diff --git a/.github/workflows/depot-registry-canary.yml b/.github/workflows/depot-registry-canary.yml index 836fe49bed..63e6cce858 100644 --- a/.github/workflows/depot-registry-canary.yml +++ b/.github/workflows/depot-registry-canary.yml @@ -20,9 +20,6 @@ on: permissions: contents: read -env: - DEPOT_PROJECT_ID: mzm95zcv7p - concurrency: group: depot-registry-canary cancel-in-progress: false @@ -74,33 +71,16 @@ jobs: needs: policy permissions: contents: read - id-token: write strategy: fail-fast: false matrix: source: [upstream, depot] sample: [1, 2, 3, 4, 5] - # Use GitHub's OIDC issuer for the Depot project trust relationship while - # retaining a fresh hosted VM for every timing sample. - runs-on: ubuntu-24.04 + # Depot provisions a fresh runner for every sample and pre-authenticates it + # to the organization Registry with a short-lived job credential. + runs-on: depot-ubuntu-24.04 timeout-minutes: 15 steps: - - name: Set up Depot CLI - if: ${{ matrix.source == 'depot' }} - uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1 - with: - version: 2.101.77 - - name: Authenticate to Depot Registry - if: ${{ matrix.source == 'depot' }} - shell: bash - env: - DEPOT_REGISTRY_HOST: ${{ vars.DEPOT_REGISTRY_HOST }} - run: | - set -euo pipefail - - depot pull-token --project "$DEPOT_PROJECT_ID" | - docker login "$DEPOT_REGISTRY_HOST" --username x-token --password-stdin - - name: Pull exact image on a fresh runner shell: bash env: @@ -112,6 +92,11 @@ jobs: run: | set -euo pipefail + if [[ "${DEPOT_ORG_ID:-}" != "1ntz5vlngn" ]]; then + echo "registry canaries require a pre-authenticated Mesh-LLM Depot runner" >&2 + exit 1 + fi + image="$UPSTREAM_IMAGE" if [[ "$SOURCE" == "depot" ]]; then image="$DEPOT_IMAGE" diff --git a/ci/DEPOT_MIGRATION.md b/ci/DEPOT_MIGRATION.md index ca7210aafd..f8647c0498 100644 --- a/ci/DEPOT_MIGRATION.md +++ b/ci/DEPOT_MIGRATION.md @@ -444,13 +444,15 @@ token to PR code. The checked-in `depot-registry-canary.yml` implements that measurement gate for any digest-pinned public base or runner image. Configure each upstream repository as a distinct Depot pull-through repository, set the nonsecret -`DEPOT_REGISTRY_HOST` repository variable, and permit the job's GitHub OIDC -identity to mint a short-lived read-only `depot pull-token`. No stored registry -secret is required. Run the workflow from `main` with the exact upstream digest -and relative Depot repository name. It allocates five fresh ephemeral runners -per source, verifies digest identity, retains raw timing observations for 14 -days, and reports whether both thresholds pass. Do not enable a mirror in -normal builds until its own retained cohort passes. +`DEPOT_REGISTRY_HOST` repository variable, and enable Depot's native Actions-job +Registry access for the organization. Depot pre-authenticates each trusted +ephemeral runner with a short-lived job credential, so no stored registry secret +or workflow-minted pull token is required. Run the workflow from `main` with the +exact upstream digest and relative Depot repository name. It allocates five +fresh ephemeral runners per source, verifies the injected Depot organization +identity and digest identity, retains raw timing observations for 14 days, and +reports whether both thresholds pass. Do not enable a mirror in normal builds +until its own retained cohort passes. ### `Mesh-LLM/mesh-packaging` diff --git a/ci/METRICS.md b/ci/METRICS.md index fbbc0d9bb4..a7cf046754 100644 --- a/ci/METRICS.md +++ b/ci/METRICS.md @@ -197,10 +197,10 @@ cold-pull, and publication-time thresholds in Use the manual `depot-registry-canary.yml` workflow for registry comparisons. The upstream input must be digest-pinned, and the Depot repository must mirror that exact upstream repository. Each source receives five fresh ephemeral -GitHub-hosted runners so local layer reuse cannot turn a warm local pull into a -false registry result while Depot authenticates through the project's GitHub -Actions OIDC trust relationship. Downloaded observation artifacts can be -reevaluated with: +Depot-managed runners so local layer reuse cannot turn a warm local pull into a +false registry result. Depot pre-authenticates each ephemeral runner with a +short-lived organization Registry job credential. Downloaded observations can +be reevaluated with: ```bash python3 scripts/summarize-depot-registry-pulls.py \ diff --git a/ci/ci.md b/ci/ci.md index 0745c08a80..a0dea780bd 100644 --- a/ci/ci.md +++ b/ci/ci.md @@ -616,8 +616,8 @@ public reference with a configured Depot mirror using five fresh ephemeral runner samples per source. The workflow verifies that every pull resolves to the same manifest digest and requires both 20% and 10 seconds of median pull improvement before a mirror is eligible for broader use. Its read-only pull -token is minted through GitHub OIDC only in the cached pull step; no stored -registry secret is used, and the OIDC permission is never available to PR code. +access comes from Depot's short-lived job credential on each trusted ephemeral +runner; no stored registry secret or workflow-minted pull token is used. This measures registry transfer only; it does not measure package-manager, Cargo, npm/pnpm, native compilation, or Docker export work. diff --git a/scripts/tests/test_depot_registry_canary_workflow.py b/scripts/tests/test_depot_registry_canary_workflow.py index 69344b74ef..85af2701f3 100644 --- a/scripts/tests/test_depot_registry_canary_workflow.py +++ b/scripts/tests/test_depot_registry_canary_workflow.py @@ -16,11 +16,17 @@ def test_canary_is_manual_and_main_only(self) -> None: self.assertNotIn("push:", self.workflow) self.assertIn('"refs/heads/main"', self.workflow) - def test_pull_token_is_short_lived_and_oidc_scoped(self) -> None: - self.assertIn("id-token: write", self.workflow) - self.assertIn("depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461", self.workflow) - self.assertIn('depot pull-token --project "$DEPOT_PROJECT_ID"', self.workflow) - self.assertIn("docker login", self.workflow) + def test_registry_auth_is_native_and_job_scoped(self) -> None: + self.assertIn("runs-on: depot-ubuntu-24.04", self.workflow) + self.assertIn('"${DEPOT_ORG_ID:-}" != "1ntz5vlngn"', self.workflow) + self.assertIn( + "registry canaries require a pre-authenticated Mesh-LLM Depot runner", + self.workflow, + ) + self.assertNotIn("id-token: write", self.workflow) + self.assertNotIn("depot pull-token", self.workflow) + self.assertNotIn("docker login", self.workflow) + self.assertNotIn("DEPOT_PROJECT_ID", self.workflow) self.assertNotIn("secrets.", self.workflow) self.assertNotIn("DEPOT_REGISTRY_PULL_TOKEN", self.workflow) self.assertNotIn("printenv", self.workflow) @@ -28,7 +34,7 @@ def test_pull_token_is_short_lived_and_oidc_scoped(self) -> None: def test_canary_uses_fresh_runner_samples_and_exact_digest(self) -> None: self.assertIn("source: [upstream, depot]", self.workflow) self.assertIn("sample: [1, 2, 3, 4, 5]", self.workflow) - self.assertIn("runs-on: ubuntu-24.04", self.workflow) + self.assertEqual(self.workflow.count("runs-on: depot-ubuntu-24.04"), 1) self.assertIn("upstream_image must be pinned by sha256 digest", self.workflow) self.assertIn("digest mismatch", self.workflow)