oblachno-oss/devx

Public Access

Fork 0

Files

T

Emil Simeonov 8cbf148745

CI / validate (pull_request) Failing after 49s

Details

CI / auto-merge (pull_request) Skipped

Details

feat(ci): manifest-aware dependency PRs and cleanup protection

Implements: DEVX-165 REQ-1..3

- create_dependency_pr gains --manifest/--verify-container/--source-ref:
  resolves the producer image's OCI digest via the packages API before
  opening the PR, then writes structured manifest fields
  (version/git_ref/image_tag/image_digest/updated_at) in the PR branch
- clean_images gains --protect: pinned versions survive --keep trimming
  so a manifest-referenced digest can't be garbage-collected
- regression tests for digest resolution, manifest helpers, verify
  ordering, and protect filtering

2026-09-19 04:13:11 +02:00

1.9 KiB

Raw Blame History

DEVX-165: Manifest-aware dependency PRs and registry cleanup protection

Problem

S03 (OBL-INFRA-548 REQ-3) requires an immutable delivery contract: infra pins the sso-bridge release as {version, git ref, image tag, OCI digest} in a JSON manifest. Two gaps in devx block that:

create_dependency_pr only regex-bumps a version string in pyproject/ansible vars — it cannot update a structured manifest with the resolved image digest, and it does not verify the producer artifact exists before opening the PR.
clean_images deletes all but the newest N tags — a tag/digest that infra still pins gets deleted once newer releases land, breaking deploys.

Approach

REQ-1: create_dependency_pr gains --manifest <path> + --verify-container <owner/name>: before opening the PR it resolves the container tag's OCI digest via the registry manifests API (Docker-Content-Digest), then updates manifest fields {version, git_ref, image_tag, image_digest, source_commit, updated_at} in the PR branch instead of a regex bump.

REQ-2: clean_images gains --protect (repeatable): named versions are never deleted regardless of --keep trimming.

REQ-3: Regression tests for manifest update, digest resolution, verify-then-PR ordering, and protect filtering.

Files Affected

src/devx/ci/create_dependency_pr.py
src/devx/tools/clean_images.py
tests/unit/test_create_dependency_pr.py
tests/unit/test_clean_images.py

Test Plan

New unit tests per REQ; make pytest-cov, make lint-all.

Deploy Plan

Merge → devx release → consumer repos pick up via dependency PRs.

Rollback Plan

Revert; regex version bump and unprotected cleanup return.

Acceptance Criteria

REQ-1: Manifest update + pre-PR OCI digest verification
REQ-2: --protect exempts versions from cleanup
REQ-3: Regression tests added and passing

1.9 KiB Raw Blame History