feat(release): automate artifact and tag flows

.gitea/workflows/package-release.yml

@@ -1,95 +0,0 @@
-# Package bot-bottle only after immutable OCI and Firecracker artifacts have
-# been published. The inputs are the release boundary: the resulting wheel
-# carries these exact identities and production startup never chooses another.
-
-name: package-release
-
-on:
-  workflow_dispatch:
-    inputs:
-      orchestrator_image:
-        description: Digest-pinned orchestrator OCI reference
-        required: true
-      gateway_image:
-        description: Digest-pinned gateway OCI reference
-        required: true
-      agent_claude_image:
-        description: Digest-pinned Claude agent OCI reference
-        required: true
-      agent_codex_image:
-        description: Digest-pinned Codex agent OCI reference
-        required: true
-      agent_pi_image:
-        description: Digest-pinned Pi agent OCI reference
-        required: true
-      firecracker_orchestrator_version:
-        description: Published orchestrator rootfs package version
-        required: true
-      firecracker_orchestrator_sha256:
-        description: SHA-256 of orchestrator rootfs.ext4.gz
-        required: true
-      firecracker_gateway_version:
-        description: Published gateway rootfs package version
-        required: true
-      firecracker_gateway_sha256:
-        description: SHA-256 of gateway rootfs.ext4.gz
-        required: true
-
-jobs:
-  package:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout the release commit
-        uses: actions/checkout@v4
-
-      - name: Install package build tooling
-        run: python3 -m pip install --break-system-packages build
-
-      - name: Generate immutable release manifest
-        run: |
-          python3 scripts/generate_release_manifest.py \
-            --source-commit "$GITHUB_SHA" \
-            --orchestrator-image '${{ inputs.orchestrator_image }}' \
-            --gateway-image '${{ inputs.gateway_image }}' \
-            --agent-claude-image '${{ inputs.agent_claude_image }}' \
-            --agent-codex-image '${{ inputs.agent_codex_image }}' \
-            --agent-pi-image '${{ inputs.agent_pi_image }}' \
-            --firecracker-orchestrator-version '${{ inputs.firecracker_orchestrator_version }}' \
-            --firecracker-orchestrator-sha256 '${{ inputs.firecracker_orchestrator_sha256 }}' \
-            --firecracker-gateway-version '${{ inputs.firecracker_gateway_version }}' \
-            --firecracker-gateway-sha256 '${{ inputs.firecracker_gateway_sha256 }}' \
-            --output release-manifest.json
-
-      - name: Build package with assigned infrastructure pins
-        env:
-          BOT_BOTTLE_RELEASE_MANIFEST: ${{ github.workspace }}/release-manifest.json
-        run: python3 -m build --wheel
-
-      - name: Verify packaged manifest
-        run: |
-          test "$(find dist -maxdepth 1 -name '*.whl' -type f | wc -l)" -eq 1
-          python3 -m venv verify-venv
-          verify-venv/bin/pip install --no-deps dist/*.whl
-          verify-venv/bin/python -c \
-            'from bot_bottle.release_manifest import load_manifest; print(load_manifest())'
-
-      - name: Publish immutable commit bundle
-        env:
-          BOT_BOTTLE_RELEASE_TOKEN: ${{ secrets.BOT_BOTTLE_RELEASE_TOKEN }}
-        run: |
-          wheel="$(find dist -maxdepth 1 -name '*.whl' -type f)"
-          python3 scripts/generate_release_bundle.py \
-            --manifest release-manifest.json \
-            --wheel "$wheel" \
-            --workflow-run "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
-            --published-at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
-            --output bundle-index.json \
-            --publish
-
-      - name: Upload verified release bundle receipt
-        uses: actions/upload-artifact@v3
-        with:
-          name: bot-bottle-release
-          path: |
-            dist/*.whl
-            bundle-index.json

.gitea/workflows/pre-release-test.yml

@@ -19,6 +19,19 @@ name: pre-release-test
 
 on:
   workflow_dispatch:
+    inputs:
+      ref:
+        description: Revision to qualify
+        required: false
+        default: main
+  workflow_call:
+    inputs:
+      ref:
+        required: true
+        type: string
+    secrets:
+      BOT_BOTTLE_INFRA_ARTIFACT_TOKEN:
+        required: true
 
 jobs:
   unit:
@@ -26,6 +39,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
 
