DEVX-165: Manifest-aware dependency PRs and registry cleanup protection

Problem

S03 (OBL-INFRA-548 REQ-3) requires an immutable delivery contract: infra pins the sso-bridge release as {version, git ref, image tag, OCI digest} in a JSON manifest. Two gaps in devx block that:

create_dependency_pr only regex-bumps a version string in pyproject/ansible vars — it cannot update a structured manifest with the resolved image digest, and it does not verify the producer artifact exists before opening the PR.
clean_images deletes all but the newest N tags — a tag/digest that infra still pins gets deleted once newer releases land, breaking deploys.

Approach

REQ-1: create_dependency_pr gains --manifest <path> + --verify-container <owner/name> + --container-tag + --source-ref: before opening the PR it resolves the container tag's OCI digest via the packages API (manifest.json blob sha256), then updates manifest fields {version, git_ref, image_tag, image_digest, source_run_id, updated_at} in the PR branch instead of a regex bump. --container-tag decouples the image tag from the release version (sso-bridge images tag __init__.py.__version__, not the git tag).

REQ-1b: create_dependency_pr clones the target repo into a tempdir and performs all file lookups and git operations inside it. Previously it operated on CWD — the producer repo's own checkout — so file updates silently targeted the wrong repo and the whole dep-PR path no-oped behind || echo warning.

REQ-2: clean_images gains --protect (repeatable): named versions are never deleted regardless of --keep trimming.

REQ-3: Regression tests for manifest update, digest resolution, verify-then-PR ordering, and protect filtering.

Files Affected

src/devx/ci/create_dependency_pr.py
src/devx/tools/clean_images.py
tests/unit/test_create_dependency_pr.py
tests/unit/test_clean_images.py

Test Plan

New unit tests per REQ; make pytest-cov, make lint-all.

Deploy Plan

Merge → devx release → consumer repos pick up via dependency PRs.

Rollback Plan

Revert; regex version bump and unprotected cleanup return.

Acceptance Criteria

REQ-1: Manifest update + pre-PR OCI digest verification
REQ-2: --protect exempts versions from cleanup
REQ-3: Regression tests added and passing

2.3 KiB Raw Blame History