coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

INFD-WP-0010-T02: owner-CI workflow for the full service image
All checks were successful
Build and Publish Service Image / build-and-push (push) Successful in 2m38s
Details

Browse source 
.forgejo/workflows/service-image.yaml builds Containerfile from the pushed
commit's tarball and pushes forgejo.coulomb.social/coulomb/informed-decision
:main-<short sha>, then reports the immutable digest. Before pushing it
checks the zlib floor, the runtime smoke (tools/zlib_overlay/check_runtime.py)
and that the installed modules equal the commit's source.

Containerfile builds the wheel in-image (hash-pinned setuptools in
requirements-build.lock) and installs the zlib overlay's hash-pinned,
Alpine-signed zlib-1.3.2-r1 package offline, failing below 1.3.2-r1, so the
live image's zlib fix cannot regress. Overlay workflows are unchanged.
Local build: 13/13 container checks, zlib 1.3.2-r1, source manifest match.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
This commit is contained in:
tegwick 2026-11-01 11:32:32 +01:00
parent 0ef57537ac
commit c228583b60
9 changed files with 211 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md
View file

@ -26,6 +26,14 @@ its own workflow, and it must keep zlib at `1.3.2-r1` or later. A plain rebuild
pinned `python:3.12-alpine@sha256:b64631e0…` base and only adds `libuuid`. That would reintroduce the zlib
finding that the live image `f5588f49…` remediated. Then pin the image as in step 0.
**Update, same day:** the full-image workflow now exists in source: `.forgejo/workflows/service-image.yaml`. It
builds `Containerfile` from the pushed commit's tarball, with the wheel built in-image. It installs the overlay's
hash-pinned zlib-1.3.2-r1 package offline and enforces `zlib>=1.3.2-r1`. It checks the runtime smoke and that the
installed source matches the commit before pushing `forgejo.coulomb.social/coulomb/informed-decision:main-<short sha>`,
then prints the digest in "Report immutable digest". A local build of the same Containerfile passed 13/13 container
checks (`tools/smoke_container.py --workload`), with zlib 1.3.2-r1 and the installed modules identical to source.
The gate is now: the push runs this workflow, then step 0 pins the digest it reports.
**Do not sync this candidate with the current image.** The live image `f5588f49…` accepts only the four basic
registry keys: `set(row) != {submitter_id, memo_classes, review_groups, daily_limit}`. It would reject the
executor row, so every intake request would fail with 503 `intake_configuration_unavailable`, State Hub's
@ -59,7 +67,7 @@ Candidate source changes in this commit:
```bash
cd ~/informed-decision
docker buildx imagetools inspect forgejo.coulomb.social/coulomb/informed-decision:<CI_TAG> # read the digest
docker buildx imagetools inspect forgejo.coulomb.social/coulomb/informed-decision:main-<short sha> # or the CI "Report immutable digest" line
# set "image" in deploy/lifecycle/admission.candidate.json to forgejo.coulomb.social/coulomb/informed-decision@<IMAGE_DIGEST>
python3 tools/render_deployment.py --input deploy/lifecycle/admission.candidate.json \
--output deploy/lifecycle/service.candidate.json