docker-devkit 0.1.22__tar.gz → 0.1.23.dev36667933546__tar.gz

docker_devkit-0.1.23.dev36667933546/.github/workflows/ci-cd.yml

@@ -0,0 +1,98 @@
+name: CI/CD
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main, dev]
+  pull_request:
+    branches: [dev]
+
+# Cancel superseded runs on the same branch, except main — where publish-stable
+# must never die mid-release (overlapping release merges queue instead).
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+permissions:
+  contents: read
+
+env:
+  RELEASE_DEVKIT_VERSION: 0.1.25
+
+jobs:
+  check:
+    if: github.ref != 'refs/heads/main'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - run: uv run preflight-python
+      - shell: bash
+        run: uvx --from release-devkit==${{ env.RELEASE_DEVKIT_VERSION }} publish-stable --dry-run
+
+  ensure-release-pr:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/dev'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@v7
+      - shell: bash
+        run: uvx --from release-devkit==${{ env.RELEASE_DEVKIT_VERSION }} ensure-release-pr
+
+  publish-stable:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: write
+      id-token: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: main
+          fetch-depth: 0
+          fetch-tags: true
+      - uses: astral-sh/setup-uv@v7
+      - shell: bash
+        run: uvx --from release-devkit==${{ env.RELEASE_DEVKIT_VERSION }} publish-stable
+        env:
+          NPM_CONFIG_LOGLEVEL: verbose
+
+  publish-dev:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/dev'
+    needs: [check]
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@v7
+      - shell: bash
+        run: uvx --from release-devkit==${{ env.RELEASE_DEVKIT_VERSION }} publish-dev
+        env:
+          NPM_CONFIG_LOGLEVEL: verbose

{docker_devkit-0.1.22 → docker_devkit-0.1.23.dev36667933546}/AGENTS.md

@@ -10,11 +10,15 @@ Config surfaces org-wide follow one law (its home is release-devkit's `AGENTS.md
 
 ## Release flow
 
-Publishing rides `release.yml`, triggered by a successful CI run on a `main` push: the machinery — release-devkit's `publish-stable` (an inlined, version-pinned `uvx` step in the publish job, keeping OIDC identity local), never a project dependency (docker-devkit sits inside its own dependency graph; a project-level release-devkit edge is a resolver cycle) — computes the plan from the tag ledger and path-diff, patches the version ephemerally, and publishes to PyPI under OIDC trusted publishing (publisher bound to `release.yml`, no environment). The committed `pyproject.toml` version is permanently the `0.0.0.dev0` sentinel; the `docker-devkit-v*` tags are the version ledger (declared `major_minor` line in `release-devkit.yaml`, patch-auto within the line). While pre-1.0, breaking changes ride the normal patch flow without a bump; from 1.0 on, API-breaking changes ship with a manually bumped `major_minor` — patch-auto assumes additive changes.
+Publishing rides `ci-cd.yml` via inlined `uvx --from release-devkit==${{ env.RELEASE_DEVKIT_VERSION }}` steps, version-pinned in the workflow `env:` (see release-devkit's `AGENTS.md`), never a project dependency (docker-devkit sits inside its own dependency graph; a project-level release-devkit edge is a resolver cycle), under OIDC trusted publishing (publisher bound to `ci-cd.yml`, `release` environment). The committed `pyproject.toml` version is permanently the `0.0.0.dev0` sentinel; the `docker-devkit-v*` tags are the version ledger (declared `major_minor` line in `release-devkit.yaml`, patch-auto within the line). While pre-1.0, breaking changes ride the normal patch flow without a bump; from 1.0 on, API-breaking changes ship with a manually bumped `major_minor` — patch-auto assumes additive changes.
+
+## Mirror consumption
+
+Consumers with docker images (placeframe, capture-tool) run `mirror` via the docker-devkit PyPI dependency — inline in their `mirror` job (checkout + `setup-uv` + ghcr login + `uv run mirror`), version-sourced by the consumer's `uv.lock`. The job carries `permissions: { contents: read, packages: write }` + `env: GITHUB_TOKEN` (ghcr login for `crane copy`). Pure-Python devkits have no `mirror` job.
 
