@platforma-sdk/block-tools 2.12.6 → 2.12.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@platforma-sdk/block-tools",
-  "version": "2.12.6",
+  "version": "2.12.8",
   "description": "Utility to manipulate Platforma Blocks and Block Registry",
   "license": "UNLICENSED",
   "bin": {
@@ -34,14 +34,14 @@
     "undici": "~7.16.0",
     "yaml": "^2.8.0",
     "zod": "~3.25.76",
+    "@milaboratories/pl-model-common": "1.47.2",
+    "@milaboratories/pl-model-middle-layer": "1.30.14",
+    "@milaboratories/ts-helpers": "1.8.6",
+    "@platforma-sdk/blocks-deps-updater": "2.2.0",
     "@milaboratories/pl-http": "1.2.4",
-    "@milaboratories/pl-model-backend": "1.4.16",
-    "@milaboratories/pl-model-common": "1.47.1",
-    "@milaboratories/pl-model-middle-layer": "1.30.13",
+    "@platforma-sdk/package-builder-lib": "1.2.1",
     "@milaboratories/resolve-helper": "1.1.3",
-    "@platforma-sdk/blocks-deps-updater": "2.2.0",
-    "@milaboratories/ts-helpers": "1.8.5",
-    "@platforma-sdk/package-builder-lib": "1.2.0"
+    "@milaboratories/pl-model-backend": "1.4.17"
   },
   "devDependencies": {
     "@rollup/plugin-node-resolve": "^16.0.1",
@@ -56,9 +56,9 @@
     "vite": "^8.0.6",
     "vite-plugin-dts": "^4.5.3",
     "vitest": "^4.1.3",
-    "@milaboratories/build-configs": "2.0.0",
-    "@milaboratories/ts-builder": "1.6.0",
-    "@milaboratories/ts-configs": "1.3.0"
+    "@milaboratories/ts-builder": "1.6.1",
+    "@milaboratories/ts-configs": "1.3.1",
+    "@milaboratories/build-configs": "2.0.0"
   },
   "scripts": {
     "build": "vite build",

package/src/cmd/software/run-build.test.ts

@@ -127,14 +127,14 @@ describe("runBuild orchestration", () => {
     ]);
   });
 
-  it("dev docker build targets the built-in dev registry; release does not", async () => {
+  it("dev docker build targets the built-in dev registry; release the production registry", async () => {
     const dev = await run({ channel: "dev", variant: "docker", location: "remote" });
     expect(dev.spies.buildDockerImages).toHaveBeenCalledWith(
       expect.objectContaining({ registry: defaults.DEV_DOCKER_REGISTRY }),
     );
     const rel = await run({ channel: "release", variant: "docker", location: "remote" });
     expect(rel.spies.buildDockerImages).toHaveBeenCalledWith(
-      expect.objectContaining({ registry: undefined }),
+      expect.objectContaining({ registry: defaults.DOCKER_REGISTRY }),
     );
   });
 
@@ -166,11 +166,26 @@ describe("runBuild orchestration", () => {
       });
     });
 
-    it("release override targets the configured release registry, no built-in default", async () => {
-      expect(await dockerAddresses(releaseRemote)).toEqual({ pull: undefined, push: undefined });
+    it("release pull defaults to the built-in registry, independent of the push target", async () => {
+      // No push override: nothing pushed, pull embeds the built-in production registry.
+      expect(await dockerAddresses(releaseRemote)).toEqual({
+        pull: defaults.DOCKER_REGISTRY,
+        push: undefined,
+      });
+      // Push to quay, but the descriptor still embeds containers.pl-open.science (GA-fronted proxy).
+      // quay is not reachable from corporate deployments, so pull must NOT inherit the push target.
+      process.env.PL_RELEASE_DOCKER_PUSH_URL = "quay.io/org/repo";
+      expect(await dockerAddresses(releaseRemote)).toEqual({
+        pull: defaults.DOCKER_REGISTRY,
+        push: "quay.io/org/repo",
+      });
+    });
+
+    it("PL_RELEASE_DOCKER_PULL_URL overrides the built-in release pull default", async () => {
       process.env.PL_RELEASE_DOCKER_PUSH_URL = "quay.io/org/repo";
+      process.env.PL_RELEASE_DOCKER_PULL_URL = "cdn.example/release";
       expect(await dockerAddresses(releaseRemote)).toEqual({
-        pull: "quay.io/org/repo",
+        pull: "cdn.example/release",
         push: "quay.io/org/repo",
       });
     });

package/src/cmd/software/run-build.ts

@@ -134,7 +134,10 @@ function parsePushTarget(raw: string): { registry: string; autoLogin: boolean }
 }
 
 // Docker push target + the pull address embedded in the descriptor. Precedence flag > channel env >
-// dev default (release has none); pull defaults to push; autoLogin follows the push target's ecr://.
+// dev default (release has none). Pull default is channel-specific: dev pulls from where it pushed
+// (one ECR host), but release push (quay) and pull (containers.pl-open.science, GA-fronted proxy) are
+// different locations by design, so release pull defaults to the built-in registry, NOT the push
+// target. autoLogin follows the push target's ecr://.
 function resolveDockerAddresses(
   channel: Channel,
   opts: BuildOptions,
@@ -149,7 +152,8 @@ function resolveDockerAddresses(
     opts.dockerPushTo ?? channelPush ?? (isDev ? defaults.DEV_DOCKER_PUSH_TARGET : undefined);
   const parsed = rawPush ? parsePushTarget(rawPush) : { registry: undefined, autoLogin: false };
 
-  const rawPull = opts.dockerRegistry ?? channelPull ?? rawPush;
+  const rawPull =
+    opts.dockerRegistry ?? channelPull ?? (isDev ? rawPush : defaults.DOCKER_REGISTRY);
   const pull = rawPull ? stripScheme(rawPull) : undefined;
 
   return { pull, push: parsed.registry, autoLogin: parsed.autoLogin };