feat(infra): pull artifacts pinned by package release

2026-07-27 15:13:52 +00:00
parent 938df8513f
commit 8315e4192a
29 changed files with 621 additions and 56 deletions
@@ -0,0 +1,67 @@
+# Package bot-bottle only after immutable OCI and Firecracker artifacts have
+# been published. The inputs are the release boundary: the resulting wheel
+# carries these exact identities and production startup never chooses another.
+
+name: package-release
+
+on:
+  workflow_dispatch:
+    inputs:
+      orchestrator_image:
+        description: Digest-pinned orchestrator OCI reference
+        required: true
+      gateway_image:
+        description: Digest-pinned gateway OCI reference
+        required: true
+      firecracker_orchestrator_version:
+        description: Published orchestrator rootfs package version
+        required: true
+      firecracker_orchestrator_sha256:
+        description: SHA-256 of orchestrator rootfs.ext4.gz
+        required: true
+      firecracker_gateway_version:
+        description: Published gateway rootfs package version
+        required: true
+      firecracker_gateway_sha256:
+        description: SHA-256 of gateway rootfs.ext4.gz
+        required: true
+
+jobs:
+  package:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout the release commit
+        uses: actions/checkout@v4
+
+      - name: Install package build tooling
+        run: python3 -m pip install --break-system-packages build
+
+      - name: Generate immutable release manifest
+        run: |
+          python3 scripts/generate_release_manifest.py \
+            --source-commit "$GITHUB_SHA" \
+            --orchestrator-image '${{ inputs.orchestrator_image }}' \
+            --gateway-image '${{ inputs.gateway_image }}' \
+            --firecracker-orchestrator-version '${{ inputs.firecracker_orchestrator_version }}' \
+            --firecracker-orchestrator-sha256 '${{ inputs.firecracker_orchestrator_sha256 }}' \
+            --firecracker-gateway-version '${{ inputs.firecracker_gateway_version }}' \
+            --firecracker-gateway-sha256 '${{ inputs.firecracker_gateway_sha256 }}' \
+            --output release-manifest.json
+
+      - name: Build package with assigned infrastructure pins
+        env:
+          BOT_BOTTLE_RELEASE_MANIFEST: ${{ github.workspace }}/release-manifest.json
+        run: python3 -m build
+
+      - name: Verify packaged manifest
+        run: |
+          python3 -m venv verify-venv
+          verify-venv/bin/pip install --no-deps dist/*.whl
+          verify-venv/bin/python -c \
+            'from bot_bottle.release_manifest import load_manifest; print(load_manifest())'
+
+      - name: Upload release package
+        uses: actions/upload-artifact@v3
+        with:
+          name: bot-bottle-release
+          path: dist/