 ## Shape
 
-Entry points (`[project.scripts]`): `up` → `up.py:app`, `down` → `down.py:app`, `build` → `build_docker.py:app`, `mirror` → `mirror.py:app`, `generate-score` → `score_generate.py:app`. All accept `--help`.
+Entry points (`[project.scripts]`): `up` → `up.py:app`, `down` → `down.py:app`, `build` → `build_docker.py:app`, `mirror` → `mirror.py:app`, `generate-score` → `score_generate.py:app`, `docker-build-matrix` → `matrix.py:app`. All accept `--help`.
 
 | Module | Role |
 |---|---|
@@ -25,6 +29,7 @@ Entry points (`[project.scripts]`): `up` → `up.py:app`, `down` → `down.py:ap
 | `config.py` | `DockerDevkitConfig` — the root `docker-devkit.yaml` schema: a required `requires` PEP 440 specifier plus optional `lifecycle` / `mirror` / `generate-score` sections, `extra="forbid"` on every model. `load_config(root)` is the single strictyaml entry point: parses the file (returns `None` when absent — the no-config → single-file-default path for `up`/`down`), then self-checks the installed docker-devkit version against `requires` (refuses loudly outside range; the `0.0.0.dev0` dev sentinel bypasses the check, not the field). The section models (`LifecycleConfig`, `MirrorConfig`, `ScoreConfig`) live here; `load_lifecycle_config` / `load_mirror_config` / `load_score_config` in their modules are thin wrappers over it. |
 | `lifecycle.py` | `LifecycleConfig` (model in `config.py`) — the `lifecycle:` section declaration (`files`: compose files in layering order with `{gpu}` templating; `dev_file`: optional dev overlay); `load_lifecycle_config()` (reads the `lifecycle:` section via `config.load_config`, `None` when the section or file is absent), `resolve_manifest()` / `require_manifest()` (the raising form) / `resolve_lock()` (the image manifest and its lock are a named pair — `workloads/images.yml` + `workloads/images.lock`, with the legacy root `compose.bake.yml` + `.env.lock` pair still resolved so repos can upgrade before moving files), `enforce_bake_declaration()` (a manifest under either name requires a declaration), `expand_compose_files()` (assembles the `-f` list; a `{gpu}` entry is dropped when the GPU resolves to `none`; `dev_file` appended when a dev overlay applies). |
 | `detect_gpu.py` | `detect_gpu()` → `cuda`/`rocm`/`none` from host devices; the `Gpu` literal. |
+| `matrix.py` | `docker-build-matrix` — emit the CI build matrix as one `matrix=<JSON>` `$GITHUB_OUTPUT` line: one entry per variant (`common`/`cuda`/`rocm`, derived from the service-name suffix convention), `targets` = that variant's explicitly-buildable services with dependents grouped with the base their `additional_contexts: target:` references pull in (one leg builds a whole dependency-closure group in a single bake invocation — the safe default over hoping registry cache makes flat legs suffice). Tagless services never become explicit targets (bake rejects a tagless target under `--push`) — they ride as in-invocation dependencies; `x-cross-compile-targets` are excluded; a group spanning variants is a loud error. |
 | `modes.py` | `resolve_auth_mode()` — validates `PUBLIC_URL` + `AUTH_MODE` from `.env`, rejecting `keycloak` over cleartext `http://`. |
 | `context_sha.py` | `compute_service_shas(repo_root, bake: BakeDocument)` — per-service `tree-<hash>` image tags over the `.dockerignore`-allowlisted git tree. The workload-tree root is derived as the single top-level directory containing every tagged service's Dockerfile (a bake graph spanning several top-level directories is a loud error); files under it that belong to no tagged service are excluded from every SHA rather than shared into all of them. |
 | `documents.py` | `BakeDocument` + `parse_bake(path)` — the typed bake-file model every consumer of bake data goes through (build, up, down, generate-score, the reference collectors). A field validator enforces at parse time that every `x-base-images` value is `path:tag` or `path@digest` (a `${…}` hole or a bare path is a validation error, killing the silent-unpinned `FROM` → `:latest` failure mode). `digest_pinned(reference)` is the shared tail test. |

