molecule-ai/molecule-core
44
0
Fork 2
Code Issues 134 Pull Requests 156 Actions Packages Projects Releases Wiki Activity

Phase 3 step 4: build pipeline OCI labels + atomic pin update — internal#229 §X step 4 #554

New Issue
Closed
opened 2026-05-11 19:33:25 +00:00 by hongming · 2 comments
hongming commented 2026-05-11 19:33:25 +00:00
Owner
Copy Link
Copy Source

Parent RFC: internal#229 §X amendment (Phase 2 design).

Implements step 4 of §6 sequencing — build pipeline produces images carrying full provenance + atomically updates the CP pin.

Parallelizable with steps 1 (molecule-controlplane#130) and 2 (operator-config issue). Becomes useful once step 1 ships in log-only mode — the new builds get a green verifier outcome immediately, and the dataset for step 3 (backfill) is bounded to pre-existing pins.

Scope (this tracker issue)

This is the umbrella; expect 2–4 sub-PRs touching workflow YAML in different repos. Each sub-PR is independently reviewable.

PR-1: molecule-ai/molecule-core — .gitea/workflows/publish-workspace-server-image.yml + publish-runtime.yml

Add to the buildx step:

- name: build + label + push
  run: |
    docker buildx build \
      --tag "${REGISTRY}/${REPO}:staging-${GITHUB_SHA}" \                  # FULL 40-char SHA
      --tag "${REGISTRY}/${REPO}:staging-$(date -u +%Y%m%dT%H%M)" \
      --label "org.opencontainers.image.source=https://git.moleculesai.app/molecule-ai/${REPO}" \
      --label "org.opencontainers.image.revision=${GITHUB_SHA}" \
      --label "org.opencontainers.image.created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
      --label "molecule.workflow.run_id=${GITHUB_RUN_ID}" \
      --push .

- name: capture digest + update CP pin atomically
  run: |
    DIGEST=$(docker buildx imagetools inspect "${REGISTRY}/${REPO}:staging-${GITHUB_SHA}" --format '{{.Manifest.Digest}}')
    echo "::notice::published digest=${DIGEST}"
    curl -fSs -X POST \
      -H "Authorization: Bearer ${{ secrets.CP_ADMIN_API_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d "{\"runtime\":\"workspace-server\",\"digest\":\"${DIGEST}\",\"source_sha\":\"${GITHUB_SHA}\"}" \
      "${{ vars.CP_URL }}/cp/admin/runtime-image-pins"

Pre-req on CP side: POST /cp/admin/runtime-image-pins endpoint must accept this payload. Today the table is updated manually. File a sub-issue on molecule-controlplane for this endpoint if it doesn't exist yet.

PR-2: molecule-ai/molecule-ai-workspace-template-* (9 template repos) — .gitea/workflows/publish-image.yml

Same shape, adjusted for template image conventions. Coordinate as one PR per repo or bundle via mirror script. The 9 repos:

  • molecule-ai-workspace-template-claude-code
  • molecule-ai-workspace-template-hermes
  • molecule-ai-workspace-template-langgraph
  • molecule-ai-workspace-template-autogen
  • molecule-ai-workspace-template-codex
  • molecule-ai-workspace-template-crewai
  • molecule-ai-workspace-template-deepagents
  • molecule-ai-workspace-template-gemini-cli
  • molecule-ai-workspace-template-openclaw

PR-3 (sub-issue on molecule-controlplane): POST /cp/admin/runtime-image-pins endpoint that takes {runtime, digest, source_sha} and upserts the row.

Acceptance criteria (DoD)

  1. One full publish→pin cycle on staging:
    • Push a no-op commit to molecule-core/staging
    • Workflow fires, builds image with labels
    • docker buildx imagetools inspect <digest> shows all 4 labels
    • CP runtime_image_pins row updated with new digest + source_sha = commit SHA
    • Trigger redeploy on staging-cplead tenant — CP#130's verifier emits redeploy.verify.reachable (because new image has labels AND SHA resolves on Gitea)
  2. Five-Axis review (security lens: CP_ADMIN_API_TOKEN must come from Gitea secret, not be echoed; CP_URL is a non-secret repo variable)
  3. Per-repo PR template includes link back to this issue + RFC#229 §X

Out of scope

  • Removing :latest tag from publish step — that's step 6 of the RFC sequencing.
  • Backfilling existing pins with source_sha — that's step 3.
  • The CP enforcement-mode flip — that's step 5.

Five-Axis review lens (per sub-PR)

  • Correctness: GITHUB_SHA is the full 40-char from the workflow env (verify in YAML linter). docker buildx imagetools inspect digest format matches what CP stores (sha256:).
  • Security: CP_ADMIN_API_TOKEN exposure on failure logs — pipe through mask: if Gitea Actions supports it; otherwise scope the curl to a step with continue-on-error: false + no extra logging.
  • Architecture: Pipeline-writes-pin is the seam this RFC closes. If a publish succeeds but the pin update fails, the workflow should fail loudly (no silent drift). curl -fSs ensures non-2xx exits non-zero.
  • Performance: Pin update is a single POST; trivial.
  • Readability: The 4 OCI labels follow the OCI image-spec annotations — standard names, no proprietary fields except molecule.workflow.run_id.

DRI: core-devops. Effort estimate: ~1 day across all sub-PRs.

**Parent RFC:** [internal#229 §X amendment](https://git.moleculesai.app/molecule-ai/internal/issues/229#issuecomment-12538) (Phase 2 design). Implements **step 4 of §6 sequencing** — build pipeline produces images carrying full provenance + atomically updates the CP pin. Parallelizable with steps 1 ([molecule-controlplane#130](https://git.moleculesai.app/molecule-ai/molecule-controlplane/issues/130)) and 2 (operator-config issue). Becomes useful once step 1 ships in log-only mode — the new builds get a green verifier outcome immediately, and the dataset for step 3 (backfill) is bounded to pre-existing pins. ## Scope (this tracker issue) This is the umbrella; expect 2–4 sub-PRs touching workflow YAML in different repos. Each sub-PR is independently reviewable. **PR-1: `molecule-ai/molecule-core` — `.gitea/workflows/publish-workspace-server-image.yml` + `publish-runtime.yml`** Add to the `buildx` step: ```yaml - name: build + label + push run: | docker buildx build \ --tag "${REGISTRY}/${REPO}:staging-${GITHUB_SHA}" \ # FULL 40-char SHA --tag "${REGISTRY}/${REPO}:staging-$(date -u +%Y%m%dT%H%M)" \ --label "org.opencontainers.image.source=https://git.moleculesai.app/molecule-ai/${REPO}" \ --label "org.opencontainers.image.revision=${GITHUB_SHA}" \ --label "org.opencontainers.image.created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \ --label "molecule.workflow.run_id=${GITHUB_RUN_ID}" \ --push . - name: capture digest + update CP pin atomically run: | DIGEST=$(docker buildx imagetools inspect "${REGISTRY}/${REPO}:staging-${GITHUB_SHA}" --format '{{.Manifest.Digest}}') echo "::notice::published digest=${DIGEST}" curl -fSs -X POST \ -H "Authorization: Bearer ${{ secrets.CP_ADMIN_API_TOKEN }}" \ -H "Content-Type: application/json" \ -d "{\"runtime\":\"workspace-server\",\"digest\":\"${DIGEST}\",\"source_sha\":\"${GITHUB_SHA}\"}" \ "${{ vars.CP_URL }}/cp/admin/runtime-image-pins" ``` **Pre-req on CP side:** `POST /cp/admin/runtime-image-pins` endpoint must accept this payload. Today the table is updated manually. File a sub-issue on `molecule-controlplane` for this endpoint if it doesn't exist yet. **PR-2: `molecule-ai/molecule-ai-workspace-template-*` (9 template repos) — `.gitea/workflows/publish-image.yml`** Same shape, adjusted for template image conventions. Coordinate as one PR per repo or bundle via mirror script. The 9 repos: - `molecule-ai-workspace-template-claude-code` - `molecule-ai-workspace-template-hermes` - `molecule-ai-workspace-template-langgraph` - `molecule-ai-workspace-template-autogen` - `molecule-ai-workspace-template-codex` - `molecule-ai-workspace-template-crewai` - `molecule-ai-workspace-template-deepagents` - `molecule-ai-workspace-template-gemini-cli` - `molecule-ai-workspace-template-openclaw` **PR-3 (sub-issue on molecule-controlplane):** `POST /cp/admin/runtime-image-pins` endpoint that takes `{runtime, digest, source_sha}` and upserts the row. ## Acceptance criteria (DoD) 1. One full publish→pin cycle on staging: - Push a no-op commit to `molecule-core/staging` - Workflow fires, builds image with labels - `docker buildx imagetools inspect <digest>` shows all 4 labels - CP `runtime_image_pins` row updated with new digest + `source_sha` = commit SHA - Trigger redeploy on `staging-cplead` tenant — CP#130's verifier emits `redeploy.verify.reachable` (because new image has labels AND SHA resolves on Gitea) 2. Five-Axis review (security lens: `CP_ADMIN_API_TOKEN` must come from Gitea secret, not be echoed; `CP_URL` is a non-secret repo variable) 3. Per-repo PR template includes link back to this issue + RFC#229 §X ## Out of scope - Removing `:latest` tag from publish step — that's step 6 of the RFC sequencing. - Backfilling existing pins with `source_sha` — that's step 3. - The CP enforcement-mode flip — that's step 5. ## Five-Axis review lens (per sub-PR) - **Correctness:** `GITHUB_SHA` is the full 40-char from the workflow env (verify in YAML linter). `docker buildx imagetools inspect` digest format matches what CP stores (`sha256:`). - **Security:** `CP_ADMIN_API_TOKEN` exposure on failure logs — pipe through `mask:` if Gitea Actions supports it; otherwise scope the curl to a step with `continue-on-error: false` + no extra logging. - **Architecture:** Pipeline-writes-pin is the seam this RFC closes. If a publish succeeds but the pin update fails, the workflow should fail loudly (no silent drift). `curl -fSs` ensures non-2xx exits non-zero. - **Performance:** Pin update is a single POST; trivial. - **Readability:** The 4 OCI labels follow the [OCI image-spec annotations](https://github.com/opencontainers/image-spec/blob/main/annotations.md) — standard names, no proprietary fields except `molecule.workflow.run_id`. DRI: `core-devops`. Effort estimate: ~1 day across all sub-PRs.
core-devops was assigned by hongming 2026-05-11 19:33:32 +00:00
core-devops commented 2026-05-11 19:56:43 +00:00
Member
Copy Link
Copy Source

PR #559 implements PR-1 (OCI labels + buildx) for both platform and tenant images. Part 2 (atomic CP pin update via POST /cp/admin/runtime-image-pins) remains open — depends on the CP endpoint being available (PR-3 sub-issue on molecule-controlplane).

PR #559 implements PR-1 (OCI labels + buildx) for both platform and tenant images. Part 2 (atomic CP pin update via POST /cp/admin/runtime-image-pins) remains open — depends on the CP endpoint being available (PR-3 sub-issue on molecule-controlplane).
triage-operator added the tier:medium label 2026-05-11 20:20:15 +00:00
core-devops commented 2026-05-11 20:22:06 +00:00
Member
Copy Link
Copy Source

Phase 3 step 4 OCI labels merged in PR #559 (commit 815dc7e1). Closing.

Phase 3 step 4 OCI labels merged in PR #559 (commit 815dc7e1). Closing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/ci
CI/CD pipeline issues
 kind/infrastructure
Infrastructure-related issues
 merge-queue
Ready for serialized Gitea merge queue
 merge-queue-hold
Temporarily hold PR in merge queue
 platform/go
Go platform test issues
 release-blocker
Blocks the staging→main promotion / a release
 release-test
security
test-label-sre
tier:high
High risk per dev-sop §SOP-6 — ceo only, 24h cooldown
 tier:low
Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve
 tier:medium
Medium risk per dev-sop §SOP-6 — managers/ceo can approve
 triage-test
test
No Label tier:medium
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
agent-dev-a agent-dev-b agent-pm app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) hongming hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)
No Assignees core-devops
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#554
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?