feat(release): add verified image publication pipeline

2026-08-15 14:52:01 +09:00
parent f7b33784ab
commit fd080496b3
47 changed files with 907 additions and 22 deletions
@@ -0,0 +1,101 @@
+name: Publish verified PortfolioHub image
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Reject every event except a strict version tag push
+        env:
+          RELEASE_EVENT: ${{ github.event_name }}
+          RELEASE_REF: ${{ github.ref }}
+          RELEASE_SHA: ${{ github.sha }}
+        run: |
+          python - <<'PY'
+          import os, re
+          assert os.environ["RELEASE_EVENT"] == "push"
+          assert re.fullmatch(r"refs/tags/v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)", os.environ["RELEASE_REF"])
+          assert re.fullmatch(r"[0-9a-f]{40}", os.environ["RELEASE_SHA"])
+          PY
+      - name: Check out exact tagged source commit
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 1
+      - run: python scripts/image_release.py validate-checkout --actual "$(git rev-parse HEAD)" --expected "${GITHUB_SHA}"
+      - run: python scripts/image_release.py validate-event --event "${GITHUB_EVENT_NAME}" --ref "${GITHUB_REF}" --commit "${GITHUB_SHA}"
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - run: python -m pip install "uv==0.11.14"
+      - run: uv sync --extra dev --locked
+      - run: uv run pytest -q
+      - name: Honest scoped lint
+        run: uv run ruff check --select F,I app/db/migrations.py scripts/image_release.py tests/release
+      - name: Record exact source migration inventory
+        run: uv run python -c 'from app.db.migrations import migration_inventory; print("\n".join(migration_inventory()))' > migration-inventory.txt
+      - name: Create excluded synthetic canary
+        run: printf '%s\n' 'PORTFOLIO_HUB_SECRET_CANARY_DO_NOT_SHIP' > .env.ci-canary
+      - name: Build exact source image once
+        run: docker build --provenance=false --build-arg "SOURCE_COMMIT=${GITHUB_SHA}" --tag "portfolio-hub-ci:${GITHUB_SHA}" .
+      - name: Smoke installed payload, health, migration and isolated PostgreSQL
+        run: python scripts/image_release.py smoke --image "portfolio-hub-ci:${GITHUB_SHA}" --inventory migration-inventory.txt --timeout 180
+      - name: Record tested image ID
+        run: python scripts/image_release.py record-image-id --image "portfolio-hub-ci:${GITHUB_SHA}" --output portfolio-hub-image.id
+      - name: Export tested image without rebuilding
+        run: docker save --output portfolio-hub-image.tar "portfolio-hub-ci:${GITHUB_SHA}"
+      - name: Scan filesystem, history, inspect, archive metadata and outputs
+        run: |
+          set +e
+          python scripts/image_release.py scan --image "portfolio-hub-ci:${GITHUB_SHA}" --archive portfolio-hub-image.tar >canary-scan.stdout 2>canary-scan.stderr
+          scan_status=$?
+          set -e
+          python scripts/image_release.py assert-clean-output canary-scan.stdout canary-scan.stderr
+          exit "${scan_status}"
+      - run: python scripts/image_release.py checksum --archive portfolio-hub-image.tar --output portfolio-hub-image.tar.sha256
+      - uses: actions/upload-artifact@v4
+        with:
+          name: tested-image-${{ github.run_id }}-${{ github.run_attempt }}
+          if-no-files-found: error
+          retention-days: 7
+          path: |
+            portfolio-hub-image.tar
+            portfolio-hub-image.tar.sha256
+            portfolio-hub-image.id
+            migration-inventory.txt
+            scripts/image_release.py
+
+  publish:
+    needs: verify
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: tested-image-${{ github.run_id }}-${{ github.run_attempt }}
+          path: tested-image
+      - name: Load same archive, tag and publish without rebuilding
+        id: publish
+        env:
+          GITHUB_ACTOR: ${{ github.actor }}
+          REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          python tested-image/scripts/image_release.py publish \
+            --archive tested-image/portfolio-hub-image.tar \
+            --checksum tested-image/portfolio-hub-image.tar.sha256 \
+            --image-id tested-image/portfolio-hub-image.id \
+            --local-image "portfolio-hub-ci:${GITHUB_SHA}" \
+            --commit "${GITHUB_SHA}" --event "${GITHUB_EVENT_NAME}" --ref "${GITHUB_REF}"
@@ -0,0 +1,27 @@
+name: Verify container release contracts
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - run: python -m pip install "uv==0.11.14"
+      - run: uv sync --extra dev --locked
+      - run: uv run pytest -q
+      - name: Honest scoped lint for release additions
+        run: uv run ruff check --select F,I app/db/migrations.py scripts/image_release.py tests/release
+      - name: Validate container contracts without registry writes
+        run: uv run pytest -q tests/release