Public Access
Emil Simeonov
8cbf148745
Implements: DEVX-165 REQ-1..3 - create_dependency_pr gains --manifest/--verify-container/--source-ref: resolves the producer image's OCI digest via the packages API before opening the PR, then writes structured manifest fields (version/git_ref/image_tag/image_digest/updated_at) in the PR branch - clean_images gains --protect: pinned versions survive --keep trimming so a manifest-referenced digest can't be garbage-collected - regression tests for digest resolution, manifest helpers, verify ordering, and protect filtering
56 lines
1.9 KiB
Markdown
56 lines
1.9 KiB
Markdown
# DEVX-165: Manifest-aware dependency PRs and registry cleanup protection
|
|
|
|
## Problem
|
|
|
|
S03 (OBL-INFRA-548 REQ-3) requires an immutable delivery contract: infra
|
|
pins the sso-bridge release as {version, git ref, image tag, OCI digest}
|
|
in a JSON manifest. Two gaps in devx block that:
|
|
|
|
1. `create_dependency_pr` only regex-bumps a version string in
|
|
pyproject/ansible vars — it cannot update a structured manifest with
|
|
the resolved image digest, and it does not verify the producer
|
|
artifact exists before opening the PR.
|
|
2. `clean_images` deletes all but the newest N tags — a tag/digest that
|
|
infra still pins gets deleted once newer releases land, breaking
|
|
deploys.
|
|
|
|
## Approach
|
|
|
|
REQ-1: `create_dependency_pr` gains `--manifest <path>` +
|
|
`--verify-container <owner/name>`: before opening the PR it resolves the
|
|
container tag's OCI digest via the registry `manifests` API
|
|
(`Docker-Content-Digest`), then updates manifest fields
|
|
`{version, git_ref, image_tag, image_digest, source_commit, updated_at}`
|
|
in the PR branch instead of a regex bump.
|
|
|
|
REQ-2: `clean_images` gains `--protect` (repeatable): named versions are
|
|
never deleted regardless of `--keep` trimming.
|
|
|
|
REQ-3: Regression tests for manifest update, digest resolution,
|
|
verify-then-PR ordering, and protect filtering.
|
|
|
|
## Files Affected
|
|
|
|
- `src/devx/ci/create_dependency_pr.py`
|
|
- `src/devx/tools/clean_images.py`
|
|
- `tests/unit/test_create_dependency_pr.py`
|
|
- `tests/unit/test_clean_images.py`
|
|
|
|
## Test Plan
|
|
|
|
- New unit tests per REQ; `make pytest-cov`, `make lint-all`.
|
|
|
|
## Deploy Plan
|
|
|
|
- Merge → devx release → consumer repos pick up via dependency PRs.
|
|
|
|
## Rollback Plan
|
|
|
|
- Revert; regex version bump and unprotected cleanup return.
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [x] REQ-1: Manifest update + pre-PR OCI digest verification
|
|
- [x] REQ-2: `--protect` exempts versions from cleanup
|
|
- [x] REQ-3: Regression tests added and passing
|