{docker_devkit-0.1.22 → docker_devkit-0.1.23.dev36667933546}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: docker-devkit
-Version: 0.1.22
+Version: 0.1.23.dev36667933546
 Summary: Docker-stack lifecycle commands (up/down/build) driven by a pyproject-declared compose assembly
 License-File: LICENSE
 License-File: NOTICE

{docker_devkit-0.1.22 → docker_devkit-0.1.23.dev36667933546}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "docker-devkit"
-version = "0.1.22"
+version = "0.1.23.dev36667933546"
 description = "Docker-stack lifecycle commands (up/down/build) driven by a pyproject-declared compose assembly"
 requires-python = ">=3.13"
 dependencies = [
@@ -19,6 +19,7 @@ dev = [
     "basedpyright>=1.39.10",
     "ruff>=0.14.11",
     "pytest>=8.0.0",
+    "python-devkit>=0.1.0",
     "types-pyyaml>=6.0.12.20260906",
     "types-strictyaml>=1.7.3.3",
 ]
@@ -33,6 +34,7 @@ down = "docker_devkit.down:app"
 build = "docker_devkit.build_docker:app"
 mirror = "docker_devkit.mirror:app"
 generate-score = "docker_devkit.score_generate:app"
+docker-build-matrix = "docker_devkit.matrix:app"
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/docker_devkit"]

{docker_devkit-0.1.22 → docker_devkit-0.1.23.dev36667933546}/release-devkit.yaml

@@ -1,5 +1,5 @@
 requires: ">=0.1"
-ci_workflow: ci.yml
+ci_workflow: ci-cd.yml
 packages:
   docker-devkit:
     path: .

docker_devkit-0.1.23.dev36667933546/src/docker_devkit/matrix.py

@@ -0,0 +1,96 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import typer
+
+from .detect_gpu import GPU_TYPES
+from .documents import BakeDocument, parse_bake
+from .lifecycle import require_manifest
+
+app = typer.Typer(add_completion=False, pretty_exceptions_show_locals=False)
+
+TARGET_CONTEXT_PREFIX = "target:"
+PLAIN_VARIANT = "common"
+
+
+@app.command()
+def matrix_main() -> None:
+    bake = parse_bake(require_manifest(Path.cwd()))
+    print(f"matrix={json.dumps({'include': compute_matrix_entries(bake)})}")
+
+
+# One entry per variant: targets are the dependency-closure groups of that variant's
+# explicitly-buildable services, coalesced into a single leg — the shape a single
+# gpu-resolved build invocation would produce, with dependents grouped with the base
+# their additional_contexts `target:` references pull in.
+def compute_matrix_entries(bake: BakeDocument) -> list[dict[str, str]]:
+    entries_by_variant: dict[str, list[str]] = {}
+    for group in dependency_groups(bake):
+        explicit = sorted(
+            service
+            for service in group
+            if bake.services[service].build.tags and service not in set(bake.cross_compile_targets)
+        )
+        if not explicit:
+            continue
+        variant = group_variant(bake, explicit)
+        entries_by_variant.setdefault(variant, []).extend(explicit)
+
+    return [
+        {"targets": " ".join(sorted(entries_by_variant[variant])), "variant": variant}
+        for variant in sorted(entries_by_variant)
+    ]
+
+
+def dependency_groups(bake: BakeDocument) -> list[list[str]]:
+    parent = {service: service for service in bake.services}
+
+    for name, service in bake.services.items():
+        for context in service.build.additional_contexts.values():
+            if not context.startswith(TARGET_CONTEXT_PREFIX):
+                continue
+            dependency = context.removeprefix(TARGET_CONTEXT_PREFIX)
+            if dependency not in bake.services:
+                raise RuntimeError(f"{name} references unknown build target {dependency!r} via additional_contexts")
+            union(parent, find(parent, name), find(parent, dependency))
+
+    members: dict[str, list[str]] = {}
+    for service in bake.services:
+        members.setdefault(find(parent, service), []).append(service)
+    return sorted(sorted(group) for group in members.values())
+
+
+# Tagless services never become explicit targets (bake rejects a tagless target under
+# --push) — they ride along as in-invocation dependencies of the group that needs them,
+# so the variant is decided by the tagged services alone.
+def group_variant(bake: BakeDocument, explicit: list[str]) -> str:
+    variants = {service_variant(service) for service in explicit}
+    if len(variants) > 1:
+        raise RuntimeError(
+            f"dependency group spans gpu variants ({', '.join(sorted(explicit))}) — "
+            "additional_contexts must stay within one device family"
+        )
+    return variants.pop()
+
+
+def service_variant(service: str) -> str:
+    for gpu in GPU_TYPES:
+        if service.endswith(f"-{gpu}"):
+            return gpu
+    return PLAIN_VARIANT
+
+
+def find(parent: dict[str, str], service: str) -> str:
+    root = service
+    while parent[root] != root:
+        root = parent[root]
+    while parent[service] != service:
+        parent[service], service = root, parent[service]
+    return root
+
+
+def union(parent: dict[str, str], left: str, right: str) -> None:
+    if left != right:
+        parent[right] = left

