From 94b2713596673d38af86ab4268764adb903e8701 Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Tue, 3 Nov 2026 14:19:37 +0100 Subject: [PATCH 1/2] ci: publish stable protos to buf Signed-off-by: Simon Scatton --- .agents/skills/release-captain/SKILL.md | 5 +++++ .github/workflows/release-publish.yml | 27 +++++++++++++++++++++++++ .github/workflows/release.yml | 1 + CI.md | 12 ++++++++++- buf.yaml | 5 +++-- flake.nix | 1 + 6 files changed, 48 insertions(+), 3 deletions(-) diff --git a/.agents/skills/release-captain/SKILL.md b/.agents/skills/release-captain/SKILL.md index 77fc7f0831..5950a9b08c 100644 --- a/.agents/skills/release-captain/SKILL.md +++ b/.agents/skills/release-captain/SKILL.md @@ -41,6 +41,11 @@ tag, or start a second `Pre-release` run for a tag; it has no concurrency guard. - `Release` (`release.yml`) is dispatched by hand with the stable version. It picks the highest `-pre.N` on `main` whose whole `Pre-release` run passed, creates the stable tag on that commit, and publishes without requalifying. +- Stable releases publish public schemas to `buf.build/openshell/core` with + the release tag as the label; prereleases skip Buf publication. The Buf + repository must exist and Actions must have a `BUF_TOKEN` secret with write + access. A failed Buf push fails the release run; follow Recovery before + rerunning the failed publication job. ## Setup diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index 24190aab68..1d66548d1b 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -36,6 +36,8 @@ on: required: true type: string secrets: + BUF_TOKEN: + required: false SNAPCRAFT_STORE_CREDENTIALS: required: false FERN_TOKEN: @@ -508,6 +510,31 @@ jobs: retention-days: 90 if-no-files-found: error + publish-protos: + name: Publish Protobuf Schemas + needs: release + if: ${{ !inputs.is-prerelease }} + runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + contents: read + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + ref: ${{ inputs.source-sha }} + + - uses: ./.github/actions/setup-nix + + - name: Push release schemas to Buf + env: + BUF_TOKEN: ${{ secrets.BUF_TOKEN }} + SOURCE_CONTROL_URL: ${{ github.server_url }}/${{ github.repository }}/commit/${{ inputs.source-sha }} + run: | + nix shell --inputs-from . nixpkgs#buf -c \ + buf push --exclude-unnamed --label "${RELEASE_TAG}" \ + --source-control-url "${SOURCE_CONTROL_URL}" + publish-snap: name: Publish Snap needs: release diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 15ab451116..417399a505 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -158,6 +158,7 @@ jobs: is-prerelease: false make-latest: ${{ needs.promote.outputs.make-latest == 'true' }} secrets: + BUF_TOKEN: ${{ secrets.BUF_TOKEN }} SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }} FERN_TOKEN: ${{ secrets.FERN_TOKEN }} GITLAB_CI_TRIGGER_TOKEN: ${{ secrets.GITLAB_CI_TRIGGER_TOKEN }} diff --git a/CI.md b/CI.md index 6fe38b9a8b..9f7aae8cde 100644 --- a/CI.md +++ b/CI.md @@ -342,6 +342,16 @@ parallel within the same run, using native job dependencies. Its platform package artifacts are uploaded after versioned images and the chart, so the installer can use them while qualification runs or after it fails. The pre-release snap artifact is published to the `latest/beta` channel. +Stable release publication pushes the public `proto/` module to +`buf.build/openshell/core`, labeled with the release tag (for example, +`v0.1.7`) and linked to the release source commit. Prereleases do not publish +schemas to Buf. +The unnamed storage module under `crates/openshell-server/proto/` is excluded. +Create the `openshell/core` repository in Buf before publishing and configure the +GitHub Actions secret `BUF_TOKEN` with a token that can write to that repository. +Publication runs inside the release workflow so tags created with `GITHUB_TOKEN` +are covered; it does not depend on a separate tag-push event. A failed Buf push +fails publication and can be retried by rerunning the failed job. The implemented `release-tag-v1` profile is an incremental subset of RFC 