mirror of
https://github.com/block/buzz.git
synced 2026-10-27 04:30:52 +00:00
f249710331
## Why Phase 1 of progressive delivery needs an explicit eligibility boundary before deployment automation can safely consume relay artifacts. Today the canonical Docker workflow can publish independently of the same-SHA CI result, the relay does not expose its source/build identity, and the Helm chart only renders mutable tags. The existing `ghcr.io/block/buzz-staging-dev` workflow in #6709 remains a manual pre-merge preview lane. It is deliberately not a canonical promotion input. ## What changed - Compile the full source SHA and GitHub Actions build identity into canonical relay binaries and expose it at `/_status`. - Gate creation of tagged multi-architecture manifests on the latest exact-SHA `CI` push run succeeding on `main` or `release`. - Preserve the signed SLSA provenance and add a signed, release-only deployment-eligibility predicate with source, build run, qualifying CI run, and exact compatible Buzz chart version. - Keep failed or pending builds untagged and without an eligibility predicate; preview-package artifacts are excluded by package and signer contract. - Add optional `image.digest` support to Buzz chart `0.1.8`, retaining the existing tag fallback. - Document verification and the intentional boundary between image/chart compatibility and backwards-compatible database migrations. ## Risk and rollout Canonical tag publication now waits for same-SHA CI and fails closed when the newest matching run fails. Per-architecture blobs may remain untagged after a failed qualification; they are not promotion inputs. Debug manifests are also CI-gated but do not receive the release eligibility predicate. There are no migration or schema-orchestration changes. The companion BuilderBot infrastructure PR will pin a separately verified canonical main digest and expose a read-only running-deployment inspection command. Signed eligibility is available only for artifacts published after this workflow lands. ## Verification - Blox: workflow contract fixtures, including stale-green rejection and predicate structure - Blox: `actionlint` for `ci.yml` and `docker.yml` - Blox: 46 Helm unit tests, chart lint, and production/quickstart render fixtures - Blox: relay status unit test, workspace Rust formatting, and workspace all-target clippy - Live evidence: exact-SHA CI selector chose successful run `32857345153` for source `9d1e4b257657f382d3111ce748f3da8d063b7671` - Existing canonical digest provenance verified with `gh attestation verify` ## References - #6709 — developer-preview precursor; intentionally separate from canonical eligibility - `docs/deployment-identity.md` *Generated with Codex* --------- Signed-off-by: Luke Tornquist <tornquist@squareup.com>
69 lines
2.3 KiB
Markdown
69 lines
2.3 KiB
Markdown
# Relay deployment identity
|
|
|
|
Canonical relay images from `ghcr.io/block/buzz` carry two signed
|
|
attestations:
|
|
|
|
- SLSA build provenance maps the immutable image digest to the source commit
|
|
and Docker workflow run.
|
|
- The Buzz deployment-eligibility predicate records the successful same-SHA
|
|
CI run and the exact Buzz Helm chart version from that source commit.
|
|
|
|
The Docker workflow creates tagged multi-architecture manifests only after the
|
|
same full source SHA has a successful `CI` push run on `main` or `release`.
|
|
Architecture-specific build manifests may exist without tags while CI is
|
|
running or after it fails; they do not receive the deployment-eligibility
|
|
predicate and are not promotion inputs.
|
|
|
|
Verify a canonical eligible digest with:
|
|
|
|
```bash
|
|
gh attestation verify \
|
|
oci://ghcr.io/block/buzz@sha256:<digest> \
|
|
--repo block/buzz \
|
|
--signer-workflow block/buzz/.github/workflows/docker.yml \
|
|
--predicate-type https://buzz.block.xyz/attestations/deployment-eligibility/v1 \
|
|
--source-ref refs/heads/main
|
|
```
|
|
|
|
The predicate's `helm_chart.compatible_version` is image-to-chart metadata. It
|
|
does not describe database schema compatibility and does not relax Buzz's rule
|
|
that migrations remain backwards compatible.
|
|
|
|
The manual pre-merge workflow publishes only to
|
|
`ghcr.io/block/buzz-staging-dev`. Those preview images are intentionally
|
|
ineligible: they use a different package, may name non-main source, and do not
|
|
receive the canonical deployment-eligibility predicate.
|
|
|
|
## Runtime inspection
|
|
|
|
The relay health listener exposes intrinsic build identity at `/_status`:
|
|
|
|
```json
|
|
{
|
|
"service": "buzz-relay",
|
|
"version": "0.2.1",
|
|
"uptime_seconds": 123,
|
|
"build": {
|
|
"source_sha": "<40-character-source-sha>",
|
|
"id": "github-actions:<run-id>:<attempt>",
|
|
"url": "https://github.com/block/buzz/actions/runs/<run-id>/attempts/<attempt>"
|
|
}
|
|
}
|
|
```
|
|
|
|
Non-CI builds report stable `unknown` or `local` fallback values instead of
|
|
claiming provenance they do not have.
|
|
|
|
## Helm digest pinning
|
|
|
|
Buzz chart `0.1.8` and newer accept an immutable image digest:
|
|
|
|
```yaml
|
|
image:
|
|
repository: ghcr.io/block/buzz
|
|
digest: sha256:<64-lowercase-hex-characters>
|
|
```
|
|
|
|
When `image.digest` is set, the chart renders `repository@digest` and ignores
|
|
`image.tag`. Existing tag-only values remain backwards compatible.
|