Repository navigation
feat(ci): add reusable Gradle native image workflow - #42
Merged
Merged
Conversation
9 of 12 tasks
This was referenced Nov 1, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request
Description
Native service builds share one reusable Gradle workflow. Callers select Micro and optionally Distroless and can run their packaged-image contracts before publication. Builds verify non-root runtime identity, source labels and native binary checksums; pull requests never publish images.
Publish standard release tags from the exact verified Native/Micro image: main produces edge and a short SHA, stable vX.Y.Z produces X.Y.Z and latest, prereleases produce only their version. Reject invalid version tags before registry login or publication. Preserve immutable native SHA tags and the optional Distroless comparison target.
Type of Change
Related Issues
No linked issue.
Testing
17 workflow contract tests pass. Shell execution tests cover allowed/invalid targets, BuildKit secret arguments, protected Maven property files and cleanup after both successful and failed hooks. Existing runner routing checks cover public/private repositories and missing payloads. Service image integration remains covered by repository-owned verification hooks.
Risk
This additive workflow runs only for callers. Native compilation needs up to 8 GiB heap; private repositories use the existing 16 GiB runner class. Publication requires successful unit tests, binary checks and any configured runtime contracts. Cold Kotlin compilation receives a 4 GiB Gradle heap inside the existing 16 GiB runner; the native compiler is capped at 8 GiB. Both runtime bases are built together, checksummed, and the exact tested image is published without recompilation. No deployment is performed.
How to revert
Revert this commit and restore affected callers to their prior workflow revision.
Checklist