mirror of
https://github.com/block/buzz.git
synced 2026-10-31 14:31:02 +00:00
f249710331
## Why Phase 1 of progressive delivery needs an explicit eligibility boundary before deployment automation can safely consume relay artifacts. Today the canonical Docker workflow can publish independently of the same-SHA CI result, the relay does not expose its source/build identity, and the Helm chart only renders mutable tags. The existing `ghcr.io/block/buzz-staging-dev` workflow in #6709 remains a manual pre-merge preview lane. It is deliberately not a canonical promotion input. ## What changed - Compile the full source SHA and GitHub Actions build identity into canonical relay binaries and expose it at `/_status`. - Gate creation of tagged multi-architecture manifests on the latest exact-SHA `CI` push run succeeding on `main` or `release`. - Preserve the signed SLSA provenance and add a signed, release-only deployment-eligibility predicate with source, build run, qualifying CI run, and exact compatible Buzz chart version. - Keep failed or pending builds untagged and without an eligibility predicate; preview-package artifacts are excluded by package and signer contract. - Add optional `image.digest` support to Buzz chart `0.1.8`, retaining the existing tag fallback. - Document verification and the intentional boundary between image/chart compatibility and backwards-compatible database migrations. ## Risk and rollout Canonical tag publication now waits for same-SHA CI and fails closed when the newest matching run fails. Per-architecture blobs may remain untagged after a failed qualification; they are not promotion inputs. Debug manifests are also CI-gated but do not receive the release eligibility predicate. There are no migration or schema-orchestration changes. The companion BuilderBot infrastructure PR will pin a separately verified canonical main digest and expose a read-only running-deployment inspection command. Signed eligibility is available only for artifacts published after this workflow lands. ## Verification - Blox: workflow contract fixtures, including stale-green rejection and predicate structure - Blox: `actionlint` for `ci.yml` and `docker.yml` - Blox: 46 Helm unit tests, chart lint, and production/quickstart render fixtures - Blox: relay status unit test, workspace Rust formatting, and workspace all-target clippy - Live evidence: exact-SHA CI selector chose successful run `32857345153` for source `9d1e4b257657f382d3111ce748f3da8d063b7671` - Existing canonical digest provenance verified with `gh attestation verify` ## References - #6709 — developer-preview precursor; intentionally separate from canonical eligibility - `docs/deployment-identity.md` *Generated with Codex* --------- Signed-off-by: Luke Tornquist <tornquist@squareup.com>
43 lines
1.2 KiB
YAML
43 lines
1.2 KiB
YAML
apiVersion: v2
|
||
name: buzz
|
||
description: |
|
||
Buzz — a Nostr-based messaging platform for human–agent collaboration.
|
||
|
||
A single relay binary serving WebSocket + REST + web UI, backed by
|
||
PostgreSQL and Redis. Configurable for single-node evaluation
|
||
(subcharts on) and HA production (external services, existingSecret).
|
||
type: application
|
||
version: 0.1.8
|
||
appVersion: "0.1.0"
|
||
home: https://github.com/block/buzz
|
||
sources:
|
||
- https://github.com/block/buzz
|
||
keywords:
|
||
- nostr
|
||
- relay
|
||
- messaging
|
||
- websocket
|
||
- chat
|
||
maintainers:
|
||
- name: Block
|
||
url: https://github.com/block
|
||
annotations:
|
||
artifacthub.io/changes: |
|
||
- kind: added
|
||
description: Optional immutable relay image digest pinning with backwards-compatible tag fallback.
|
||
artifacthub.io/license: Apache-2.0
|
||
|
||
# Optional eval-only subcharts. Production deploys disable both and point
|
||
# externalPostgresql / externalRedis (or secrets.existingSecret) at managed
|
||
# services.
|
||
dependencies:
|
||
- name: postgres
|
||
version: "0.19.x"
|
||
repository: oci://registry-1.docker.io/cloudpirates
|
||
condition: postgresql.enabled
|
||
alias: postgresql
|
||
- name: redis
|
||
version: "0.30.x"
|
||
repository: oci://registry-1.docker.io/cloudpirates
|
||
condition: redis.enabled
|