docker-devkit 0.2.0.dev37277620738__tar.gz → 0.2.1.dev37485576216__tar.gz

{docker_devkit-0.2.0.dev37277620738 → docker_devkit-0.2.1.dev37485576216}/.github/actions/setup-release-devkit/action.yml

@@ -5,7 +5,7 @@ runs:
   steps:
     - shell: bash
       env:
-        RELEASE_DEVKIT_COMMIT: 1130b982aeb956a42b7bf9000ad231eaade593bf
+        RELEASE_DEVKIT_COMMIT: ed406a0d88445dd601b7cbe47decbb6371694e3a
       run: |
         git clone https://github.com/outernet-foundation/release-devkit.git "$RUNNER_TEMP/release-devkit"
         git -C "$RUNNER_TEMP/release-devkit" checkout "$RELEASE_DEVKIT_COMMIT"

{docker_devkit-0.2.0.dev37277620738 → docker_devkit-0.2.1.dev37485576216}/.github/workflows/release.yml

@@ -11,12 +11,14 @@ permissions:
   contents: read
 
 jobs:
-  publish-prerelease:
+  prerelease:
     if: github.ref == 'refs/heads/dev'
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write
       id-token: write
+      packages: read
+      actions: read
     steps:
       - uses: actions/checkout@v5
         with:
@@ -31,7 +33,9 @@ jobs:
           save-cache: "false"
       - &setup-release-devkit
         uses: ./.github/actions/setup-release-devkit
-      - run: uv run --project "$RUNNER_TEMP/release-devkit" --locked --no-dev publish-prerelease
+      - run: uv run --project "$RUNNER_TEMP/release-devkit" --locked --no-dev prerelease
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
 
   release:
     if: github.ref == 'refs/heads/main'

{docker_devkit-0.2.0.dev37277620738 → docker_devkit-0.2.1.dev37485576216}/AGENTS.md

@@ -65,7 +65,7 @@ The mirror is declared, not inferred: the `mirror:` section with `prefix` in the
 - The `mirror` verb (crane install from a pinned release, per-target `crane copy`, count footer) uses bashrun + plain prints, deliberately not ci-devkit's `ci_step` — it needs nothing from the floor.
 - Non-mirror lock entries (e.g. `placeframe/*` publishes) are not probed and keep failing naturally at pull. There is no config-level ban on the flag: an air-gap fails closed anyway (no route to upstream — the pull dies with or without it).
 
-The ci-devkit edge exists for the builds shelf: a CI `build` run pushes the resolved `workloads/images.lock` to the repo's builds registry (`--builds-registry` + `--lock-project` + `--run-number`) through ci-devkit's `push_build` — one `images-lock`-platform artifact tagged `run-{N}` per run, the exact lock the run baked with, consumed by release-devkit's release stapler. ORAS CLI knowledge lives only in ci-devkit (org law); local builds (`--mode local`, no `--builds-registry`) never touch it.
+The ci-devkit edge exists for the builds shelf: a CI `build` run distills bake's `--metadata-file` into a digest manifest (`target → {ref, digest, tags[]}` JSON) and pushes it to the repo's builds registry at the conventional `images-digests/all` project/platform (`--builds-registry` + `--run-number`) through ci-devkit's `push_build` — one `images-digests-all` artifact tagged `run-{N}` per run, consumed by release-devkit's release surfaces for the built-image digest table. `workloads/images.lock` stays in source control (the stapler that consumed the shelf copy is gone). ORAS CLI knowledge lives only in ci-devkit (org law); local builds (`--mode local`, no `--builds-registry`) never touch it.
 
 Lifecycle stays a separate package from codegen (client generation, datamodel generation, workspace locking) because their dependency surfaces are disjoint — bundling them would force a consumer that only brings a stack up to install `sqlacodegen`, `psycopg`, `datamodel-code-generator`.
 