docker_devkit-0.1.23.dev36667933546/tests/test_matrix.py

@@ -0,0 +1,129 @@
+import json
+from pathlib import Path
+
+import pytest
+
+from docker_devkit.documents import BakeDocument
+from docker_devkit.matrix import compute_matrix_entries
+
+
+def service(dockerfile: str, *, tags: bool = True, contexts: dict[str, str] | None = None) -> dict[str, object]:
+    build: dict[str, object] = {"dockerfile": dockerfile}
+    if tags:
+        build["tags"] = [f"registry/{dockerfile}:latest"]
+    if contexts is not None:
+        build["additional_contexts"] = contexts
+    return {"build": build}
+
+
+TAGGED_BASES = BakeDocument.model_validate({
+    "services": {
+        "api": service("docker/api/Dockerfile"),
+        "postgres": service("docker/postgres/Dockerfile"),
+        "neural-networks-base-cuda": service("docker/neural-networks-base/Dockerfile"),
+        "reconstructor-cuda": service(
+            "docker/reconstructor/Dockerfile", contexts={"neural-networks-base": "target:neural-networks-base-cuda"}
+        ),
+        "localizer-cuda": service(
+            "docker/localizer/Dockerfile", contexts={"neural-networks-base": "target:neural-networks-base-cuda"}
+        ),
+    }
+})
+
+TAGLESS_BASES = BakeDocument.model_validate({
+    "services": {
+        "api": service("docker/api/Dockerfile"),
+        "neural-networks-base-cuda": service("docker/neural-networks-base/Dockerfile", tags=False),
+        "reconstructor-cuda": service(
+            "docker/reconstructor/Dockerfile", contexts={"neural-networks-base": "target:neural-networks-base-cuda"}
+        ),
+    },
+})
+
+
+def test_tagged_bases_group_with_their_dependents() -> None:
+    entries = compute_matrix_entries(TAGGED_BASES)
+
+    assert entries == [
+        {"targets": "api postgres", "variant": "common"},
+        {"targets": "localizer-cuda neural-networks-base-cuda reconstructor-cuda", "variant": "cuda"},
+    ]
+
+
+def test_tagless_bases_ride_as_dependencies_not_targets() -> None:
+    entries = compute_matrix_entries(TAGLESS_BASES)
+
+    assert entries == [
+        {"targets": "api", "variant": "common"},
+        {"targets": "reconstructor-cuda", "variant": "cuda"},
+    ]
+
+
+def test_single_service_repo_emits_matrix_of_one() -> None:
+    bake = BakeDocument.model_validate({"services": {"livekit-token": service("workloads/livekit-token/Dockerfile")}})
+
+    assert compute_matrix_entries(bake) == [{"targets": "livekit-token", "variant": "common"}]
+
+
+def test_cross_compile_targets_are_excluded() -> None:
+    bake = BakeDocument.model_validate({
+        "services": {
+            "api": service("docker/api/Dockerfile"),
+            "zed-capture": service("docker/zed-capture/Dockerfile"),
+        },
+        "x-cross-compile-targets": ["zed-capture"],
+    })
+
+    assert compute_matrix_entries(bake) == [{"targets": "api", "variant": "common"}]
+
+
+def test_non_target_additional_contexts_do_not_group() -> None:
+    bake = BakeDocument.model_validate({
+        "services": {
+            "api": service("docker/api/Dockerfile", contexts={"shared": "docker/shared"}),
+            "postgres": service("docker/postgres/Dockerfile"),
+        }
+    })
+
+    assert compute_matrix_entries(bake) == [{"targets": "api postgres", "variant": "common"}]
+
+
+def test_group_spanning_variants_fails_loudly() -> None:
+    bake = BakeDocument.model_validate({
+        "services": {
+            "api": service("docker/api/Dockerfile"),
+            "reconstructor-cuda": service("docker/reconstructor/Dockerfile", contexts={"api": "target:api"}),
+        }
+    })
+
+    with pytest.raises(RuntimeError, match="spans gpu variants"):
+        compute_matrix_entries(bake)
+
+
+def test_unknown_target_reference_fails_loudly() -> None:
+    bake = BakeDocument.model_validate({
+        "services": {
+            "api": service("docker/api/Dockerfile", contexts={"base": "target:missing-base"}),
+        }
+    })
+
+    with pytest.raises(RuntimeError, match="unknown build target"):
+        compute_matrix_entries(bake)
+
+
+def test_matrix_main_prints_github_output_line(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    (tmp_path / "workloads").mkdir()
+    (tmp_path / "workloads" / "images.yml").write_text(
+        "services:\n  livekit-token:\n    build:\n      dockerfile: workloads/livekit-token/Dockerfile\n"
+        "      tags:\n        - ghcr.io/example/livekit-token:latest\n"
+    )
+    monkeypatch.chdir(tmp_path)
+
+    from docker_devkit.matrix import matrix_main
+
+    matrix_main()
+
+    payload = json.loads(capsys.readouterr().out.splitlines()[0][len("matrix=") :])
+    assert payload == {"include": [{"targets": "livekit-token", "variant": "common"}]}

{docker_devkit-0.1.22 → docker_devkit-0.1.23.dev36667933546}/uv.lock

@@ -34,11 +34,25 @@ wheels = [
 
 [[package]]
 name = "bashrun"
-version = "0.1.0"
+version = "0.1.12"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/24/cd/dc3df91cbe2bfbe57b6d9bfe225f5808a22888d636cf30005d89133237c8/bashrun-0.1.0.tar.gz", hash = "sha256:e376f34693ba12ec907a6ab43626ed425c876c2b7be6569563a6492e11c79bc7", size = 18983, upload-time = "2026-09-21T01:47:56.971Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/19/2c/742acb113293e712d82c5cfce35a30f344385a7d9852d5844b0bcff4f12f/bashrun-0.1.12.tar.gz", hash = "sha256:d5fd926ec1cb1df6e218a98fe8ad737c24b72bcf740bdfbe2ecf4c77894878a0", size = 32364, upload-time = "2026-09-30T04:02:19.854Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/be/9a/749dd28f3defde3690e0280131f9461e4100c43c117f9363798f6dedbb91/bashrun-0.1.0-py3-none-any.whl", hash = "sha256:80f87924f88336460890d669aa1abb6fb8c389b675fdb41ac8d2b6861d4ebddb", size = 7634, upload-time = "2026-09-21T01:47:56.233Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/1d/4de203dbe4d711b39f7b440bd141b429864e2a3539faa9b6531eab456195/bashrun-0.1.12-py3-none-any.whl", hash = "sha256:9a188b90eb25249d24556dcdaccfa09ca3efe741406a1c71c7e3cecd170f41b0", size = 7511, upload-time = "2026-09-30T04:02:18.991Z" },
+]
+
+[[package]]
+name = "ci-devkit"
+version = "0.1.14"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "bashrun" },
+    { name = "pydantic" },
+    { name = "pydantic-settings" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/22/25/dc42c65e6147eb64477eae4f410b26d630f03f46c3d3bdcdab374df28081/ci_devkit-0.1.14.tar.gz", hash = "sha256:f8b45fa995bba626edda29c191883224173155a39137da5a1bc67f09ad28d337", size = 51204, upload-time = "2026-09-30T04:06:27.581Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/4f/08/56cafd065e2d00ad90d450867282d79469bc4c7c9eefa1dc11dcf84e0c96/ci_devkit-0.1.14-py3-none-any.whl", hash = "sha256:64b74d797a040d8d57735eda30dbb59844d0de9c64e53dd24e9769d10bc34e18", size = 25689, upload-time = "2026-09-30T04:06:26.522Z" },
 ]
 