0014 qualification. Failed checks fail the parent workflow and retain evidence in Actions. @@ -691,7 +701,7 @@ These workflows run after merge to publish dev/tagged artifacts and verify them. | `.github/workflows/release-auto-tag.yml` | Weekdays at 14:00 Europe/Zurich, tags the next `-pre.N` on `main` when commits landed since the latest one, then dispatches Pre-release. It skips when the train has no `-pre.1` or its version is already stable, so push each train's `-pre.1` tag by hand. | | `.github/workflows/release-prerelease.yml` | Pre-release orchestrator, triggered by prerelease tag pushes or dispatched by Release Auto-Tag or manually. A tagless dispatch creates the next candidate on its branch; explicit tags select existing candidates. Builds, then publishes and qualifies in parallel. Qualification failure fails the run and sends the failure notification; published artifacts remain available. | | `.github/workflows/release-build.yml` | Shared version computation, binary and image builds, and package builds. Validates that the tag matches the caller's release kind. | -| `.github/workflows/release-publish.yml` | Shared artifact assembly, OCI image tags and Helm chart publication, and package publication. Stable releases also publish to GitHub Releases, snap, npm, PyPI, and Fern. | +| `.github/workflows/release-publish.yml` | Shared artifact assembly, OCI image tags and Helm chart publication, and package publication. Stable releases also publish release-labeled public schemas to Buf (`BUF_TOKEN` required), GitHub Releases, snap, npm, PyPI, and Fern. | | `.github/workflows/release-notes.yml` | Shared prompt-driven release notes generation through Inference Hub, used by prerelease previews, notes-only previews, and stable releases. Stable releases reuse the promoted prerelease's preview when available. | | `.github/workflows/release-qualification.yml` | Reusable qualification suites and result aggregation. Runs security scans, conformance and feature integration, Docker and VM E2E, protobuf compatibility, and advisory compatibility review. | | `.github/workflows/snap-package.yml` | Builds snap and component artifacts for Release Dev, Release, and Pre-release without Store credentials or publication. | diff --git a/buf.yaml b/buf.yaml index 77fde36564..4d6ac0b4de 100644 --- a/buf.yaml +++ b/buf.yaml @@ -1,14 +1,15 @@ # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. # SPDX-License-Identifier: Apache-2.0 -# Repo-level buf module. Declares proto/ as the single module so buf generate, +# Repo-level buf workspace. Declares public and storage modules so buf generate, # buf lint, buf breaking, and the editor LSP all resolve imports the same way. # Code generation lives with each consumer (see sdk/go/buf.gen.yaml, -# sdk/typescript/buf.gen.yaml); this file owns the module boundary and proto +# sdk/typescript/buf.gen.yaml); this file owns the module boundaries and proto # validation policy. version: v2 modules: - path: proto + name: buf.build/openshell/core - path: crates/openshell-server/proto lint: use: diff --git a/flake.nix b/flake.nix index 83197ebd5b..82cba67632 100644 --- a/flake.nix +++ b/flake.nix @@ -74,6 +74,7 @@ yq-go zizmor zstd + buf ]; commonDevShell = { packages = [ rustToolchain ] ++ commonDevShellPackages; From 73a48cff9ad43da74ec6ba60541fe362c8f03185 Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Tue, 3 Nov 2026 14:22:34 +0100 Subject: [PATCH 2/2] ci: scope buf push to public protos Signed-off-by: Simon Scatton --- .github/workflows/release-publish.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index 1d66548d1b..3187555d28 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -531,8 +531,8 @@ jobs: BUF_TOKEN: ${{ secrets.BUF_TOKEN }} SOURCE_CONTROL_URL: ${{ github.server_url }}/${{ github.repository }}/commit/${{ inputs.source-sha }} run: | - nix shell --inputs-from . nixpkgs#buf -c \ - buf push --exclude-unnamed --label "${RELEASE_TAG}" \ + nix develop -c \ + buf push proto --label "${RELEASE_TAG}" \ --source-control-url "${SOURCE_CONTROL_URL}" publish-snap: