ci: build runner images once before digest promotion - #9
Merged
Merged
Conversation
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (29)
📝 WalkthroughWalkthroughThe pull request replaces the monolithic image publication workflow with policy-driven validation, matrix-based family staging, immutable descriptor verification, digest promotion, and latest-cohort reconciliation. It also adds runner family configuration, revision metadata checks, operational documentation, and integration tests. ChangesRunner image pipeline
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related PRs
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
ndizazzo
marked this pull request as ready for review
July 30, 2026 07:11
This was referenced Aug 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
validate,stage, andpromotemodes: manual dispatch defaults to validation, main pushes stage candidates only, and the weekly schedule or an explicit main dispatch performs promotionDEPOT_RUNNERS_ENABLED=true*-digest-sha256-<manifest-digest>tags while retaining both full source revisions in OCI labels and candidate descriptorslatestmap in a retained cohort manifest and reconcile it serially/idempotently after all versioned promotions and attestations succeedExecution contract
validatevalidateonlyvalidatemode=minstagemode=maxpromotemode=maxPerformance evidence
The corrected run passed all 22 allocated jobs and all 20 platform builds. It reduced wall time by 72.3%, aggregate job time by 57.7%, and the critical platform row by 74.0%. Queueing was at most 9 seconds. All allocated jobs used the GitHub Actions group with only
ubuntu-24.04andubuntu-24.04-arm; zero Depot jobs were assigned to the pull request. The completed logs contain no actualsending cache exportorexporting cachephase.Both measured runs are exhaustive because this PR changes the Dockerfile. Once merged, workflow/docs/policy-only pull requests will select only the mandatory public CPU AMD64 contract row; image-input changes select their affected environment/backend families, and common or unknown image inputs continue to fail open to the complete matrix.
Historical context: a representative pre-restructure PR took 17m12s; representative publication runs took 39m15s and 48m01s.
Rollout boundary
This PR is merged. Depot access still requires the organization runner group to be restricted to this repository and both default-branch workflows documented in
docs/OPERATIONS.md. The live repository currently has no main-branch ruleset or branch protection, so public Depot access remains blocked until main protection, required review for workflow changes, and selected-workflow runner-group restrictions are verified. This PR does not change repository settings.Candidate cleanup also remains deliberately conservative: GHCR package-version deletion can remove promoted references sharing a digest. The operations guide records the 14-day target and the proof required before automating deletion.
Validation
git diff --checkSummary by CodeRabbit
New Features
Documentation
Tests
Post-merge evidence
Post-merge main run 30522118156 completed successfully at merge commit
4e79e68e22a5ea9bb1eedf9a2a7e7ccfc20b2bca: all 20 platform rows and 13 assembly/index jobs passed, with no failed, cancelled, or timed-out jobs. The local untracked.omo/directory was not added or modified.