 [[package]]
@@ -69,6 +83,7 @@ dependencies = [
 dev = [
     { name = "basedpyright" },
     { name = "pytest" },
+    { name = "python-devkit" },
     { name = "ruff" },
     { name = "types-pyyaml" },
     { name = "types-strictyaml" },
@@ -90,6 +105,7 @@ requires-dist = [
 dev = [
     { name = "basedpyright", specifier = ">=1.39.10" },
     { name = "pytest", specifier = ">=8.0.0" },
+    { name = "python-devkit", specifier = ">=0.1.0" },
     { name = "ruff", specifier = ">=0.14.11" },
     { name = "types-pyyaml", specifier = ">=6.0.12.20260906" },
     { name = "types-strictyaml", specifier = ">=1.7.3.3" },
@@ -290,6 +306,21 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/ec/57/56b9bcc3c9c6a792fcbaf139543cee77261f3651ca9da0c93f5c1221264b/python_dateutil-2.9.0.post0-py2.py3-none-any.whl", hash = "sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427", size = 229892, upload-time = "2024-03-01T18:36:18.57Z" },
 ]
 
+[[package]]
+name = "python-devkit"
+version = "0.1.15"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "bashrun" },
+    { name = "ci-devkit" },
+    { name = "pydantic" },
+    { name = "typer" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/82/53/c3b37f69c35475b09cdf1c18deb193238d7ab5143ee6bc97e5c22c48fe87/python_devkit-0.1.15.tar.gz", hash = "sha256:ac1ef0f2a4622e9c97763f4e353005c41164e2d6d4b130cdb709e811947f253d", size = 34651, upload-time = "2026-09-30T04:12:18.88Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b6/81/da4f76cbfccb5a4d5a58a9f51d3e2b7d40f6dc9edd931d7891b2789adeae/python_devkit-0.1.15-py3-none-any.whl", hash = "sha256:0c13684cc780e3ba9b3e25feed61065b355e8fc7436bee043e7c6adf71fa40e7", size = 14537, upload-time = "2026-09-30T04:12:17.918Z" },
+]
+
 [[package]]
 name = "python-dotenv"
 version = "1.2.2"

docker_devkit-0.1.22/.github/workflows/ci.yml

@@ -1,29 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-env:
-  PYTHON_DEVKIT_VERSION: "0.1.13"
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v5
-
-      - uses: astral-sh/setup-uv@v7
-        with:
-          enable-cache: true
-
-      - name: Preflight
-        run: uvx --from python-devkit==${PYTHON_DEVKIT_VERSION} preflight-python

docker_devkit-0.1.22/.github/workflows/release.yml

@@ -1,33 +0,0 @@
-name: Release
-
-on:
-  workflow_run:
-    workflows: [CI]
-    types: [completed]
-    branches: [main]
-
-concurrency:
-  group: release
-  cancel-in-progress: false
-
-jobs:
-  publish:
-    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      id-token: write
-    env:
-      RELEASE_DEVKIT_VERSION: "0.1.24"
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          ref: ${{ github.event.workflow_run.head_sha }}
-
-      # Workaround: fetch-tags is broken with shallow clones
-      - run: git fetch --tags origin
-
-      - uses: astral-sh/setup-uv@v7
-
-      - name: Publish
-        run: uvx --from release-devkit==${RELEASE_DEVKIT_VERSION} publish-stable --config release-devkit.yaml

