Public Access
64 lines
2.3 KiB
Markdown
64 lines
2.3 KiB
Markdown
# DEVX-165: Manifest-aware dependency PRs and registry cleanup protection
|
|
|
|
## Problem
|
|
|
|
S03 (OBL-INFRA-548 REQ-3) requires an immutable delivery contract: infra
|
|
pins the sso-bridge release as {version, git ref, image tag, OCI digest}
|
|
in a JSON manifest. Two gaps in devx block that:
|
|
|
|
1. `create_dependency_pr` only regex-bumps a version string in
|
|
pyproject/ansible vars — it cannot update a structured manifest with
|
|
the resolved image digest, and it does not verify the producer
|
|
artifact exists before opening the PR.
|
|
2. `clean_images` deletes all but the newest N tags — a tag/digest that
|
|
infra still pins gets deleted once newer releases land, breaking
|
|
deploys.
|
|
|
|
## Approach
|
|
|
|
REQ-1: `create_dependency_pr` gains `--manifest <path>` +
|
|
`--verify-container <owner/name>` + `--container-tag` +
|
|
`--source-ref`: before opening the PR it resolves the container tag's
|
|
OCI digest via the packages API (`manifest.json` blob sha256), then
|
|
updates manifest fields `{version, git_ref, image_tag, image_digest,
|
|
source_run_id, updated_at}` in the PR branch instead of a regex bump.
|
|
`--container-tag` decouples the image tag from the release version
|
|
(sso-bridge images tag `__init__.py.__version__`, not the git tag).
|
|
|
|
REQ-1b: `create_dependency_pr` clones the *target* repo into a tempdir
|
|
and performs all file lookups and git operations inside it. Previously
|
|
it operated on CWD — the producer repo's own checkout — so file updates
|
|
silently targeted the wrong repo and the whole dep-PR path no-oped
|
|
behind `|| echo warning`.
|
|
|
|
REQ-2: `clean_images` gains `--protect` (repeatable): named versions are
|
|
never deleted regardless of `--keep` trimming.
|
|
|
|
REQ-3: Regression tests for manifest update, digest resolution,
|
|
verify-then-PR ordering, and protect filtering.
|
|
|
|
## Files Affected
|
|
|
|
- `src/devx/ci/create_dependency_pr.py`
|
|
- `src/devx/tools/clean_images.py`
|
|
- `tests/unit/test_create_dependency_pr.py`
|
|
- `tests/unit/test_clean_images.py`
|
|
|
|
## Test Plan
|
|
|
|
- New unit tests per REQ; `make pytest-cov`, `make lint-all`.
|
|
|
|
## Deploy Plan
|
|
|
|
- Merge → devx release → consumer repos pick up via dependency PRs.
|
|
|
|
## Rollback Plan
|
|
|
|
- Revert; regex version bump and unprotected cleanup return.
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [x] REQ-1: Manifest update + pre-PR OCI digest verification
|
|
- [x] REQ-2: `--protect` exempts versions from cleanup
|
|
- [x] REQ-3: Regression tests added and passing
|