Skip to content

Publish node images with the job token and correlate Service Manager dispatches - #433

Closed
davidiw wants to merge 2 commits into
m1from
ci/company-ghcr-publish
Closed

davidiw wants to merge 2 commits into
m1from
ci/company-ghcr-publish

Conversation

@davidiw

@davidiw davidiw commented Oct 6, 2026 •

Copy link
Copy Markdown

Summary

  • Log in to GHCR as github.actor with the job's GITHUB_TOKEN in build-versions.yaml and publish-builder-images.yaml. packages: write was already declared. This removes the dependency on the movement-infra-agent personal access token (INFRA_GH_PAT), whose holder is unknown.
  • Label every image with org.opencontainers.image.source and org.opencontainers.image.revision, so GHCR links each package to its repository automatically. A new optional image_source input lets the private mirror keep the shared public packages linked to this repository.
  • Record the pushed manifest digest as a build-container action output and in the job summary, so deployments pin a digest, not a tag.
  • Add an optional request_id dispatch input, shown in the run name, so a Service Manager dispatch can be matched to its run.

Prerequisites (done)

aptos-node, aptos-debugger and aptos-faucet-service each grant this repository and aptos-core-private Actions write access.

Test

Pushing this branch runs build-versions through the new login path. A green run, with images whose summary shows a digest, is the test.

Companion PR: movement-network/aptos-core-private, same branch name. It depends on the image_source input landing on m1 here first.

🤖 Generated with Claude Code


View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.

davidiw and others added 2 commits October 6, 2026 16:44
…dispatches

- Log in to GHCR as github.actor with the job's GITHUB_TOKEN (packages: write
  was already declared) instead of the movement-infra-agent PAT, in
  build-versions and publish-builder-images.
- Label every image with org.opencontainers.image.source/revision so GHCR
  links the package to the building repository automatically.
- Record the pushed manifest digest as an action output and in the summary.
- Add an optional request_id dispatch input shown in the run name, so a
  Service Manager dispatch can be matched to its run (D37).

Requires each package (aptos-node, aptos-debugger, aptos-faucet-service) to
grant this repository Actions write access before the first run.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…epository

Adds an optional image_source input for the source label; it defaults to the
building repository.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@davidiw

davidiw commented Oct 7, 2026

Copy link
Copy Markdown
Author

Superseded by the same branch reopened under the movement-sm bot account so it can be approved.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant