Repository navigation
Adopt core v0.18.1's callertoken, image lock, image evidence and publish workflow; delete this repo's copies; release #89
Description
What to do
Adopt core v0.18.1's shared plumbing and delete this repo's copies. Then release the agent.
core#759, released in v0.18.0/v0.18.1, exports one implementation of what this repo and service-warehouse each carry a copy of:
callertoken(new package):UnaryServerInterceptor,StreamServerInterceptor,IsHealthMethod,PerRPCCredentials,DialOption,Generate,CheckListener.resources:ParseImageLock,ImageLock,ErrImageUnpublished,IsSHA256Digest.agents/services/sbom:ImageSubjects,CollectImageEvidence,WriteImageEvidenceIndex,ImageEvidenceDocument,LocalImageID..github/workflows/publish-service-image.yml: aworkflow_callworkflow (inputsimage-name,version,lock-file,platforms; secretregistry-token; outputdigest).
#759's author has already done the adoption in a scratch copy of this repo: +70/−468 lines, including a 77-to-27-line workflow caller, with go build, go vet and go test passing. One unrelated rename had to be bridged: resources.VisibilityExternal → VisibilityPublic.
Behaviour that changes for this repo (state each in the PR)
- Health exemption is exact: only
/grpc.health.v1.Health/Checkand/Watchare exempt.Health/Listnow needs a token. This repo's copy exempted the wholeHealth/prefix. - Empty server token fails closed. This repo never installed interceptors with an empty token, so nothing changes in practice. Confirm it.
- Generated tokens are 64 hex characters, up from 48.
- Image lock parsing is strict:
registry/nameis enforced,sha256:must be lowercase hex, unknown keys (e.g.tag) are refused. - Evidence subjects go through
ExpectedFromImageReference, which refuses a bare tag. Multi-platform declarations get one subject per platform. - The publish workflow checks out with
persist-credentials: falseand refuses a commit not reachable from the default branch.
Steps
codefly agent deps --pin v0.18.1(the CLI verb, not a handgo.modedit; it updates root,base/*and factory template locks). Bridge every API change from this repo's current core pin to v0.18.1.- Replace the copies with the core exports and delete the copies. Switch the image workflow to call
publish-service-image.yml. go build ./... && go vet ./... && go test -race ./..., the repo's CI, and the agent's own release CI (codefly ci run).- One PR. Once it's merged, the coordinator runs
codefly publish patch. Never hand-tag.
Docs updated in the same PR (README / AGENTS.md wherever the token, lock or evidence behaviour is described).
Activity
antoinetoussaint-byte commentedon Oct 11, 2026
lazybox has finished working on this.
claude(Opus 5) held it from 2026-10-11 20:53 UTC until 2026-10-11 21:22 UTC. Theworkinglabel has been removed; this comment is the record.claim detail
antoinetoussaint-byte commentedon Oct 11, 2026
Adoption is ready for review in #90 at
5e3bc8bf8efece3a363773df5f3666b4c1dfd985.codefly agent deps --pin v0.18.1; removed the copied token/auth, gateway lock and image evidence implementations, and switched gateway image publication to core's immutable v0.18.1 workflow commit. README.md and AGENTS.md are updated. The PR lists every requested behavior change and classifies each change as a fix; no hacks.go build ./...,go vet ./...,go mod tidy -diff,go test -race ./...: pass.codefly agent ciwith CLI 0.1.181 passes all six stages, with zero failed/skipped stages: native and Linux/amd64 release binaries, audit, generated-service conformance and source drift included. It ran the requestedcodefly ci run --allin the generated workspace: six tasks passed; only sync-drift was skipped because this agent advertises no Sync capability. Runningcodefly ci runat the agent repo root correctly reports no workspace. Reports are retained in.codefly/agent-ci/{report.json,workspace/report.json}in this workspace.The first clean-tree release build hit a Go-toolchain download TLS timeout; the unchanged full gate passed on retry. The audit records unpatched Moby advisories GO-2026-4883 and GO-2026-4887 under the CLI's existing policy. Live S3, Azure and GCS IAM/Workload Identity, and a live dispatch of the new publisher, were not verified.
No publication, tag or merge was performed. Coordinator: review/merge #90, prepare the next gateway image and adopt its
gateway-image.json-<version>artifact through the reviewed lock flow, then run the CLI release. The existing gateway lock and agent version were left for that release preparation.antoinetoussaint-byte commentedon Oct 11, 2026
Correction to step 4 of this issue: do not run
codefly publish patchimmediately after merging #90. The current gateway lock is built for 0.0.14; publishing first pushes v0.0.15 beforerelease.ymlrefuses that stale lock.Coordinator release sequence:
codefly publish --dry-run(expected next version: 0.0.15).publish-gateway-image.ymlonmainwithversion=0.0.15. Watch this first live reusable-publisher run, including registry push and the image version label.gateway-image.json-0.0.15, commit its contents asgateway-image.jsonin a reviewed PR, and merge that PR.codefly publish patch. Never hand-tag.If the dry run reports another version, use it consistently throughout. Keep gateway code stable between image preparation and publication. If the shared publisher's credential handoff fails, fix it in core and re-pin; do not work around it here.
PR #90 review fixes are pushed at 65315e9: release-workflow pin aligned, reference docs made timeless, stale parser diagnostics corrected. Focused local tests pass and all six CI jobs are green. The PR body's release notes contain the same corrected sequence. No publication, tag or merge was performed.
antoinetoussaint-byte commentedon Oct 11, 2026
PR #92 restores the repository-owned publisher as the owner-approved hack / STOPGAP pending core#770: #92
Head:
aa0b5a8f37fd96d8577e69146216566f3f9790e7. CI run 38157329762 is green: all six jobs passed, including MinIO/GCS-emulator integration, runtime e2e and image evidence. Local build, vet, tidy, race tests, workflow regression tests and actionlint passed.The job comes from
fcd9d9e4~1with all five proven action pins retained. Checkout keepspersist-credentials: false; core v0.18.1's default-branch refusal shell is copied verbatim and runs before login/build. The artifact remainsgateway-image.json-<version>. README.md and AGENTS.md document the stopgap and its replacement by core's planned 0.18.2 composite action. All other #90 adoption stays intact.No merge, dispatch, publish or release tag was performed; a live push remains for the coordinator to verify. The dispatch-only agent conformance suite and generated-workspace
codefly ci runwere not rerun for this workflow-only change. Real S3, GCS/IAM and Azure were not exercised.Coordinator: review and merge #92, run
codefly publish --dry-run(expect 0.0.15), dispatchpublish-gateway-image.ymlon main withversion=0.0.15, adopt itsgateway-image.json-0.0.15artifact asgateway-image.jsonin a reviewed PR, then runcodefly publish patch. The new lock must be merged before publishing the agent.antoinetoussaint-byte commentedon Oct 11, 2026
Released v0.0.15: tag →
8d7076b6(release PR #94), release workflow green, 9 assets (4 platform archives, one SBOM each, checksums). It carries #90 (core v0.18.1's callertoken, image lock and evidence; copies deleted) and #92 (the in-repo publish job, a labelled stopgap pending core#770). Gateway image:ghcr.io/codefly-dev/service-object-storage@sha256:847afa19dc94a3c1f7389efcba31554afc9517f096d282b6c01b51fce324ebbe, locked by #93. Agent CI at publish: 6 passed, 0 failed. Still open: adopting core's composite publish action once core#771 ships in v0.18.2. That will be a separate PR, so this issue can close.fix: publish the gateway image through core's composite action (#95)