docker_devkit-0.1.22/plan.md

@@ -1,145 +0,0 @@
-# One home for third-party image declarations; docker-devkit stops parsing compose
-
-Status note for pickup: COMPLETE. Shipped: docker-devkit 0.1.15, release-devkit
-0.1.11 (both on PyPI). placeframe `dev`: `f2c94d16` (declarations conversion +
-generate-score port completion), `33ddfb26` (score artifacts), `e0bcd9f8`
-(prose) — preflight green. capture-tool `dev`: `ef7660d` (renames + repin),
-`6025c5e` (prose) — lock round-trip stable, rig render green. All four repos
-need operator pushes. Resolved during execution: the fluent-bit declaration key
-is `SEAWEEDFS_AUDIT_IMAGE` (the plan's `FLUENT_BIT_IMAGE` never matched the
-actual compose hole — holes stayed textually unchanged); stale `DOTNET_*`
-declarations and `PYTHON_BASE`/`ZED_BASE` lock entries were pruned in placeframe
-(zero consumers); `INITIALIZE_S3_IMAGE` (consumed by scripts/sweep_postprocess)
-was promoted to a declaration; the generate-score console-script collision was
-resolved by completing the port (config table in placeframe pyproject,
-duplicate module deleted); capture-tool's bake file is `compose.bake.yml`, not
-the `compose.zed.bake.yml` this plan named. NEXT: make-it-sing's own plan.md
-resumes — flip its committed Stage 3 checkpoint (`6b4120c`) from
-`ARG UV_BASE_DIGEST` + `FROM mirror/…${UV_BASE_DIGEST}` to
-`ARG UV_BASE_IMAGE` + `FROM ${UV_BASE_IMAGE}`, repin docker-devkit >=0.1.15.
-
-## Why this initiative exists
-
-docker-devkit parses consumer compose files for exactly one purpose: discovering
-`x-image-ref` labels (declarations of externally-pulled images) so `run_build`
-can digest-lock them and `mirror-images` can mirror them. That single need dragged
-in a pile of wrong-shaped machinery:
-
-- Compose's YAML dialect tags (`!reset`) require PyYAML constructor registration,
-  and PyYAML's constructor API is untyped — a type-checker fight with no clean
-  resolution (the only surviving form was a suppression-boundary debate).
-- The include-following logic in `run_build` serves zero org repos (the only
-  compose include anywhere is make-it-sing's `oci://` one, which contributes
-  nothing and was skipped anyway).
-- Two declaration mechanisms exist for one need: `x-image-ref` labels in compose
-  (placeframe: fluent-bit, cloudbeaver, keycloak, ngrok) and `x-base-images` in
-  the bake file (placeframe: loki, alloy, grafana, and every Dockerfile base).
-- The `_DIGEST` suffix lock shape (`image: path${X_DIGEST:?err}` in compose,
-  lock `X_DIGEST=@sha256:…`) authors the mirror path TWICE — bake declaration +
-  compose image line — a drift exposure (path drift fails loud at pull; tags
-  cannot drift, but the duplication is authored).
-- The Dockerfile suffix form (`FROM path${X_DIGEST}`) has a silent-unpinned
-  failure mode: an empty arg yields a tagless `FROM path`, and Docker silently
-  pulls `:latest`.
-
-## The design
-
-- **Single declaration home**: bake `x-base-images`. Keys use the `_IMAGE`
-  convention (`UV_BASE_IMAGE`, `KEYCLOAK_IMAGE`, …). One authored string
-  (`path:tag`) per third-party image, anywhere in the org.
-- **run_build single-emits** one lock entry per declaration:
-  `NAME=path:tag@sha256:…`. No dual shapes, no suffix entries.
-- **Compose image lines** are pure holes: `image: "${KEYCLOAK_IMAGE:?err}"`.
-- **Dockerfiles** use `ARG NAME` + `FROM ${NAME}`. An empty arg is a hard parse
-  error — this fixes the silent-`:latest` foot-gun.
-- **BakeDocument gains a field validator**: every `base_images` value must be
-  `path:tag` or `path@digest`. The declarations half of `unpinned_references`
-  moves to parse time (enforced on every command run, not a CI-only scan).
-- **`collect_repo_references` splits**: `declared_references(root)` (bake
-  declarations only — what mirror-images consumes) and a stray-ref scan
-  (Dockerfile `FROM`/`COPY --from` literals + score yaml `image:` lines — what
-  `unpinned_references` polices; it survives with that narrow job of catching
-  hand-written literal refs that bypass the declaration system).
-- **`version_coupling_violations` is unchanged** — it guards a genuinely
-  non-derivable agreement (pyproject `tool.uv.required-version` ↔ image tag; the
