docker-devkit 0.2.0.dev37277620738__tar.gz → 0.2.1.dev109__tar.gz

{docker_devkit-0.2.0.dev37277620738 → docker_devkit-0.2.1.dev109}/.github/actions/setup-release-devkit/action.yml

@@ -5,7 +5,7 @@ runs:
   steps:
     - shell: bash
       env:
-        RELEASE_DEVKIT_COMMIT: 1130b982aeb956a42b7bf9000ad231eaade593bf
+        RELEASE_DEVKIT_COMMIT: 84afa7a39ba21ab8971014dbefe130e3b9df8ded
       run: |
         git clone https://github.com/outernet-foundation/release-devkit.git "$RUNNER_TEMP/release-devkit"
         git -C "$RUNNER_TEMP/release-devkit" checkout "$RELEASE_DEVKIT_COMMIT"

{docker_devkit-0.2.0.dev37277620738 → docker_devkit-0.2.1.dev109}/.github/workflows/integrate.yml

@@ -54,3 +54,24 @@ jobs:
       - *uv-restore
       - *setup-release-devkit
       - run: uv run --project "$RUNNER_TEMP/release-devkit" --locked --no-dev validate-release-plan
+
+  update-pr-draft-release:
+    if: github.event.pull_request
+    needs: [validate-release-plan]
+    permissions:
+      contents: write
+      packages: read
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          # Perform a full clone, required for tags
+          fetch-depth: 0
+          fetch-tags: true
+          persist-credentials: false
+      - *uv-restore
+      - *setup-release-devkit
+      - run: uv run --project "$RUNNER_TEMP/release-devkit" --locked --no-dev release --channel pr
+        env:
+          GITHUB_TOKEN: ${{ github.token }}

{docker_devkit-0.2.0.dev37277620738 → docker_devkit-0.2.1.dev109}/.github/workflows/merge-gate.yml

@@ -22,7 +22,7 @@ jobs:
       - uses: actions/checkout@v5
         with:
           ref: ${{ github.event.pull_request.head.sha || github.event.workflow_run.head_sha }}
-          # Perform a full clone, required so merge-gate can validate that this PR is a fast forward from dev
+          # Perform a full clone, required so merge-gate can validate that this PR is a semi-linear merge into dev
           fetch-depth: 0
           persist-credentials: false
       - uses: astral-sh/setup-uv@v7
@@ -35,7 +35,6 @@ jobs:
         with:
           app-id: ${{ vars.MERGE_BOT_APP_ID }}
           private-key: ${{ secrets.MERGE_BOT_APP_PRIVATE_KEY }}
-      - run: uv run --project "$RUNNER_TEMP/release-devkit" --locked --no-dev merge-gate
+      - run: uv run --project "$RUNNER_TEMP/release-devkit" --locked --no-dev merge-gate --head-sha ${{ github.event.pull_request.head.sha || github.event.workflow_run.head_sha }}
         env:
           GITHUB_TOKEN: ${{ steps.mint.outputs.token }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.workflow_run.head_sha }}

{docker_devkit-0.2.0.dev37277620738 → docker_devkit-0.2.1.dev109}/.github/workflows/release.yml

@@ -11,12 +11,13 @@ permissions:
   contents: read
 
 jobs:
-  publish-prerelease:
+  prerelease:
     if: github.ref == 'refs/heads/dev'
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write
       id-token: write
+      packages: read
     steps:
       - uses: actions/checkout@v5
         with:
@@ -31,7 +32,9 @@ jobs:
           save-cache: "false"
       - &setup-release-devkit
         uses: ./.github/actions/setup-release-devkit
-      - run: uv run --project "$RUNNER_TEMP/release-devkit" --locked --no-dev publish-prerelease
+      - run: uv run --project "$RUNNER_TEMP/release-devkit" --locked --no-dev release --channel dev
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
 
   release:
     if: github.ref == 'refs/heads/main'
@@ -49,6 +52,6 @@ jobs:
           persist-credentials: true
       - *uv-restore
       - *setup-release-devkit
-      - run: uv run --project "$RUNNER_TEMP/release-devkit" --locked --no-dev release
+      - run: uv run --project "$RUNNER_TEMP/release-devkit" --locked --no-dev release --channel stable
         env:
           GITHUB_TOKEN: ${{ github.token }}

{docker_devkit-0.2.0.dev37277620738 → docker_devkit-0.2.1.dev109}/AGENTS.md

@@ -65,7 +65,7 @@ The mirror is declared, not inferred: the `mirror:` section with `prefix` in the
 - The `mirror` verb (crane install from a pinned release, per-target `crane copy`, count footer) uses bashrun + plain prints, deliberately not ci-devkit's `ci_step` — it needs nothing from the floor.
 - Non-mirror lock entries (e.g. `placeframe/*` publishes) are not probed and keep failing naturally at pull. There is no config-level ban on the flag: an air-gap fails closed anyway (no route to upstream — the pull dies with or without it).
 
