Skip to content

Complete the Debian 13 tutorial builder migration#468

Closed
jeremi wants to merge 1 commit into
mainfrom
agent/debian13-boundary-minimal
Closed

Complete the Debian 13 tutorial builder migration#468
jeremi wants to merge 1 commit into
mainfrom
agent/debian13-boundary-minimal

Conversation

@jeremi

@jeremi jeremi commented Jul 24, 2026

Copy link
Copy Markdown
Member

What changed

  • Move the remaining maintained Registryctl tutorial builder from the pinned Bookworm image to the repository's canonical digest-pinned Trixie builder.
  • Add the tutorial script to the existing explicit Debian 13 image contract and reject common Debian 12 and Bookworm spellings in the maintained surfaces already inventoried by that checker.
  • Run the existing contract in every CI changes job and protect that wiring through the gate inventory.
  • Key the tutorial build cache by the builder-bearing script and Cargo.lock, without a fallback that could restore artifacts built under the former base.

Why

This is the deliberately small replacement for #460. Issue #380 requires the remaining maintained image path to move to Debian 13 and a repository guard against accidental Debian 12 reintroduction. It explicitly does not require a generic Docker, shell, or workflow parser.

Validation

  • python3 release/scripts/check-debian13-images.py
  • python3 release/scripts/check-gates-inventory.py
  • python3 -m unittest release/scripts/test_registry_release.py (64 passed)
  • python3 -m unittest release/scripts/test_check_gates_inventory.py (43 passed)
  • Full release script suite (260 passed)
  • Registryctl tutorial helper tests (9 passed)
  • Registryctl tutorial dry run
  • Full Relay and Notary source tutorial journey built from a fresh cache with the pinned Trixie builder
  • actionlint, bash -n, ShellCheck, and git diff --check

Issue status

Progresses #380 but does not close it. Release-candidate scans, vendor PKCS#11 proof, runtime acceptance, Solmara implementer evidence, and lifecycle documentation remain separate closure evidence.

Supersedes #460.

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a0e9313fb3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread .github/workflows/ci.yml
echo "registryctl_tutorial=${registryctl_tutorial}"
} >> "${GITHUB_OUTPUT}"

- name: Check Debian 13 image contract

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Add the missing DCO sign-off

This commit message has no Signed-off-by: trailer (checked with git log -1 --format=%B 1e7986950dcd7d4270d42fff64a5aaa0413881ba), so the repository's DCO requirement will fail even though the workflow and script changes are present. Please recommit or amend with git commit -s before this lands.

AGENTS.md reference: AGENTS.md:L70-L70

Useful? React with 👍 / 👎.

RELAY_TUTORIAL="$SITE_ROOT/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx"
NOTARY_TUTORIAL="$SITE_ROOT/src/content/docs/tutorials/verify-claim-registry-api.mdx"
BUILDER_IMAGE="rust:1.95-bookworm@sha256:4c2fd73ef19c5ef9d54bee03b06b2839a392604fbfcd578ed948b71b37c1d7fb"
BUILDER_IMAGE="rust:1.95-trixie@sha256:f49565f188ee00bc2a18dd418183f2c5f23ef7d6e691890517ed341a598f67c3"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Split this change by owning area

This docs-site tutorial migration is bundled with release/scripts/* contract changes and root CI wiring in the same commit, so the patch crosses at least the docs/site/ and release/ owning areas. Please split the tutorial-builder update from the release/CI guard change, or otherwise get an explicit exception before landing it.

AGENTS.md reference: AGENTS.md:L77-L78

Useful? React with 👍 / 👎.

jeremi commented Jul 24, 2026

Copy link
Copy Markdown
Member Author

Superseded by #469, the single ready integration PR for this reviewed 1.0 batch. This PR's exact head is preserved as an ancestor of #469, so its implementation and commit history are retained; only the merge path has been consolidated.

@jeremi jeremi closed this Jul 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant