From 89d2ba7e82187a8304ee3147dede3bde30764cb4 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 27 Jul 2026 17:14:14 +0000 Subject: [PATCH] feat(release): automate artifact and tag flows --- .gitea/workflows/package-release.yml | 95 ------------- .gitea/workflows/pre-release-test.yml | 26 +++- .gitea/workflows/publish-artifacts.yml | 189 +++++++++++++++++++++++++ .gitea/workflows/release.yml | 93 ++++++++++++ 4 files changed, 306 insertions(+), 97 deletions(-) delete mode 100644 .gitea/workflows/package-release.yml create mode 100644 .gitea/workflows/publish-artifacts.yml create mode 100644 .gitea/workflows/release.yml diff --git a/.gitea/workflows/package-release.yml b/.gitea/workflows/package-release.yml deleted file mode 100644 index 58b7b85a..00000000 --- a/.gitea/workflows/package-release.yml +++ /dev/null @@ -1,95 +0,0 @@ -# Package bot-bottle only after immutable OCI and Firecracker artifacts have -# been published. The inputs are the release boundary: the resulting wheel -# carries these exact identities and production startup never chooses another. - -name: package-release - -on: - workflow_dispatch: - inputs: - orchestrator_image: - description: Digest-pinned orchestrator OCI reference - required: true - gateway_image: - description: Digest-pinned gateway OCI reference - required: true - agent_claude_image: - description: Digest-pinned Claude agent OCI reference - required: true - agent_codex_image: - description: Digest-pinned Codex agent OCI reference - required: true - agent_pi_image: - description: Digest-pinned Pi agent OCI reference - required: true - firecracker_orchestrator_version: - description: Published orchestrator rootfs package version - required: true - firecracker_orchestrator_sha256: - description: SHA-256 of orchestrator rootfs.ext4.gz - required: true - firecracker_gateway_version: - description: Published gateway rootfs package version - required: true - firecracker_gateway_sha256: - description: SHA-256 of gateway rootfs.ext4.gz - required: true - -jobs: - package: - runs-on: ubuntu-latest - steps: - - name: Checkout the release commit - uses: actions/checkout@v4 - - - name: Install package build tooling - run: python3 -m pip install --break-system-packages build - - - name: Generate immutable release manifest - run: | - python3 scripts/generate_release_manifest.py \ - --source-commit "$GITHUB_SHA" \ - --orchestrator-image '${{ inputs.orchestrator_image }}' \ - --gateway-image '${{ inputs.gateway_image }}' \ - --agent-claude-image '${{ inputs.agent_claude_image }}' \ - --agent-codex-image '${{ inputs.agent_codex_image }}' \ - --agent-pi-image '${{ inputs.agent_pi_image }}' \ - --firecracker-orchestrator-version '${{ inputs.firecracker_orchestrator_version }}' \ - --firecracker-orchestrator-sha256 '${{ inputs.firecracker_orchestrator_sha256 }}' \ - --firecracker-gateway-version '${{ inputs.firecracker_gateway_version }}' \ - --firecracker-gateway-sha256 '${{ inputs.firecracker_gateway_sha256 }}' \ - --output release-manifest.json - - - name: Build package with assigned infrastructure pins - env: - BOT_BOTTLE_RELEASE_MANIFEST: ${{ github.workspace }}/release-manifest.json - run: python3 -m build --wheel - - - name: Verify packaged manifest - run: | - test "$(find dist -maxdepth 1 -name '*.whl' -type f | wc -l)" -eq 1 - python3 -m venv verify-venv - verify-venv/bin/pip install --no-deps dist/*.whl - verify-venv/bin/python -c \ - 'from bot_bottle.release_manifest import load_manifest; print(load_manifest())' - - - name: Publish immutable commit bundle - env: - BOT_BOTTLE_RELEASE_TOKEN: ${{ secrets.BOT_BOTTLE_RELEASE_TOKEN }} - run: | - wheel="$(find dist -maxdepth 1 -name '*.whl' -type f)" - python3 scripts/generate_release_bundle.py \ - --manifest release-manifest.json \ - --wheel "$wheel" \ - --workflow-run "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \ - --published-at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \ - --output bundle-index.json \ - --publish - - - name: Upload verified release bundle receipt - uses: actions/upload-artifact@v3 - with: - name: bot-bottle-release - path: | - dist/*.whl - bundle-index.json diff --git a/.gitea/workflows/pre-release-test.yml b/.gitea/workflows/pre-release-test.yml index 4263914f..273e4d1e 100644 --- a/.gitea/workflows/pre-release-test.yml +++ b/.gitea/workflows/pre-release-test.yml @@ -19,6 +19,19 @@ name: pre-release-test on: workflow_dispatch: + inputs: + ref: + description: Revision to qualify + required: false + default: main + workflow_call: + inputs: + ref: + required: true + type: string + secrets: + BOT_BOTTLE_INFRA_ARTIFACT_TOKEN: + required: true jobs: unit: @@ -26,6 +39,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@v4 + with: + ref: ${{ inputs.ref }} # No actions/setup-python: the runner image already ships Python 3.12, # and older act_runner engines mishandle setup-python's PATH (coverage @@ -66,6 +81,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@v4 + with: + ref: ${{ inputs.ref }} # No actions/setup-python (see the note in the `unit` job); the # container's system Python 3.12 runs the stdlib test suite directly. @@ -138,10 +155,11 @@ jobs: # the old build-infra → integration-firecracker + coverage chain incurred. integration-firecracker: runs-on: [self-hosted, kvm] - if: github.event_name == 'workflow_dispatch' steps: - name: Checkout uses: actions/checkout@v4 + with: + ref: ${{ inputs.ref }} - name: Preflight — Firecracker host is ready run: | @@ -212,13 +230,14 @@ jobs: # Python >=3.11 with `coverage` importable on the launchd service PATH. integration-macos: runs-on: [self-hosted, macos] - if: github.event_name == 'workflow_dispatch' concurrency: group: integration-macos-infra cancel-in-progress: false steps: - name: Checkout uses: actions/checkout@v4 + with: + ref: ${{ inputs.ref }} # Fail loudly if the backend this job promises isn't actually usable, # rather than letting every test silently `unittest.skip` and the job go @@ -290,6 +309,7 @@ jobs: - name: Checkout uses: actions/checkout@v4 with: + ref: ${{ inputs.ref }} fetch-depth: 0 - name: Install coverage @@ -340,6 +360,8 @@ jobs: steps: - name: Checkout the tested revision uses: actions/checkout@v4 + with: + ref: ${{ inputs.ref }} - name: Download the tested rootfs uses: actions/download-artifact@v3 diff --git a/.gitea/workflows/publish-artifacts.yml b/.gitea/workflows/publish-artifacts.yml new file mode 100644 index 00000000..50aaa0a6 --- /dev/null +++ b/.gitea/workflows/publish-artifacts.yml @@ -0,0 +1,189 @@ +name: publish-artifacts + +on: + workflow_dispatch: + inputs: + ref: + description: Branch, tag, or commit to publish + required: true + default: main + workflow_call: + inputs: + ref: + required: true + type: string + outputs: + source_commit: + description: Published immutable source commit + value: ${{ jobs.resolve.outputs.sha }} + secrets: + BOT_BOTTLE_RELEASE_TOKEN: + required: true + BOT_BOTTLE_INFRA_ARTIFACT_TOKEN: + required: true + +concurrency: + group: publish-artifacts-${{ inputs.ref }} + cancel-in-progress: false + +jobs: + resolve: + runs-on: ubuntu-latest + outputs: + sha: ${{ steps.revision.outputs.sha }} + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ inputs.ref }} + fetch-depth: 0 + - id: revision + name: Resolve the immutable source revision + run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" + + oci: + needs: resolve + runs-on: ubuntu-latest + outputs: + orchestrator: ${{ steps.images.outputs.orchestrator }} + gateway: ${{ steps.images.outputs.gateway }} + agent_claude: ${{ steps.images.outputs.agent_claude }} + agent_codex: ${{ steps.images.outputs.agent_codex }} + agent_pi: ${{ steps.images.outputs.agent_pi }} + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ needs.resolve.outputs.sha }} + - name: Log in to the package registry + uses: docker/login-action@v3 + with: + registry: gitea.dideric.is + username: ${{ gitea.actor }} + password: ${{ secrets.BOT_BOTTLE_RELEASE_TOKEN }} + - name: Set up multi-architecture builds + uses: docker/setup-buildx-action@v3 + - id: images + name: Build, smoke-test, and publish OCI images + run: | + set -euo pipefail + python_base=$(python3 -c \ + 'import json; print(json.load(open("image-build-args.json"))["PYTHON_BASE_IMAGE"])') + node_base=$(python3 -c \ + 'import json; print(json.load(open("image-build-args.json"))["NODE_BASE_IMAGE"])') + sha='${{ needs.resolve.outputs.sha }}' + registry=gitea.dideric.is/didericis + + build_image() { + key=$1 + name=$2 + dockerfile=$3 + build_arg=$4 + smoke=$5 + local_ref="bot-bottle-${name}:candidate" + remote_ref="${registry}/bot-bottle-${name}:commit-${sha}" + docker build --build-arg "$build_arg" -t "$local_ref" \ + -f "$dockerfile" . + smoke_command=$(printf "$smoke" "$local_ref") + sh -c "docker run --rm $smoke_command" + docker buildx build --platform linux/amd64,linux/arm64 \ + --build-arg "$build_arg" --push --iidfile "${key}.iid" \ + -t "$remote_ref" -f "$dockerfile" . + digest=$(cat "${key}.iid") + case "$digest" in sha256:*) ;; *) exit 1 ;; esac + echo "${key}=${registry}/bot-bottle-${name}@${digest}" \ + >> "$GITHUB_OUTPUT" + } + + build_image orchestrator orchestrator Dockerfile.orchestrator \ + "PYTHON_BASE_IMAGE=$python_base" \ + "--entrypoint python3 %s -c 'import bot_bottle.orchestrator'" + build_image gateway gateway Dockerfile.gateway \ + "PYTHON_BASE_IMAGE=$python_base" \ + "--entrypoint mitmdump %s --version" + build_image agent_claude claude bot_bottle/contrib/claude/Dockerfile \ + "NODE_BASE_IMAGE=$node_base" "%s claude --version" + build_image agent_codex codex bot_bottle/contrib/codex/Dockerfile \ + "NODE_BASE_IMAGE=$node_base" "%s codex --version" + build_image agent_pi pi bot_bottle/contrib/pi/Dockerfile \ + "NODE_BASE_IMAGE=$node_base" "%s pi --version" + + firecracker: + needs: resolve + runs-on: [self-hosted, kvm] + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ needs.resolve.outputs.sha }} + - name: Build and smoke-test Firecracker artifacts + env: + BOT_BOTTLE_FC_DROPBEAR: /var/cache/bot-bottle-fc/dropbear + run: | + python3 cli.py backend status --backend=firecracker + python3 -m bot_bottle.backend.firecracker.publish_infra \ + --output infra-candidate --reuse-published + BOT_BOTTLE_INFRA_ARTIFACT_DIR="$PWD/infra-candidate" \ + python3 -m unittest discover -t . -s tests/integration -v + - name: Publish tested Firecracker artifacts + env: + BOT_BOTTLE_INFRA_ARTIFACT_TOKEN: ${{ secrets.BOT_BOTTLE_INFRA_ARTIFACT_TOKEN }} + BOT_BOTTLE_FC_DROPBEAR: /var/cache/bot-bottle-fc/dropbear + run: | + python3 -m bot_bottle.backend.firecracker.publish_infra \ + --publish-dir infra-candidate + - name: Record Firecracker artifact identities + run: | + cp infra-candidate/orchestrator/version.txt fc-orchestrator-version + cp infra-candidate/orchestrator/rootfs.ext4.gz.sha256 fc-orchestrator-sha + cp infra-candidate/gateway/version.txt fc-gateway-version + cp infra-candidate/gateway/rootfs.ext4.gz.sha256 fc-gateway-sha + - uses: actions/upload-artifact@v3 + with: + name: firecracker-identities + path: | + fc-orchestrator-version + fc-orchestrator-sha + fc-gateway-version + fc-gateway-sha + + package: + needs: [resolve, oci, firecracker] + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ needs.resolve.outputs.sha }} + - uses: actions/download-artifact@v3 + with: + name: firecracker-identities + - name: Build the wheel with the published identities + run: | + python3 -m pip install --break-system-packages build + python3 scripts/generate_release_manifest.py \ + --source-commit '${{ needs.resolve.outputs.sha }}' \ + --orchestrator-image '${{ needs.oci.outputs.orchestrator }}' \ + --gateway-image '${{ needs.oci.outputs.gateway }}' \ + --agent-claude-image '${{ needs.oci.outputs.agent_claude }}' \ + --agent-codex-image '${{ needs.oci.outputs.agent_codex }}' \ + --agent-pi-image '${{ needs.oci.outputs.agent_pi }}' \ + --firecracker-orchestrator-version "$(cat fc-orchestrator-version)" \ + --firecracker-orchestrator-sha256 "$(awk '{print $1}' fc-orchestrator-sha)" \ + --firecracker-gateway-version "$(cat fc-gateway-version)" \ + --firecracker-gateway-sha256 "$(awk '{print $1}' fc-gateway-sha)" \ + --output release-manifest.json + BOT_BOTTLE_RELEASE_MANIFEST="$PWD/release-manifest.json" \ + python3 -m build --wheel + - name: Verify and publish the immutable commit bundle + env: + BOT_BOTTLE_RELEASE_TOKEN: ${{ secrets.BOT_BOTTLE_RELEASE_TOKEN }} + run: | + wheel=$(find dist -maxdepth 1 -name '*.whl' -type f) + python3 -m venv verify-venv + verify-venv/bin/pip install --no-deps "$wheel" + verify-venv/bin/python -c \ + 'from bot_bottle.release_manifest import load_manifest; load_manifest()' + python3 scripts/generate_release_bundle.py \ + --manifest release-manifest.json \ + --wheel "$wheel" \ + --workflow-run \ + "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \ + --published-at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \ + --output bundle-index.json --publish diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml new file mode 100644 index 00000000..47c937aa --- /dev/null +++ b/.gitea/workflows/release.yml @@ -0,0 +1,93 @@ +name: release + +on: + push: + tags: + - "v*" + +concurrency: + group: release-${{ github.ref_name }} + cancel-in-progress: false + +jobs: + validate: + runs-on: ubuntu-latest + outputs: + sha: ${{ steps.release.outputs.sha }} + tag: ${{ steps.release.outputs.tag }} + channel: ${{ steps.release.outputs.channel }} + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + - id: release + name: Validate tag shape and promotion branch + run: | + set -euo pipefail + tag=${GITHUB_REF#refs/tags/} + channel=$(python3 -c \ + 'import sys; from bot_bottle.release_qualification import release_channel; print(release_channel(sys.argv[1]))' \ + "$tag") + branch=$channel + git fetch origin "$branch" + sha=$(git rev-list -n 1 "$tag") + git merge-base --is-ancestor "$sha" "origin/$branch" || { + echo "$tag is not reachable from protected $branch" >&2 + exit 1 + } + echo "sha=$sha" >> "$GITHUB_OUTPUT" + echo "tag=$tag" >> "$GITHUB_OUTPUT" + echo "channel=$channel" >> "$GITHUB_OUTPUT" + + qualify: + needs: validate + uses: ./.gitea/workflows/pre-release-test.yml + with: + ref: ${{ needs.validate.outputs.sha }} + secrets: + BOT_BOTTLE_INFRA_ARTIFACT_TOKEN: ${{ secrets.BOT_BOTTLE_INFRA_ARTIFACT_TOKEN }} + + artifacts: + needs: [validate, qualify] + uses: ./.gitea/workflows/publish-artifacts.yml + with: + ref: ${{ needs.validate.outputs.sha }} + secrets: + BOT_BOTTLE_RELEASE_TOKEN: ${{ secrets.BOT_BOTTLE_RELEASE_TOKEN }} + BOT_BOTTLE_INFRA_ARTIFACT_TOKEN: ${{ secrets.BOT_BOTTLE_INFRA_ARTIFACT_TOKEN }} + + promote: + needs: [validate, artifacts] + runs-on: ubuntu-latest + concurrency: + group: release-channel-${{ needs.validate.outputs.channel }} + cancel-in-progress: false + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ needs.validate.outputs.sha }} + - name: Verify install from the published bundle + env: + BOT_BOTTLE_REF: ${{ needs.validate.outputs.sha }} + run: | + sh install.sh + bot-bottle --help + - name: Publish release qualification and advance channel + env: + BOT_BOTTLE_RELEASE_TOKEN: ${{ secrets.BOT_BOTTLE_RELEASE_TOKEN }} + run: | + python3 scripts/publish_release_qualification.py \ + --tag '${{ needs.validate.outputs.tag }}' \ + --source-commit '${{ needs.validate.outputs.sha }}' \ + --workflow-run \ + "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \ + --qualified-at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" + - name: Create the Gitea release + env: + GITEA_TOKEN: ${{ secrets.BOT_BOTTLE_RELEASE_TOKEN }} + run: | + curl --fail-with-body --silent --show-error \ + -H "Authorization: token $GITEA_TOKEN" \ + -H "Content-Type: application/json" \ + -d "{\"tag_name\":\"${{ needs.validate.outputs.tag }}\",\"name\":\"${{ needs.validate.outputs.tag }}\",\"target_commitish\":\"${{ needs.validate.outputs.sha }}\"}" \ + "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases"