Repository navigation
The shared gate INSTALLS its upstreams: upstream-seed fetches the sealed publication and hands it to the tester as --seed - #2481
Conversation
…sealed publication and hands it to the tester as --seed
Step 2 of the plugin build contract (Doc/Architecture/PluginBuildContract):
"install my dependencies" — as built artifacts, served by MeshWeaver. The
reusable gate had eight inputs and no way to consume a bake: `stage-repo` copied
the upstream's SOURCE into the mount and the tester recompiled it. Measured
2026-08-27: core passes --seed in 9 places, every plugin repo in 0.
`upstream-seed: plugins` now makes the gate:
1. resolve the framework identity its OWN image resolves — composed exactly as
the tester step composes it, digest-pinned, so the seed is addressed to the
identity that will consume it;
2. assert each upstream has a SEALED publication under that identity
(`_complete` — existence first, fail closed, the publish script's own rule),
and fail RED if not: a gate that silently compiled its upstream is
indistinguishable from one that installed it (BakeSeed's own warning);
3. download the bundles into a seed dir with `framework-mvid.txt` beside them,
mount it read-only, and pass `--seed /seed`. The tester checks the seed
before the mesh boots (usage error, exit 2 — never green) and REFUSES a run
that compiled what it was handed (BakeSeedConsumer.Shortfall).
Reads storage with the same OIDC identity publish-bake writes with, declared the
same way (three optional secrets, id-token: write, a preflight that names what is
missing). Adds `bake-publish-targets` so the gate reads where publish-bake wrote.
Empty upstream-seed is today's behaviour, byte for byte. Runtime depends on core
#2478 (bundles carrying node definitions) — without it the seed stamps nothing
and the Shortfall verdict correctly refuses the run.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Updates the reusable node-repo gate workflow to support “install upstream dependencies” by fetching prebuilt, sealed upstream bundle publications from portal storage and passing them to the tester as a --seed, instead of staging upstream source and recompiling it.
Changes:
- Adds new
workflow_callinputs/secrets to enable upstream bundle seeding (upstream-seed,bake-publish-targets, and Azure OIDC secrets). - Introduces an OIDC-based Azure preflight/login + framework-identity resolution step to fetch sealed upstream publications into a seed directory.
- Mounts the seed read-only into the tester container and passes
--seed /seedwhen present.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| az storage file download-batch --account-name "$account" --share-name "$share" \ | ||
| --source "$share/$dir" --destination "$SEED_DIR" --pattern '*.zip' \ | ||
| --auth-mode login --backup-intent --only-show-errors > /dev/null | ||
| n=$(ls "$SEED_DIR"/*.zip 2>/dev/null | wc -l | tr -d ' ') | ||
| echo "upstream '$src': $n bundle(s) from $account/$share/$dir" | ||
| fetched=$((fetched + n)) |
|
|
Direction change, per maintainer: the Azure-OIDC fetch in this PR is the interim. The target is the mesh verifying GitHub's OIDC identity directly — no secret, a |
…y-key, MeshWeaver#2487) — HTTPS + instance key, no Azure, works on pull_request; the Azure share stays as the fallback mode
|
Registry mode added ( |
Draft until #2478 lands — it works only once published bundles carry node definitions; before that the seed stamps nothing and the tester's
Shortfallverdict correctly refuses the run.Step 2 of the plugin build contract (
Doc/Architecture/PluginBuildContract, on #2478): install my dependencies — as built artifacts, served by MeshWeaver.The gap
The reusable gate had eight inputs and no way to consume a bake.
stage-repocopied the upstream's source into the mount and the tester recompiled it. Measured today: core passes--seedin 9 places, every plugin repo in 0.What
upstream-seed: pluginsdoes_complete, existence-first, fail-closed — the publish script's own rule). Fails red if not: a gate that silently compiled its upstream is indistinguishable from one that installed it, which isBakeSeed's own warning.framework-mvid.txtbeside them, mounts it read-only, passes--seed /seed. The tester checks the seed before the mesh boots (usage error, exit 2 — never green) and refuses a run that compiled what it was handed.Reads storage with the same OIDC identity publish-bake writes with, declared the same way: three optional secrets,
id-token: write, a preflight that names what is missing rather than skipping.Empty
upstream-seedis today's behaviour byte for byte.Verified
steps.*/inputs.*/secrets.*reference resolves to a declaration (the checker caught a phantomsteps.pinon the first pass — fixed to compose the image as the tester step does).bash -nclean on everyrun:.Then, per satellite (one small PR each)
and drop
stage-repo/stage-modules.🤖 Generated with Claude Code