f249710331
## Why Phase 1 of progressive delivery needs an explicit eligibility boundary before deployment automation can safely consume relay artifacts. Today the canonical Docker workflow can publish independently of the same-SHA CI result, the relay does not expose its source/build identity, and the Helm chart only renders mutable tags. The existing `ghcr.io/block/buzz-staging-dev` workflow in #6709 remains a manual pre-merge preview lane. It is deliberately not a canonical promotion input. ## What changed - Compile the full source SHA and GitHub Actions build identity into canonical relay binaries and expose it at `/_status`. - Gate creation of tagged multi-architecture manifests on the latest exact-SHA `CI` push run succeeding on `main` or `release`. - Preserve the signed SLSA provenance and add a signed, release-only deployment-eligibility predicate with source, build run, qualifying CI run, and exact compatible Buzz chart version. - Keep failed or pending builds untagged and without an eligibility predicate; preview-package artifacts are excluded by package and signer contract. - Add optional `image.digest` support to Buzz chart `0.1.8`, retaining the existing tag fallback. - Document verification and the intentional boundary between image/chart compatibility and backwards-compatible database migrations. ## Risk and rollout Canonical tag publication now waits for same-SHA CI and fails closed when the newest matching run fails. Per-architecture blobs may remain untagged after a failed qualification; they are not promotion inputs. Debug manifests are also CI-gated but do not receive the release eligibility predicate. There are no migration or schema-orchestration changes. The companion BuilderBot infrastructure PR will pin a separately verified canonical main digest and expose a read-only running-deployment inspection command. Signed eligibility is available only for artifacts published after this workflow lands. ## Verification - Blox: workflow contract fixtures, including stale-green rejection and predicate structure - Blox: `actionlint` for `ci.yml` and `docker.yml` - Blox: 46 Helm unit tests, chart lint, and production/quickstart render fixtures - Blox: relay status unit test, workspace Rust formatting, and workspace all-target clippy - Live evidence: exact-SHA CI selector chose successful run `32857345153` for source `9d1e4b257657f382d3111ce748f3da8d063b7671` - Existing canonical digest provenance verified with `gh attestation verify` ## References - #6709 — developer-preview precursor; intentionally separate from canonical eligibility - `docs/deployment-identity.md` *Generated with Codex* --------- Signed-off-by: Luke Tornquist <tornquist@squareup.com>
2.3 KiB
Relay deployment identity
Canonical relay images from ghcr.io/block/buzz carry two signed
attestations:
- SLSA build provenance maps the immutable image digest to the source commit and Docker workflow run.
- The Buzz deployment-eligibility predicate records the successful same-SHA CI run and the exact Buzz Helm chart version from that source commit.
The Docker workflow creates tagged multi-architecture manifests only after the
same full source SHA has a successful CI push run on main or release.
Architecture-specific build manifests may exist without tags while CI is
running or after it fails; they do not receive the deployment-eligibility
predicate and are not promotion inputs.
Verify a canonical eligible digest with:
gh attestation verify \
oci://ghcr.io/block/buzz@sha256:<digest> \
--repo block/buzz \
--signer-workflow block/buzz/.github/workflows/docker.yml \
--predicate-type https://buzz.block.xyz/attestations/deployment-eligibility/v1 \
--source-ref refs/heads/main
The predicate's helm_chart.compatible_version is image-to-chart metadata. It
does not describe database schema compatibility and does not relax Buzz's rule
that migrations remain backwards compatible.
The manual pre-merge workflow publishes only to
ghcr.io/block/buzz-staging-dev. Those preview images are intentionally
ineligible: they use a different package, may name non-main source, and do not
receive the canonical deployment-eligibility predicate.
Runtime inspection
The relay health listener exposes intrinsic build identity at /_status:
{
"service": "buzz-relay",
"version": "0.2.1",
"uptime_seconds": 123,
"build": {
"source_sha": "<40-character-source-sha>",
"id": "github-actions:<run-id>:<attempt>",
"url": "https://github.com/block/buzz/actions/runs/<run-id>/attempts/<attempt>"
}
}
Non-CI builds report stable unknown or local fallback values instead of
claiming provenance they do not have.
Helm digest pinning
Buzz chart 0.1.8 and newer accept an immutable image digest:
image:
repository: ghcr.io/block/buzz
digest: sha256:<64-lowercase-hex-characters>
When image.digest is set, the chart renders repository@digest and ignores
image.tag. Existing tag-only values remain backwards compatible.