Add reusable Core delivery entry points for stable-v1 #122
No reviewers
Labels
No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Homelab/workflows!122
Loading…
Reference in a new issue
No description provided.
Delete branch "kiyi/core-delivery"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Platform Core delivery still embeds the v1.40.0 library checkout, so it cannot adopt promoted scanner and workflow fixes. Add reusable Core and runner-identity entry points for the existing owning manual workflow to call through stable-v1.
The jobs preserve the existing operation choices, core/runner-identity job IDs, deploy runner, CORE_DEPLOY_ACTORS contract, OIDC/OpenBao flow, scan/sign/publication stages, exact signed-archive checks and sanitized evidence. Component contracts and validators remain in Platform. The frozen adapter passes its immutable library SHA to the Core tool selector and receipt checks; the library checkout includes history for retained-release provenance validation.
Validation: 22 Core/channel tests passed under Linux; actual Platform caller inputs/secrets and reusable Bash syntax passed; native Gitleaks 8.30.1 staged scan passed. Hosted CI remains required.
Release/promote these entry points with the next combined workflow release before merging the Platform caller adoption. No workflow was manually dispatched and no Core/init or registry-storage deployment was performed.
Reviewed the exact-head reusable Core and runner-identity workflows, test coverage, and documentation. The entry points preserve the deploy runner and protected-dispatch check before tool installation/credential use; they pin the library checkout to the released ref, pass the resolved library SHA into the owning tools, and keep the Core source/image scan, signed archive verification, OIDC/OpenBao deployment, and sanitized artifact boundaries. This changes workflow orchestration, not UDS runtime gateway/route ownership, manifests, or admission exemptions. No source-level blocker found. Source approval only: the two new workflow contexts are failing for both push and pull_request; the exact-head pull-request runs 7828/7829 report failed jobs 10188/10189, whose log endpoints returned 404, so their root cause and successful reusable-workflow execution remain unverified. Library, acceptance, and repository-security checks are pending. Please investigate the failed run/job scheduling or workflow parsing before merge; retain all required checks and release/promote the entry points before Platform caller adoption. This approval is not CI acceptance or merge authorization.
CI at submission: failure. This is a source-review approval, not a scan verdict; required checks still block merge.
New commits pushed, approval review dismissed automatically according to repository settings
Reviewed current exact-head source for both reusable Core and runner-identity workflows and their focused tests. The deploy jobs keep the owning Platform protected-dispatch guard ahead of tool installation and credential use, bind the released workflows checkout to LIBRARY_SHA, and preserve the Core source/image scanning, signed-bundle publication/recovery checks, OIDC/OpenBao deployment, and sanitized evidence boundaries. This is workflow orchestration; no changed UDS package, gateway/route ownership, policy, or admission resources warrant a new runtime route or exemption. No source-level blocker found at this SHA. This is source approval only: Library checks, Workflow acceptance, and Repository security are pending for this head; successful hosted checks and a released/promoted workflow library remain separate prerequisites to caller adoption/merge. The prior approval was for
bcb1c1547a, not this SHA. No merge authorized.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.
CI follow-up for the current head
72d25f0729: Library checks run 956 (API run 7836), executingtestsjob 10196, failed. Workflow acceptance (954) and Repository security (955) passed on this head. The authenticated log diagnostic slice is truncated and mostly reports scan substeps as “failed or interrupted,” including a ClamAV-installation warning; it does not establish the first failing assertion or whether that warning is the root cause. Kiyi: inspect the complete job log around its first failure/traceback and the final test summary or scan decision; fix the demonstrated cause without weakening fail-closed scans, then re-run Library checks against the resulting exact head. The existing approval (review 1323) is a source-only verdict for this SHA, not CI acceptance; the red Library check blocks merge. No UDS routing, policy, admission, or package-ownership changes were found in the changed workflow/test files.New commits pushed, approval review dismissed automatically according to repository settings
Addressed run 956 and the CI follow-up in review comment 7244 with commit
3f82c58ebf. The complete log ends with 528 tests and three assertion failures: the new Core entry points were missing from the exact release-token consumer and scan-upload inventories, and the runner-identity upload omitted findings.csv. The failing assertions were reproduced locally before the fix.The fix enumerates only the four existing signed-evidence consumer steps, adds both Core workflows to the report inventory, and uploads runner-identity/source-scans/findings.csv alongside its sanitized JSON and summary. No scan, credential gate, required check name, or raw-file exclusion was weakened.
Validation: all 24 focused tests passed; the complete Linux unit suite ran 528 tests with no failures and 20 tool-dependent skips; workflow YAML/Bash validation and all 16 mocked shell cases passed; native Gitleaks 8.30.1 staged scan passed. Fresh hosted checks started from this push, including Library checks run 959. Hosted scans and integration checks remain required before merge.
Reviewed the authenticated exact-head Core and runner-identity reusable workflows, focused contract/reporting tests and changed docs. The fix to the prior Library-check assertions adds the Core steps to the exact release-token consumer inventory, includes both workflows in scan-upload coverage, and adds sanitized runner-identity findings.csv without broadening raw artifact uploads or relaxing the gates. The existing protected-dispatch guard still precedes tool installation and credential use; released-library SHA binding, deploy runner, source/image scans, signed release verification, and OIDC/OpenBao delivery remain intact. These changes orchestrate Core delivery but do not alter UDS manifests, admission/policy, or existing gateway/route ownership; no new routing or exemption is indicated. No source blocker found at this SHA. Source approval only: Workflow acceptance, Repository security, and Library checks remain pending on this head, and hosted results/release promotion remain independent prerequisites before caller adoption or merge. No deployment or merge authorized.
CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.