       # No actions/setup-python: the runner image already ships Python 3.12,
       # and older act_runner engines mishandle setup-python's PATH (coverage
@@ -66,6 +81,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
 
       # No actions/setup-python (see the note in the `unit` job); the
       # container's system Python 3.12 runs the stdlib test suite directly.
@@ -138,10 +155,11 @@ jobs:
   # the old build-infra → integration-firecracker + coverage chain incurred.
   integration-firecracker:
     runs-on: [self-hosted, kvm]
-    if: github.event_name == 'workflow_dispatch'
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
 
       - name: Preflight — Firecracker host is ready
         run: |
@@ -212,13 +230,14 @@ jobs:
   # Python >=3.11 with `coverage` importable on the launchd service PATH.
   integration-macos:
     runs-on: [self-hosted, macos]
-    if: github.event_name == 'workflow_dispatch'
     concurrency:
       group: integration-macos-infra
       cancel-in-progress: false
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
 
       # Fail loudly if the backend this job promises isn't actually usable,
       # rather than letting every test silently `unittest.skip` and the job go
@@ -290,6 +309,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
+          ref: ${{ inputs.ref }}
           fetch-depth: 0
 
       - name: Install coverage
@@ -340,6 +360,8 @@ jobs:
     steps:
       - name: Checkout the tested revision
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
 
       - name: Download the tested rootfs
         uses: actions/download-artifact@v3

.gitea/workflows/publish-artifacts.yml

@@ -0,0 +1,189 @@
+name: publish-artifacts
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Branch, tag, or commit to publish
+        required: true
+        default: main
+  workflow_call:
+    inputs:
+      ref:
+        required: true
+        type: string
+    outputs:
+      source_commit:
+        description: Published immutable source commit
+        value: ${{ jobs.resolve.outputs.sha }}
+    secrets:
+      BOT_BOTTLE_RELEASE_TOKEN:
+        required: true
+      BOT_BOTTLE_INFRA_ARTIFACT_TOKEN:
+        required: true
+
+concurrency:
+  group: publish-artifacts-${{ inputs.ref }}
+  cancel-in-progress: false
+
+jobs:
+  resolve:
+    runs-on: ubuntu-latest
+    outputs:
+      sha: ${{ steps.revision.outputs.sha }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
+          fetch-depth: 0
+      - id: revision
+        name: Resolve the immutable source revision
+        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+  oci:
+    needs: resolve
+    runs-on: ubuntu-latest
+    outputs:
+      orchestrator: ${{ steps.images.outputs.orchestrator }}
+      gateway: ${{ steps.images.outputs.gateway }}
+      agent_claude: ${{ steps.images.outputs.agent_claude }}
+      agent_codex: ${{ steps.images.outputs.agent_codex }}
+      agent_pi: ${{ steps.images.outputs.agent_pi }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.resolve.outputs.sha }}
+      - name: Log in to the package registry
+        uses: docker/login-action@v3
+        with:
+          registry: gitea.dideric.is
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.BOT_BOTTLE_RELEASE_TOKEN }}
+      - name: Set up multi-architecture builds
+        uses: docker/setup-buildx-action@v3
+      - id: images
+        name: Build, smoke-test, and publish OCI images
+        run: |
+          set -euo pipefail
+          python_base=$(python3 -c \
+            'import json; print(json.load(open("image-build-args.json"))["PYTHON_BASE_IMAGE"])')
+          node_base=$(python3 -c \
+            'import json; print(json.load(open("image-build-args.json"))["NODE_BASE_IMAGE"])')
+          sha='${{ needs.resolve.outputs.sha }}'
+          registry=gitea.dideric.is/didericis
+
+          build_image() {
+            key=$1
+            name=$2
+            dockerfile=$3
+            build_arg=$4
+            smoke=$5
+            local_ref="bot-bottle-${name}:candidate"
+            remote_ref="${registry}/bot-bottle-${name}:commit-${sha}"
+            docker build --build-arg "$build_arg" -t "$local_ref" \
+              -f "$dockerfile" .
+            smoke_command=$(printf "$smoke" "$local_ref")
+            sh -c "docker run --rm $smoke_command"
+            docker buildx build --platform linux/amd64,linux/arm64 \
+              --build-arg "$build_arg" --push --iidfile "${key}.iid" \
+              -t "$remote_ref" -f "$dockerfile" .
+            digest=$(cat "${key}.iid")
+            case "$digest" in sha256:*) ;; *) exit 1 ;; esac
+            echo "${key}=${registry}/bot-bottle-${name}@${digest}" \
+              >> "$GITHUB_OUTPUT"
+          }
+
+          build_image orchestrator orchestrator Dockerfile.orchestrator \
+            "PYTHON_BASE_IMAGE=$python_base" \
+            "--entrypoint python3 %s -c 'import bot_bottle.orchestrator'"
+          build_image gateway gateway Dockerfile.gateway \
+            "PYTHON_BASE_IMAGE=$python_base" \
+            "--entrypoint mitmdump %s --version"
+          build_image agent_claude claude bot_bottle/contrib/claude/Dockerfile \
+            "NODE_BASE_IMAGE=$node_base" "%s claude --version"
+          build_image agent_codex codex bot_bottle/contrib/codex/Dockerfile \
+            "NODE_BASE_IMAGE=$node_base" "%s codex --version"
+          build_image agent_pi pi bot_bottle/contrib/pi/Dockerfile \
+            "NODE_BASE_IMAGE=$node_base" "%s pi --version"
+
+  firecracker:
+    needs: resolve
+    runs-on: [self-hosted, kvm]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.resolve.outputs.sha }}
+      - name: Build and smoke-test Firecracker artifacts
+        env:
+          BOT_BOTTLE_FC_DROPBEAR: /var/cache/bot-bottle-fc/dropbear
+        run: |
+          python3 cli.py backend status --backend=firecracker
+          python3 -m bot_bottle.backend.firecracker.publish_infra \
+            --output infra-candidate --reuse-published
+          BOT_BOTTLE_INFRA_ARTIFACT_DIR="$PWD/infra-candidate" \
+            python3 -m unittest discover -t . -s tests/integration -v
+      - name: Publish tested Firecracker artifacts
+        env:
+          BOT_BOTTLE_INFRA_ARTIFACT_TOKEN: ${{ secrets.BOT_BOTTLE_INFRA_ARTIFACT_TOKEN }}
+          BOT_BOTTLE_FC_DROPBEAR: /var/cache/bot-bottle-fc/dropbear
+        run: |
+          python3 -m bot_bottle.backend.firecracker.publish_infra \
+            --publish-dir infra-candidate
+      - name: Record Firecracker artifact identities
+        run: |
+          cp infra-candidate/orchestrator/version.txt fc-orchestrator-version
+          cp infra-candidate/orchestrator/rootfs.ext4.gz.sha256 fc-orchestrator-sha
+          cp infra-candidate/gateway/version.txt fc-gateway-version
+          cp infra-candidate/gateway/rootfs.ext4.gz.sha256 fc-gateway-sha
+      - uses: actions/upload-artifact@v3
+        with:
+          name: firecracker-identities
+          path: |
+            fc-orchestrator-version
+            fc-orchestrator-sha
+            fc-gateway-version
+            fc-gateway-sha
+
+  package:
+    needs: [resolve, oci, firecracker]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.resolve.outputs.sha }}
+      - uses: actions/download-artifact@v3
+        with:
+          name: firecracker-identities
+      - name: Build the wheel with the published identities
+        run: |
+          python3 -m pip install --break-system-packages build
+          python3 scripts/generate_release_manifest.py \
+            --source-commit '${{ needs.resolve.outputs.sha }}' \
+            --orchestrator-image '${{ needs.oci.outputs.orchestrator }}' \
+            --gateway-image '${{ needs.oci.outputs.gateway }}' \
+            --agent-claude-image '${{ needs.oci.outputs.agent_claude }}' \
+            --agent-codex-image '${{ needs.oci.outputs.agent_codex }}' \
+            --agent-pi-image '${{ needs.oci.outputs.agent_pi }}' \
+            --firecracker-orchestrator-version "$(cat fc-orchestrator-version)" \
+            --firecracker-orchestrator-sha256 "$(awk '{print $1}' fc-orchestrator-sha)" \
+            --firecracker-gateway-version "$(cat fc-gateway-version)" \
+            --firecracker-gateway-sha256 "$(awk '{print $1}' fc-gateway-sha)" \
+            --output release-manifest.json
+          BOT_BOTTLE_RELEASE_MANIFEST="$PWD/release-manifest.json" \
+            python3 -m build --wheel
+      - name: Verify and publish the immutable commit bundle
+        env:
+          BOT_BOTTLE_RELEASE_TOKEN: ${{ secrets.BOT_BOTTLE_RELEASE_TOKEN }}
+        run: |
+          wheel=$(find dist -maxdepth 1 -name '*.whl' -type f)
+          python3 -m venv verify-venv
+          verify-venv/bin/pip install --no-deps "$wheel"
+          verify-venv/bin/python -c \
+            'from bot_bottle.release_manifest import load_manifest; load_manifest()'
+          python3 scripts/generate_release_bundle.py \
+            --manifest release-manifest.json \
+            --wheel "$wheel" \
+            --workflow-run \
+              "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
+            --published-at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+            --output bundle-index.json --publish

.gitea/workflows/release.yml

@@ -0,0 +1,93 @@
+name: release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+concurrency:
+  group: release-${{ github.ref_name }}
+  cancel-in-progress: false
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    outputs:
+      sha: ${{ steps.release.outputs.sha }}
+      tag: ${{ steps.release.outputs.tag }}
+      channel: ${{ steps.release.outputs.channel }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - id: release
+        name: Validate tag shape and promotion branch
+        run: |
+          set -euo pipefail
+          tag=${GITHUB_REF#refs/tags/}
+          channel=$(python3 -c \
+            'import sys; from bot_bottle.release_qualification import release_channel; print(release_channel(sys.argv[1]))' \
+            "$tag")
+          branch=$channel
+          git fetch origin "$branch"
+          sha=$(git rev-list -n 1 "$tag")
+          git merge-base --is-ancestor "$sha" "origin/$branch" || {
+            echo "$tag is not reachable from protected $branch" >&2
+            exit 1
+          }
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "channel=$channel" >> "$GITHUB_OUTPUT"
+
+  qualify:
+    needs: validate
+    uses: ./.gitea/workflows/pre-release-test.yml
+    with:
+      ref: ${{ needs.validate.outputs.sha }}
+    secrets:
+      BOT_BOTTLE_INFRA_ARTIFACT_TOKEN: ${{ secrets.BOT_BOTTLE_INFRA_ARTIFACT_TOKEN }}
+
+  artifacts:
+    needs: [validate, qualify]
+    uses: ./.gitea/workflows/publish-artifacts.yml
+    with:
+      ref: ${{ needs.validate.outputs.sha }}
+    secrets:
+      BOT_BOTTLE_RELEASE_TOKEN: ${{ secrets.BOT_BOTTLE_RELEASE_TOKEN }}
+      BOT_BOTTLE_INFRA_ARTIFACT_TOKEN: ${{ secrets.BOT_BOTTLE_INFRA_ARTIFACT_TOKEN }}
+
+  promote:
+    needs: [validate, artifacts]
+    runs-on: ubuntu-latest
+    concurrency:
+      group: release-channel-${{ needs.validate.outputs.channel }}
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.validate.outputs.sha }}
+      - name: Verify install from the published bundle
+        env:
+          BOT_BOTTLE_REF: ${{ needs.validate.outputs.sha }}
+        run: |
+          sh install.sh
+          bot-bottle --help
+      - name: Publish release qualification and advance channel
+        env:
+          BOT_BOTTLE_RELEASE_TOKEN: ${{ secrets.BOT_BOTTLE_RELEASE_TOKEN }}
+        run: |
+          python3 scripts/publish_release_qualification.py \
+            --tag '${{ needs.validate.outputs.tag }}' \
+            --source-commit '${{ needs.validate.outputs.sha }}' \
+            --workflow-run \
+              "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
+            --qualified-at "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+      - name: Create the Gitea release
+        env:
+          GITEA_TOKEN: ${{ secrets.BOT_BOTTLE_RELEASE_TOKEN }}
+        run: |
+          curl --fail-with-body --silent --show-error \
+            -H "Authorization: token $GITEA_TOKEN" \
+            -H "Content-Type: application/json" \
+            -d "{\"tag_name\":\"${{ needs.validate.outputs.tag }}\",\"name\":\"${{ needs.validate.outputs.tag }}\",\"target_commitish\":\"${{ needs.validate.outputs.sha }}\"}" \
+            "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases"