts/stable_release_gate.sh release
 FLUXHEIM_GATE_FUZZ_CHECK=1 scripts/stable_release_gate.sh release
-FLUXHEIM_GATE_PODMAN=1 FLUXHEIM_GATE_PODMAN_VARIANTS=1 scripts/stable_release_gate.sh release
+FLUXHEIM_GATE_IMAGE_VARIANTS="debian alpine wolfi suse-micro" scripts/stable_release_gate.sh release
 ```
 
 For release builders that are expected to have a working OpenSSL FIPS provider,

docs/release-runbook.md

@@ -36,6 +36,7 @@ scripts/reproducible_build_check.sh
 scripts/validate-release-metadata.sh
 scripts/validate-owasp-top10-2025.sh check
 scripts/podman_smoke.sh
+FLUXHEIM_CONTAINER_VARIANTS="debian alpine" scripts/podman_smoke_variants.sh
 ```
 
 For PHP-FPM releases, also run:
@@ -62,11 +63,18 @@ For stable or release-candidate builds, prefer the stable gate:
 scripts/stable_release_gate.sh release
 ```
 
-For the `1.3` line this stable gate includes the proxy cache and local
-observability smoke suites, plus compile and packaged-config checks for the
-published full/default, cache, and proxy container image profiles. That keeps
-cache, Prometheus/OpenTelemetry basics, and focused image feature wiring
-covered by the same command used for release evidence.
+In `release` mode this stable gate is intentionally tag-blocking for container
+images: it runs the root image smoke plus representative Debian and Alpine
+variant image smokes before a tag should be pushed. Use
+`FLUXHEIM_GATE_IMAGE_VARIANTS="debian alpine wolfi suse-micro"` when the release
+needs full local variant evidence. Use `FLUXHEIM_SKIP_IMAGE_GATE=1` only when
+equivalent image evidence has already been collected on another builder.
+
+For the `1.3` and later lines this stable gate includes the proxy cache and
+local observability smoke suites, plus compile and packaged-config checks for
+the published image profiles. That keeps cache, Prometheus/OpenTelemetry
+basics, and focused image feature wiring covered by the same command used for
+release evidence.
 
 If `cargo audit` reports a known upstream advisory that cannot be fixed in this
 repository yet, record it explicitly in the release notes with the package,

release-notes/RELEASE_NOTES_1.5.17.md

@@ -25,6 +25,10 @@ PHP-FPM, Wasm, and runtime extractions smaller and safer.
 - Added a release-gate crate freshness check for compatible non-Pingora updates
   and stricter release metadata checks for release notes, README,
   build/container docs, and RPM version alignment.
+- Copied workspace crates into all container build stages so release images
+  build correctly after the workspace split.
+- Made `scripts/stable_release_gate.sh release` require the root image smoke
+  plus representative Debian and Alpine variant image smokes before tagging.
 - Fixed the vendored OpenSSL FIPS support build script so Rust 1.96 clippy
   accepts the crate under release `-D warnings` checks.
 

scripts/stable_release_gate.sh

@@ -123,8 +123,15 @@ else
     echo "stable release gate: skipping fuzz target compile check; set FLUXHEIM_GATE_FUZZ_CHECK=1 to enable"
 fi
 
-if [ "${FLUXHEIM_GATE_PODMAN:-0}" = "1" ]; then
-    echo "stable release gate: Podman smoke"
+if [ "$mode" = "release" ] && [ "${FLUXHEIM_SKIP_IMAGE_GATE:-0}" != "1" ]; then
+    echo "stable release gate: required Podman image smoke"
+    scripts/podman_smoke.sh
+    FLUXHEIM_CONTAINER_VARIANTS="${FLUXHEIM_GATE_IMAGE_VARIANTS:-debian alpine}" \
+        scripts/podman_smoke_variants.sh
+elif [ "$mode" = "release" ]; then
+    echo "stable release gate: skipping required image smoke because FLUXHEIM_SKIP_IMAGE_GATE=1" >&2
+elif [ "${FLUXHEIM_GATE_PODMAN:-0}" = "1" ]; then
+    echo "stable release gate: optional Podman smoke"
     scripts/podman_smoke.sh
     if [ "${FLUXHEIM_GATE_PODMAN_VARIANTS:-0}" = "1" ]; then
         scripts/podman_smoke_variants.sh