feat(docker-release)!: replace the matrix implementation with stevedore#40
Merged
Conversation
Open
6 tasks
Reusable image build/release via stevedore v0.0.3. The caller passes no service matrix: stevedore reads the repo's .stevedore.yaml, resolves per-service ECR versions, does change detection against per-image refs/releases/image/<id> marker refs (the same ref family docker-release.yml advances; contents: write so it can push them), and groups identical build specs into a single build. Draft: defaults to --no-push; remaining gap vs docker-release.yml is the Dispatch publish notification. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Export STEVEDORE_CACHE_FROM/STEVEDORE_CACHE_TO (one type=gha scope per
calling repo) and re-export the GitHub runtime env via
crazy-max/ghaction-github-runtime so stevedore's shelled-out buildx can
reach the gha cache backend. Configs opt in per image with
'{{ index .Env "STEVEDORE_CACHE_FROM" }}' entries that render empty
outside CI (skipped by stevedore >= v0.0.5, blairham/stevedore#8).
- Bump the action pin + default binary to v0.0.4 (plan/matrix mode).
- Document the single-job-by-design decision (#39):
one runner + one BuildKit means a build-once Dockerfile (trading#1967)
compiles once for all images, even with --parallel; a per-image matrix
fan-out would cold-cache every runner and re-run the shared stage N
times.
Still a draft (no-push defaults true): the remaining publish gap is the
Dispatch notification (blairham/stevedore#6).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
blairham/stevedore#8 merged and released: empty-rendering cache_from/cache_to entries are skipped, so cache-wired configs (pinpredict/trading#1969) build locally without the CI cache env. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The matrix implementation lives on the frozen pre-stevedore tag that every existing caller is pinned to — this replacement breaks the workflow_call contract (no matrix input) for @main only, which is exactly what the pin was minted for. Repos migrate by adding a .stevedore.yaml, dropping the matrix wiring from ci.yml, and pointing uses: back to @main. Carries the draft stevedore workflow's shape: single job by design (#39 — one BuildKit instance so a build-once Dockerfile compiles once for all images, even with --parallel), gha layer cache env (STEVEDORE_CACHE_FROM/TO, one scope per repo, opt-in per config via index-form templates skipped when empty by stevedore >= v0.0.5), and no-push defaulting true until the Dispatch notification gap (blairham/stevedore#6) closes. README + AGENTS.md updated: consumer contract, migration steps, the pre-stevedore exception wording, and the statements that only apply to the frozen matrix implementation (per-service push roles, notify-dispatch, matrix-shape playbook). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
blairham
changed the title
blairham
force-pushed
the
feat/stevedore-release-workflow
branch
from
July 5, 2026 20:55
ac5b075 to
abad819
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #38; rollout plan + merge order in #39. Per review direction: this replaces
docker-release.ymlon main with the stevedore implementation rather than adding a parallel workflow — the@pre-stevedorepin on every existing caller was minted exactly so main could break this contract. No caller is affected until it unpins.What main's
docker-release.ymlbecomesmatrixinput — stevedore reads the caller repo's.stevedore.yaml, resolves ECR versions itself (same highest-X.Y.Z+bump semantics, ECR stays the version record), does change detection against the samerefs/releases/image/<id>marker refs (fetches and advances them itself), and builds only what changed.--parallel 4. A per-image matrix fan-out would cold-cache every runner (~40–50 runner-min vs ~4–5 for trading).STEVEDORE_CACHE_FROM/STEVEDORE_CACHE_TO(onetype=ghascope per calling repo) +crazy-max/ghaction-github-runtimeso stevedore's shelled-out buildx reaches the cache backend. Configs opt in per image (trading#1969); entries render empty and are skipped locally (stevedore v0.0.5, fix(builder): skip cache_from/cache_to entries that render empty blairham/stevedore#8 — merged + released).no-pushdefaultstrueuntil the one remaining behavior gap vs the matrix implementation closes: the Dispatch publish notification (feat: machine-readable release summary of pushed images blairham/stevedore#6). Real publishes stay on the pin until then.Docs kept in sync
README (workflow table row,
pre-stevedoreexception wording, callerci.ymlskeleton) and AGENTS.md (per-service push-role and notify-dispatch statements now scoped to the frozen tag, matrix-shape playbook marked frozen).Notes for reviewers
private-modulesBuildKit-secret input exists only on the pin now; the stevedore configsecrets:block is the replacement when a migrating repo needs it.release-summaryaggregate check name disappears from main (it only ever ran on push, so no required-PR-check impact).🤖 Generated with Claude Code