-The ci-devkit edge exists for the builds shelf: a CI `build` run pushes the resolved `workloads/images.lock` to the repo's builds registry (`--builds-registry` + `--lock-project` + `--run-number`) through ci-devkit's `push_build` — one `images-lock`-platform artifact tagged `run-{N}` per run, the exact lock the run baked with, consumed by release-devkit's release stapler. ORAS CLI knowledge lives only in ci-devkit (org law); local builds (`--mode local`, no `--builds-registry`) never touch it.
+The ci-devkit edge exists for the builds shelf: a CI `build` run distills bake's `--metadata-file` into a digest manifest (`target → {ref, digest, tags[]}` JSON) and pushes it to the repo's builds shelf at the conventional `images-digests/all` project/platform through ci-devkit's `push_build` — one `images-digests-all` artifact tagged `sha-{full}` per CI head SHA, consumed by release-devkit's release surfaces for the built-image digest table. The shelf address and the SHA are derived in ci mode, never flagged: the address is `ghcr.io/{GITHUB_REPOSITORY}/builds` (the same ambient-derived constant release-devkit pulls from — a flag would carry no information and only add a typo surface), and the SHA is the checkout HEAD (`git rev-parse HEAD`), stamping the certified PR head the release channels query back at; the keying law is stated in release-devkit's `AGENTS.md`. `workloads/images.lock` stays in source control (the stapler that consumed the shelf copy is gone). ORAS CLI knowledge lives only in ci-devkit (org law); local builds (`--mode local`) never touch the shelf.
 
 Lifecycle stays a separate package from codegen (client generation, datamodel generation, workspace locking) because their dependency surfaces are disjoint — bundling them would force a consumer that only brings a stack up to install `sqlacodegen`, `psycopg`, `datamodel-code-generator`.
 

{docker_devkit-0.2.0.dev37277620738 → docker_devkit-0.2.1.dev109}/PKG-INFO

@@ -1,12 +1,12 @@
 Metadata-Version: 2.5
 Name: docker-devkit
-Version: 0.2.0.dev37277620738
+Version: 0.2.1.dev109
 Summary: Docker-stack lifecycle commands (up/down/build) driven by a pyproject-declared compose assembly
 License-File: LICENSE
 License-File: NOTICE
 Requires-Python: >=3.13
 Requires-Dist: bashrun>=0.1.0
-Requires-Dist: ci-devkit==0.1.15.dev36756330648
+Requires-Dist: ci-devkit>=0.1.15
 Requires-Dist: packaging>=24.1
 Requires-Dist: pathspec>=1.0.4
 Requires-Dist: pydantic-settings>=2.9.1

{docker_devkit-0.2.0.dev37277620738 → docker_devkit-0.2.1.dev109}/pyproject.toml

@@ -1,11 +1,11 @@
 [project]
 name = "docker-devkit"
-version = "0.2.0.dev37277620738"
+version = "0.2.1.dev109"
 description = "Docker-stack lifecycle commands (up/down/build) driven by a pyproject-declared compose assembly"
 requires-python = ">=3.13"
 dependencies = [
     "bashrun>=0.1.0",
-    "ci-devkit==0.1.15.dev36756330648",
+    "ci-devkit>=0.1.15",
     "packaging>=24.1",
     "pathspec>=1.0.4",
     "pydantic>=2.11.7",

docker_devkit-0.2.1.dev109/release-devkit.yaml

@@ -0,0 +1,6 @@
+packages:
+  docker-devkit:
+    path: .
+    major_minor: "0.2"
+    registry: pypi
+    identity: docker-devkit

{docker_devkit-0.2.0.dev37277620738 → docker_devkit-0.2.1.dev109}/src/docker_devkit/build_docker.py

@@ -6,11 +6,13 @@ import platform
 import re
 from pathlib import Path
 from subprocess import CalledProcessError
-from typing import Annotated, Any, Literal
+from tempfile import TemporaryDirectory
+from typing import Annotated, Any, Literal, TypedDict
 
 import typer
 from bashrun.bash import bash, bash_output
 from ci_devkit.builds import push_build
+from ci_devkit.setup_oras import install_oras
 from .detect_gpu import GPU_TYPES, Gpu, detect_gpu
 from .documents import BakeDocument, digest_pinned, parse_bake
 from pydantic_settings import BaseSettings
@@ -32,7 +34,16 @@ METADATA_PATH = Path("metadata.json")
 
 Mode = Literal["local", "ci"]
 
-IMAGES_LOCK_PLATFORM = "images-lock"
+DIGEST_PROJECT = "images-digests"
+DIGEST_PLATFORM = "all"
+DIGEST_FILE_NAME = "images-digests.json"
+
+
+class DigestEntry(TypedDict):
+    ref: str
+    digest: str
+    tags: list[str]
+
 
 app = typer.Typer(add_completion=False, pretty_exceptions_show_locals=False)
 
@@ -53,17 +64,6 @@ def build(
         list[str] | None,
         typer.Option("--targets", "-t", help="Build only these services (from the image manifest)."),
     ] = None,
-    builds_registry: Annotated[
-        str | None,
-        typer.Option("--builds-registry", help="OCI registry path to push the resolved lock to (CI build artifacts)."),
-    ] = None,
-    lock_project: Annotated[
-        str | None,
-        typer.Option("--lock-project", help="Project component of the lock's builds-shelf address (CI only)."),
-    ] = None,
-    run_number: Annotated[
-        int, typer.Option("--run-number", help="CI run number baked into the lock's builds-shelf tag.")
-    ] = 0,
 ) -> None:
     run_build(
         upgrade=upgrade,
@@ -73,9 +73,6 @@ def build(
         gpu_only=gpu_only,
         no_cache=no_cache,
         targets_opt=targets_opt,
-        builds_registry=builds_registry,
-        lock_project=lock_project,
-        run_number=run_number,
     )
 
 
@@ -89,9 +86,6 @@ def run_build(
     no_cache: bool = False,
     targets_opt: list[str] | None = None,
     env_overlay: dict[str, str] | None = None,
-    builds_registry: str | None = None,
-    lock_project: str | None = None,
-    run_number: int = 0,
 ) -> None:
     root = Path.cwd()
     manifest = require_manifest(root)
@@ -223,22 +217,56 @@ def run_build(
     if not set(targets) <= baked_images.keys():
         raise RuntimeError("Bake output does not cover the requested targets")
 
-    push_images_lock(builds_registry, lock_project, run_number, lock_file)
-
-
-def push_images_lock(builds_registry: str | None, lock_project: str | None, run_number: int, lock_file: Path) -> None:
-    if builds_registry is None:
-        return
-    if not lock_project or run_number <= 0:
-        raise typer.BadParameter("--builds-registry requires --lock-project and a positive --run-number")
-    push_build(
-        builds_registry,
-        lock_project,
-        IMAGES_LOCK_PLATFORM,
-        f"run-{run_number}",
-        lock_file.parent,
-        [lock_file.name],
-    )
+    # Push the digest manifest to the repo's builds shelf (address and SHA derived, never flagged)
+    if mode == "ci":
+        github_repository = os.environ.get("GITHUB_REPOSITORY", "")
+        if not github_repository:
+            raise SystemExit("GITHUB_REPOSITORY not set — ci mode reads the GitHub runner environment")
+        shelf = f"ghcr.io/{github_repository}/builds"
+        sha = bash_output("git rev-parse HEAD").strip()
+        push_image_digests(shelf, sha, baked_images, targets)
+
+
+def push_image_digests(
+    shelf: str,
+    sha: str,
+    baked_images: dict[str, Any],
+    targets: list[str],
+) -> None:
+    install_oras()
+    manifest = distill_digest_manifest(baked_images, targets)
+    with TemporaryDirectory(prefix="digest-manifest-") as staging:
+        manifest_path = Path(staging) / DIGEST_FILE_NAME
+        manifest_path.write_text(json.dumps(manifest, indent=2), encoding="utf-8")
+        push_build(
+            shelf,
+            DIGEST_PROJECT,
+            DIGEST_PLATFORM,
+            f"sha-{sha}",
+            Path(staging),
+            [DIGEST_FILE_NAME],
+        )
+
+
+def distill_digest_manifest(baked_images: dict[str, Any], targets: list[str]) -> dict[str, DigestEntry]:
+    manifest: dict[str, DigestEntry] = {}
+    for target in targets:
+        entry = baked_images[target]
+        image_name = entry["image.name"]
+        digest = entry["containerimage.digest"]
+        refs = [reference.strip() for reference in image_name.split(",") if reference.strip()]
+        image_ref = ""
+        tags: list[str] = []
+        for reference in refs:
+            reference = reference.split("@", 1)[0]
+            repository, separator, tag = reference.rpartition(":")
+            if separator:
+                image_ref = repository
+                tags.append(tag)
+        if not tags:
+            raise ValueError(f"target '{target}' produced no tagged image references from '{image_name}'")
+        manifest[target] = {"ref": image_ref, "digest": digest, "tags": tags}
+    return manifest
 
 
 # Vibe code - Gemini 3

docker_devkit-0.2.1.dev109/tests/test_build_docker.py

@@ -0,0 +1,92 @@
+import json
+from pathlib import Path
+from typing import Any
+
+import pytest
+
+from docker_devkit import build_docker
+from docker_devkit.build_docker import DIGEST_FILE_NAME, distill_digest_manifest, push_image_digests
+
+DIGEST_A = "sha256:" + "a" * 64
+DIGEST_B = "sha256:" + "b" * 64
+BUILD_SHA = "c" * 40
+REPO_ZED = "ghcr.io/outernet-foundation/placeframe-capture-tool/zed-capture"
+REPO_AOA = "ghcr.io/outernet-foundation/placeframe-capture-tool/aoa-bridge"
+
+
+def _baked(target: str, *, refs: str, digest: str) -> dict[str, dict[str, str]]:
+    return {target: {"image.name": refs, "containerimage.digest": digest}}
+
+
+class PushBuildRecorder:
+    def __init__(self) -> None:
+        self.calls: list[tuple[str, str, str, str, Path, list[str]]] = []
+        self.manifests: list[dict[str, Any]] = []
+
+    def __call__(
+        self,
+        registry: str,
+        project: str,
+        platform: str,
+        tag: str,
+        source_directory: Path,
+        paths: list[str],
+    ) -> None:
+        self.calls.append((registry, project, platform, tag, source_directory, paths))
+        manifest_path = Path(source_directory) / paths[0]
+        self.manifests.append(json.loads(manifest_path.read_text(encoding="utf-8")))
+
+
+def test_distills_single_target_single_tag() -> None:
+    baked = _baked("zed-capture", refs=f"{REPO_ZED}:tree-abc", digest=DIGEST_A)
+    assert distill_digest_manifest(baked, ["zed-capture"]) == {
+        "zed-capture": {"ref": REPO_ZED, "digest": DIGEST_A, "tags": ["tree-abc"]}
+    }
+
+
+def test_distills_multiple_tags_from_comma_separated_refs() -> None:
+    baked = _baked("zed-capture", refs=f"{REPO_ZED}:tree-abc,{REPO_ZED}:latest", digest=DIGEST_A)
+    assert distill_digest_manifest(baked, ["zed-capture"]) == {
+        "zed-capture": {"ref": REPO_ZED, "digest": DIGEST_A, "tags": ["tree-abc", "latest"]}
+    }
+
+
+def test_distills_multiple_targets() -> None:
+    baked = {
+        "zed-capture": {"image.name": f"{REPO_ZED}:tree-abc", "containerimage.digest": DIGEST_A},
+        "aoa-bridge": {"image.name": f"{REPO_AOA}:tree-def", "containerimage.digest": DIGEST_B},
+    }
+    assert distill_digest_manifest(baked, ["zed-capture", "aoa-bridge"]) == {
+        "zed-capture": {"ref": REPO_ZED, "digest": DIGEST_A, "tags": ["tree-abc"]},
+        "aoa-bridge": {"ref": REPO_AOA, "digest": DIGEST_B, "tags": ["tree-def"]},
+    }
+
+
+def test_strips_digest_suffix_from_refs() -> None:
+    baked = _baked("zed-capture", refs=f"{REPO_ZED}:tree-abc@{DIGEST_A}", digest=DIGEST_A)
+    entry = distill_digest_manifest(baked, ["zed-capture"])["zed-capture"]
+    assert entry["ref"] == REPO_ZED
+    assert entry["tags"] == ["tree-abc"]
+
+
+def test_refuses_target_with_no_tagged_references() -> None:
+    baked = _baked("zed-capture", refs=f"{REPO_ZED}@{DIGEST_A}", digest=DIGEST_A)
+    with pytest.raises(ValueError, match="zed-capture"):
+        distill_digest_manifest(baked, ["zed-capture"])
+
+
+def test_push_image_digests_pushes_manifest_to_images_digests_all(monkeypatch: pytest.MonkeyPatch) -> None:
+    recorder = PushBuildRecorder()
+    monkeypatch.setattr(build_docker, "push_build", recorder)
+    baked = _baked("zed-capture", refs=f"{REPO_ZED}:tree-abc,{REPO_ZED}:latest", digest=DIGEST_A)
+    push_image_digests("ghcr.io/owner/builds", BUILD_SHA, baked, ["zed-capture"])
+    assert len(recorder.calls) == 1
+    registry, project, platform, tag, _source_directory, paths = recorder.calls[0]
+    assert registry == "ghcr.io/owner/builds"
+    assert project == "images-digests"
+    assert platform == "all"
+    assert tag == f"sha-{BUILD_SHA}"
+    assert paths == [DIGEST_FILE_NAME]
+    assert recorder.manifests == [
+        {"zed-capture": {"ref": REPO_ZED, "digest": DIGEST_A, "tags": ["tree-abc", "latest"]}}
+    ]

