Add measured Depot Registry pull-through canary

[ndizazzo]

Summary

• add a manual trusted-main canary that compares five fresh-runner upstream pulls with five Depot pull-through pulls
• require identical image digests and report the 20% plus 10-second adoption gate
• document the security boundary, measurement limits, and current Depot runner state

Validation

• python3 -m unittest scripts.tests.test_depot_registry_canary_workflow scripts.tests.test_summarize_depot_registry_pulls
• actionlint .github/workflows/depot-registry-canary.yml
• git diff --check

Pull-through caching remains disabled in normal builds until each mapping passes the canary.

Summary by CodeRabbit

• New Features

  • Added a manually triggered registry performance canary for main-branch builds.
  • Compares upstream and mirrored image pulls using pinned images, fresh runners, digest verification, and secure short-lived access.
  • Produces retained timing results and optional threshold enforcement.

• Documentation

  • Documented registry performance criteria, rollout safeguards, operational risks, and CI workflow coverage.
  • Adoption requires matching image digests, five samples, and at least 20% plus 10 seconds of median pull-time improvement.

• Tests

  • Added coverage for workflow security, triggering rules, sampling, digest validation, and performance-report calculations.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 275aebcb-f625-4c69-916c-8866cf46a955

📥 Commits

Reviewing files that changed from the base of the PR and between 62074f5 and 7c37782.

📒 Files selected for processing (9)

• .agents/skills/manage-ci/SKILL.md
• .agents/skills/manage-ci/references/current-inventory.md
• .github/workflows/depot-registry-canary.yml
• ci/DEPOT_MIGRATION.md
• ci/METRICS.md
• ci/ci.md
• scripts/summarize-depot-registry-pulls.py
• scripts/tests/test_depot_registry_canary_workflow.py
• scripts/tests/test_summarize_depot_registry_pulls.py

---

📝 Walkthrough

Walkthrough

This change adds a manually triggered Depot Registry pull-through canary. It validates pinned images, compares upstream and Depot pull times across fresh runners, verifies digests, summarizes threshold eligibility, and documents CI trust and measurement requirements.

Changes

Depot Registry pull-through canary

Layer / File(s)	Summary
Canary workflow and pull observations .github/workflows/depot-registry-canary.yml, scripts/tests/test_depot_registry_canary_workflow.py	The workflow validates exact-main dispatch and pinned inputs, performs five upstream and five Depot pulls, verifies digests, stores observations, and uses OIDC-scoped authentication. Tests verify these controls and pinned artifact actions.
Pull observation validation and reporting scripts/summarize-depot-registry-pulls.py, scripts/tests/test_summarize_depot_registry_pulls.py	The CLI validates observations, computes median pull-time improvements, checks digest and sample requirements, emits reports, and supports threshold enforcement. Tests cover qualifying results and validation failures.
CI governance and measurement documentation .agents/skills/manage-ci/*, ci/DEPOT_MIGRATION.md, ci/METRICS.md, ci/ci.md	The CI guidance records trusted-build restrictions, rollout state, runner authorization status, measurement thresholds, retention, and the canary workflow topology.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant UpstreamRegistry
  participant DepotRegistry
  participant PullSummarizer
  GitHubActions->>GitHubActions: Validate exact-main dispatch and digest-pinned image
  GitHubActions->>UpstreamRegistry: Pull image and record elapsed time
  GitHubActions->>DepotRegistry: Obtain OIDC token and pull mirror image
  GitHubActions->>GitHubActions: Verify manifest digest and upload observations
  GitHubActions->>PullSummarizer: Generate JSON and Markdown threshold reports

Loading

Possibly related PRs

• Mesh-LLM/mesh-llm#1059: Introduced the CI management guidance and inventory extended by this canary.
• Mesh-LLM/mesh-llm#1113: Shares Depot CI infrastructure and trusted-runner governance.

Suggested reviewers: i386, michaelneale

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/depot-pull-through-cache

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}