{docker_devkit-0.2.0.dev37277620738 → docker_devkit-0.2.1.dev37485576216}/PKG-INFO

@@ -1,12 +1,12 @@
 Metadata-Version: 2.5
 Name: docker-devkit
-Version: 0.2.0.dev37277620738
+Version: 0.2.1.dev37485576216
 Summary: Docker-stack lifecycle commands (up/down/build) driven by a pyproject-declared compose assembly
 License-File: LICENSE
 License-File: NOTICE
 Requires-Python: >=3.13
 Requires-Dist: bashrun>=0.1.0
-Requires-Dist: ci-devkit==0.1.15.dev36756330648
+Requires-Dist: ci-devkit>=0.1.15
 Requires-Dist: packaging>=24.1
 Requires-Dist: pathspec>=1.0.4
 Requires-Dist: pydantic-settings>=2.9.1

{docker_devkit-0.2.0.dev37277620738 → docker_devkit-0.2.1.dev37485576216}/pyproject.toml

@@ -1,11 +1,11 @@
 [project]
 name = "docker-devkit"
-version = "0.2.0.dev37277620738"
+version = "0.2.1.dev37485576216"
 description = "Docker-stack lifecycle commands (up/down/build) driven by a pyproject-declared compose assembly"
 requires-python = ">=3.13"
 dependencies = [
     "bashrun>=0.1.0",
-    "ci-devkit==0.1.15.dev36756330648",
+    "ci-devkit>=0.1.15",
     "packaging>=24.1",
     "pathspec>=1.0.4",
     "pydantic>=2.11.7",

{docker_devkit-0.2.0.dev37277620738 → docker_devkit-0.2.1.dev37485576216}/src/docker_devkit/build_docker.py

@@ -6,7 +6,8 @@ import platform
 import re
 from pathlib import Path
 from subprocess import CalledProcessError
-from typing import Annotated, Any, Literal
+from tempfile import TemporaryDirectory
+from typing import Annotated, Any, Literal, TypedDict
 
 import typer
 from bashrun.bash import bash, bash_output
@@ -32,7 +33,16 @@ METADATA_PATH = Path("metadata.json")
 
 Mode = Literal["local", "ci"]
 
-IMAGES_LOCK_PLATFORM = "images-lock"
+DIGEST_PROJECT = "images-digests"
+DIGEST_PLATFORM = "all"
+DIGEST_FILE_NAME = "images-digests.json"
+
+
+class DigestEntry(TypedDict):
+    ref: str
+    digest: str
+    tags: list[str]
+
 
 app = typer.Typer(add_completion=False, pretty_exceptions_show_locals=False)
 
@@ -55,14 +65,12 @@ def build(
     ] = None,
     builds_registry: Annotated[
         str | None,
-        typer.Option("--builds-registry", help="OCI registry path to push the resolved lock to (CI build artifacts)."),
-    ] = None,
-    lock_project: Annotated[
-        str | None,
-        typer.Option("--lock-project", help="Project component of the lock's builds-shelf address (CI only)."),
+        typer.Option(
+            "--builds-registry", help="OCI registry path to push the digest manifest to (CI build artifacts)."
+        ),
     ] = None,
     run_number: Annotated[
-        int, typer.Option("--run-number", help="CI run number baked into the lock's builds-shelf tag.")
+        int, typer.Option("--run-number", help="CI run number baked into the digest manifest's builds-shelf tag.")
     ] = 0,
 ) -> None:
     run_build(
@@ -74,7 +82,6 @@ def build(
         no_cache=no_cache,
         targets_opt=targets_opt,
         builds_registry=builds_registry,
-        lock_project=lock_project,
         run_number=run_number,
     )
 
@@ -90,7 +97,6 @@ def run_build(
     targets_opt: list[str] | None = None,
     env_overlay: dict[str, str] | None = None,
     builds_registry: str | None = None,
-    lock_project: str | None = None,
     run_number: int = 0,
 ) -> None:
     root = Path.cwd()
@@ -223,22 +229,50 @@ def run_build(
     if not set(targets) <= baked_images.keys():
         raise RuntimeError("Bake output does not cover the requested targets")
 
-    push_images_lock(builds_registry, lock_project, run_number, lock_file)
+    push_image_digests(builds_registry, run_number, baked_images, targets)
 
 
-def push_images_lock(builds_registry: str | None, lock_project: str | None, run_number: int, lock_file: Path) -> None:
+def push_image_digests(
+    builds_registry: str | None,
+    run_number: int,
+    baked_images: dict[str, Any],
+    targets: list[str],
+) -> None:
     if builds_registry is None:
         return
-    if not lock_project or run_number <= 0:
-        raise typer.BadParameter("--builds-registry requires --lock-project and a positive --run-number")
-    push_build(
-        builds_registry,
-        lock_project,
-        IMAGES_LOCK_PLATFORM,
-        f"run-{run_number}",
-        lock_file.parent,
-        [lock_file.name],
-    )
+    if run_number <= 0:
+        raise typer.BadParameter("--builds-registry requires a positive --run-number")
+    manifest = distill_digest_manifest(baked_images, targets)
+    with TemporaryDirectory(prefix="digest-manifest-") as staging:
+        manifest_path = Path(staging) / DIGEST_FILE_NAME
+        manifest_path.write_text(json.dumps(manifest, indent=2), encoding="utf-8")
+        push_build(
+            builds_registry,
+            DIGEST_PROJECT,
+            DIGEST_PLATFORM,
+            f"run-{run_number}",
+            Path(staging),
+            [DIGEST_FILE_NAME],
+        )
+
+
+def distill_digest_manifest(baked_images: dict[str, Any], targets: list[str]) -> dict[str, DigestEntry]:
+    manifest: dict[str, DigestEntry] = {}
+    for target in targets:
+        entry = baked_images[target]
+        image_name = entry["image.name"]
+        digest = entry["containerimage.digest"]
+        refs = [reference.strip() for reference in image_name.split(",") if reference.strip()]
+        image_ref = ""
+        tags: list[str] = []
+        for reference in refs:
+            reference = reference.split("@", 1)[0]
+            repository, separator, tag = reference.rpartition(":")
+            if separator:
+                image_ref = repository
+                tags.append(tag)
+        manifest[target] = {"ref": image_ref, "digest": digest, "tags": tags}
+    return manifest
 
 
 # Vibe code - Gemini 3

docker_devkit-0.2.1.dev37485576216/tests/test_build_docker.py

@@ -0,0 +1,99 @@
+import json
+from pathlib import Path
+from typing import Any
+
+import pytest
+import typer
+
+from docker_devkit import build_docker
+from docker_devkit.build_docker import DIGEST_FILE_NAME, distill_digest_manifest, push_image_digests
+
+DIGEST_A = "sha256:" + "a" * 64
+DIGEST_B = "sha256:" + "b" * 64
+REPO_ZED = "ghcr.io/outernet-foundation/placeframe-capture-tool/zed-capture"
+REPO_AOA = "ghcr.io/outernet-foundation/placeframe-capture-tool/aoa-bridge"
+
+
+def _baked(target: str, *, refs: str, digest: str) -> dict[str, dict[str, str]]:
+    return {target: {"image.name": refs, "containerimage.digest": digest}}
+
+
+class PushBuildRecorder:
+    def __init__(self) -> None:
+        self.calls: list[tuple[str, str, str, str, Path, list[str]]] = []
+        self.manifests: list[dict[str, Any]] = []
+
+    def __call__(
+        self,
+        registry: str,
+        project: str,
+        platform: str,
+        tag: str,
+        source_directory: Path,
+        paths: list[str],
+    ) -> None:
+        self.calls.append((registry, project, platform, tag, source_directory, paths))
+        manifest_path = Path(source_directory) / paths[0]
+        self.manifests.append(json.loads(manifest_path.read_text(encoding="utf-8")))
+
+
+def test_distills_single_target_single_tag() -> None:
+    baked = _baked("zed-capture", refs=f"{REPO_ZED}:tree-abc", digest=DIGEST_A)
+    assert distill_digest_manifest(baked, ["zed-capture"]) == {
+        "zed-capture": {"ref": REPO_ZED, "digest": DIGEST_A, "tags": ["tree-abc"]}
+    }
+
+
+def test_distills_multiple_tags_from_comma_separated_refs() -> None:
+    baked = _baked("zed-capture", refs=f"{REPO_ZED}:tree-abc,{REPO_ZED}:run-42", digest=DIGEST_A)
+    assert distill_digest_manifest(baked, ["zed-capture"]) == {
+        "zed-capture": {"ref": REPO_ZED, "digest": DIGEST_A, "tags": ["tree-abc", "run-42"]}
+    }
+
+
+def test_distills_multiple_targets() -> None:
+    baked = {
+        "zed-capture": {"image.name": f"{REPO_ZED}:tree-abc", "containerimage.digest": DIGEST_A},
+        "aoa-bridge": {"image.name": f"{REPO_AOA}:tree-def", "containerimage.digest": DIGEST_B},
+    }
+    assert distill_digest_manifest(baked, ["zed-capture", "aoa-bridge"]) == {
+        "zed-capture": {"ref": REPO_ZED, "digest": DIGEST_A, "tags": ["tree-abc"]},
+        "aoa-bridge": {"ref": REPO_AOA, "digest": DIGEST_B, "tags": ["tree-def"]},
+    }
+
+
+def test_strips_digest_suffix_from_refs() -> None:
+    baked = _baked("zed-capture", refs=f"{REPO_ZED}:tree-abc@{DIGEST_A}", digest=DIGEST_A)
+    entry = distill_digest_manifest(baked, ["zed-capture"])["zed-capture"]
+    assert entry["ref"] == REPO_ZED
+    assert entry["tags"] == ["tree-abc"]
+
+
+def test_push_image_digests_is_noop_without_builds_registry(monkeypatch: pytest.MonkeyPatch) -> None:
+    recorder = PushBuildRecorder()
+    monkeypatch.setattr(build_docker, "push_build", recorder)
+    baked = _baked("zed-capture", refs=f"{REPO_ZED}:tree-abc", digest=DIGEST_A)
+    push_image_digests(None, 42, baked, ["zed-capture"])
+    assert recorder.calls == []
+
+
+def test_push_image_digests_rejects_zero_run_number() -> None:
+    with pytest.raises(typer.BadParameter):
+        push_image_digests("ghcr.io/owner/builds", 0, {}, [])
+
+
+def test_push_image_digests_pushes_manifest_to_images_digests_all(monkeypatch: pytest.MonkeyPatch) -> None:
+    recorder = PushBuildRecorder()
+    monkeypatch.setattr(build_docker, "push_build", recorder)
+    baked = _baked("zed-capture", refs=f"{REPO_ZED}:tree-abc,{REPO_ZED}:run-42", digest=DIGEST_A)
+    push_image_digests("ghcr.io/owner/builds", 42, baked, ["zed-capture"])
+    assert len(recorder.calls) == 1
+    registry, project, platform, tag, _source_directory, paths = recorder.calls[0]
+    assert registry == "ghcr.io/owner/builds"
+    assert project == "images-digests"
+    assert platform == "all"
+    assert tag == "run-42"
+    assert paths == [DIGEST_FILE_NAME]
+    assert recorder.manifests == [
+        {"zed-capture": {"ref": REPO_ZED, "digest": DIGEST_A, "tags": ["tree-abc", "run-42"]}}
+    ]

{docker_devkit-0.2.0.dev37277620738 → docker_devkit-0.2.1.dev37485576216}/uv.lock

@@ -43,16 +43,16 @@ wheels = [
 
 [[package]]
 name = "ci-devkit"
-version = "0.1.15.dev36756330648"
+version = "0.2.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "bashrun" },
     { name = "pydantic" },
     { name = "pydantic-settings" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/5c/1e/fdad4f4fd539491f8ddeaf45e349801b274e9f7a8b00f768c6e83df1b97d/ci_devkit-0.1.15.dev36756330648.tar.gz", hash = "sha256:55b497b377a5e10e85c773b57897e4d1f883129b45567d1ecb581c02a18eabe4", size = 53675, upload-time = "2026-09-30T18:10:54.868Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/fd/c6/94c2a4a406b593ca3a1140151c0cb2c1367b30bf295f32a4bf9c92c100ac/ci_devkit-0.2.0.tar.gz", hash = "sha256:a16e0a91771a5b50205646577e8d56198c7c3262a063d7ebcf9a82fc26a2e3e0", size = 53288, upload-time = "2026-10-05T15:02:35.926Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/2f/1e/9f81e475c3cc65febb1e9013caf13dd20b393275c785713a7a85498dfcbc/ci_devkit-0.1.15.dev36756330648-py3-none-any.whl", hash = "sha256:4189adc38d182591cabef7e06321ae1105cdb9fb915f38d90d352a3f277630aa", size = 28208, upload-time = "2026-09-30T18:10:54.044Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/d7/f7b91b7e62ed5cd7864f4ddbf84851ad5a31938342cb00e28bf15a7064c2/ci_devkit-0.2.0-py3-none-any.whl", hash = "sha256:d86403effbe36563b0a471d860e5e1e46ae7793d7d203a2dcc5561e91d1163f6", size = 28022, upload-time = "2026-10-05T15:02:34.654Z" },
 ]
 
 [[package]]
@@ -93,7 +93,7 @@ dev = [
 [package.metadata]
 requires-dist = [
     { name = "bashrun", specifier = ">=0.1.0" },
-    { name = "ci-devkit", specifier = "==0.1.15.dev36756330648" },
+    { name = "ci-devkit", specifier = ">=0.1.15" },
     { name = "packaging", specifier = ">=24.1" },
     { name = "pathspec", specifier = ">=1.0.4" },
     { name = "pydantic", specifier = ">=2.11.7" },