{docker_devkit-0.2.0.dev37277620738 → docker_devkit-0.2.1.dev109}/uv.lock

@@ -43,16 +43,16 @@ wheels = [
 
 [[package]]
 name = "ci-devkit"
-version = "0.1.15.dev36756330648"
+version = "0.2.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "bashrun" },
     { name = "pydantic" },
     { name = "pydantic-settings" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/5c/1e/fdad4f4fd539491f8ddeaf45e349801b274e9f7a8b00f768c6e83df1b97d/ci_devkit-0.1.15.dev36756330648.tar.gz", hash = "sha256:55b497b377a5e10e85c773b57897e4d1f883129b45567d1ecb581c02a18eabe4", size = 53675, upload-time = "2026-09-30T18:10:54.868Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/fd/c6/94c2a4a406b593ca3a1140151c0cb2c1367b30bf295f32a4bf9c92c100ac/ci_devkit-0.2.0.tar.gz", hash = "sha256:a16e0a91771a5b50205646577e8d56198c7c3262a063d7ebcf9a82fc26a2e3e0", size = 53288, upload-time = "2026-10-05T15:02:35.926Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/2f/1e/9f81e475c3cc65febb1e9013caf13dd20b393275c785713a7a85498dfcbc/ci_devkit-0.1.15.dev36756330648-py3-none-any.whl", hash = "sha256:4189adc38d182591cabef7e06321ae1105cdb9fb915f38d90d352a3f277630aa", size = 28208, upload-time = "2026-09-30T18:10:54.044Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/d7/f7b91b7e62ed5cd7864f4ddbf84851ad5a31938342cb00e28bf15a7064c2/ci_devkit-0.2.0-py3-none-any.whl", hash = "sha256:d86403effbe36563b0a471d860e5e1e46ae7793d7d203a2dcc5561e91d1163f6", size = 28022, upload-time = "2026-10-05T15:02:34.654Z" },
 ]
 
 [[package]]
@@ -93,7 +93,7 @@ dev = [
 [package.metadata]
 requires-dist = [
     { name = "bashrun", specifier = ">=0.1.0" },
-    { name = "ci-devkit", specifier = "==0.1.15.dev36756330648" },
+    { name = "ci-devkit", specifier = ">=0.1.15" },
     { name = "packaging", specifier = ">=24.1" },
     { name = "pathspec", specifier = ">=1.0.4" },
     { name = "pydantic", specifier = ">=2.11.7" },

docker_devkit-0.2.0.dev37277620738/release-devkit.yaml

@@ -1,7 +0,0 @@
-ci_workflow: release.yml
-packages:
-  docker-devkit:
-    path: .
-    major_minor: "0.2"
-    registries:
-      pypi: docker-devkit