-  tag carries suffixes like `-python3.13-trixie-slim` that pyproject doesn't
-  hold). Two authored truths that must agree is a different problem from one
-  truth scattered; the check is correct, keep it.
-
-## Changes
-
-### docker-devkit (this repo) — release 0.1.15
-
-- `image_refs.py`: delete `compose_image_refs`, `ComposeDialectLoader`, both
-  `add_constructor` registrations, and the compose branch of
-  `collect_repo_references`; implement the `declared_references` / stray-scan
-  split. `bake_base_image_refs` and `version_coupling_violations` stay.
-- `documents.py`: add the `base_images` field validator.
-- `build_docker.py`: delete the third-party `x-image-ref` resolution block;
-  single-emit lock entries from `x-base-images`; wire all bake consumption
-  through `parse_bake`/`BakeDocument` (typed access replaces dict plumbing —
-  including `compute_service_shas(repo_root, bake: BakeDocument)` and
-  `compute_default_targets(bake: BakeDocument, …)` signatures, with `up.py`,
-  `down.py`, `score_generate.py` parsing at their call sites); loud guard:
-  `--mode ci` requires `x-registry-cache`.
-- Tests: delete the compose-dialect tests; add validator + split-function tests;
-  existing fixtures via `BakeDocument.model_validate`.
-- `types-pyyaml` stays as a dev dependency (it types `parse_bake`'s PyYAML
-  surface; with the dialect code gone, zero suppressions are needed anywhere).
-- AGENTS.md: update the `image_refs.py` row and any compose-parsing references
-  (separate prose commit from the code).
-- Release via the normal tag-ledger flow; operator push (App token cannot push).
-
-### release-devkit — next patch (0.1.11)
-
-- `mirror_images.py`: switch from
-  `collect_repo_references(Path.cwd(), dockerfile_glob=None)` to
-  `declared_references(root)` — same refs, declarations-only source.
-
-### placeframe — one PR
-
-- `compose.bake.yml`: add declarations for the 4 `x-image-ref` services
-  (`CLOUDBEAVER_IMAGE`, `KEYCLOAK_IMAGE`, `FLUENT_BIT_IMAGE`, `NGROK_IMAGE`,
-  values = today's label strings); rename every existing `_DIGEST` declaration
-  key to the `_IMAGE` convention; `x-base-args` keys follow the renames.
-- `compose.yml`: delete the 4 labels (their image lines are textually unchanged —
-  they were already `${X_IMAGE:?err}` holes); flip loki×2 / alloy / grafana from
-  `path${X_DIGEST:?err}` to `${X_IMAGE:?err}`; inventory every `${…_IMAGE}` hole
-  (at minimum `SEAWEEDFS_AUDIT_IMAGE`) and ensure a declaration exists for each.
-- Dockerfiles: convert every base `FROM` to `ARG NAME` + `FROM ${NAME}`.
-- Version-coupling site registry (consumer preflight): rename `base_image` site
-  names to the new declaration keys — locate the registry during execution.
-- Regenerate `.env.lock` (`uv run build --lock-only`); preflight green; repin
-  docker-devkit `>=0.1.15`.
-- AGENTS.md mentions of `x-image-ref` updated (separate prose commit).
-
-### capture-tool
-
-- 3 Dockerfiles + `compose.zed.bake.yml` `x-base-args` key renames; regen
-  `.env.lock`; repin docker-devkit.
-
-### make-it-sing — NOT this initiative
-
-Its own `plan.md` resumes AFTER this one lands (its Stage 3/5 consume the new
-pattern). Its committed Stage 3 checkpoint (`6b4120c`) still carries the suffix
-form (`ARG UV_BASE_DIGEST` + `FROM mirror/…${UV_BASE_DIGEST}`) — flip to
-`ARG UV_BASE_IMAGE` + `FROM ${UV_BASE_IMAGE}` when resuming that plan.
-
-## Ordering
-
-docker-devkit 0.1.15 → release-devkit 0.1.11 → placeframe PR → capture-tool.
-All releases are operator pushes; the sandbox App token has Contents:read only.
-
-## Verification
-
-- docker-devkit: pytest + ruff + basedpyright all green (the checkpoint's known
-  failures must be gone — their absence is the proof the deletion was complete).
-- placeframe / capture-tool: `uv run build --lock-only` round-trip, preflight
-  battery, `docker compose config` render.
-
-## Deliberately out of scope
-
-- Score yaml scanning changes.
-- Renaming the `x-base-images` key itself (it now covers runtime images too —
-  placeframe's loki already made that de facto; note it in a bake-file comment).
-- make-it-sing CI stages (owned by its own plan).