ci(quoter-signer): publish image alongside quoter-bot on release - #205
ci(quoter-signer): publish image alongside quoter-bot on release#205julien-devatom wants to merge 1 commit into
Conversation
Fan publish-quoter-bot-dockerhub.yml over a two-image matrix so each quoter-bot production release also pushes morphoorg/quoter-signer (services/quoter-signer/Dockerfile, repo-root context) with the commit hash and forward-only latest tags. The signer rides the quoter-bot release train: the same quoter-bot-* tag family gates both latest tags. Repository names stay environment configuration — the new DOCKER_SIGNER_REPOSITORY var joins DOCKER_REPOSITORY, preflighted fail-loud — and legs run under per-image concurrency groups with fail-fast disabled so one registry failure cannot block the other image. Recorded as TIB-2026-08-14 Addendum A. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
@codex review |
|
@prd-carapulse[bot] can you review and approve if all good |
|
✅ Approved PR #205 at • Validation: |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
![prd-carapulse[bot]](https://avatars.githubusercontent.com/in/2960675?s=60&v=4){kind=small}
There was a problem hiding this comment.
Approved. Reviewed head 99fdca964ad9cded9a61d35ceabc22ac88cf42da: matrix wiring preserves per-image serialization, SHA-tag recovery, the forward-only latest gate, and scoped OIDC permissions. actionlint v1.7.12 passes; current GitHub checks pass.
Rollout prerequisites remain before the next quoter-bot release: add DOCKER_SIGNER_REPOSITORY, create morphoorg/quoter-signer as public, and grant the Docker Hub OIDC connection image-push scope. Live checks confirm the environment variable and public repository are not configured yet; Docker-side scope was not directly verifiable.
1 participant
Why
TIB-2026-08-12 Addendum A committed the
morphoorg/quoter-signermiddleware image to the TIB-2026-08-14 publishing posture, with the README's manual push as the interim channel. Every quoter-bot production release should ship the middleware image the same way it ships the bot image: an immutable public record of the released source, published with no static registry credential. This wires that up — the signer has no release cadence of its own, so it rides the quoter-bot release train rather than gaining a selector, a second environment, or a second workflow.What
publish-quoter-bot-dockerhub.ymlfans itsPublishjob over a two-image matrix (bots/quoter-bot/Dockerfile,services/quoter-signer/Dockerfile), both at repo-root context. Same OIDC login, SHA-tag idempotency, and forward-onlylatestgate per image; the samequoter-bot-*release-tag family gates bothlatesttags. Legs run under per-image concurrency groups withfail-fast: false, so one registry failure cannot cancel or block the other image.vars[matrix.repository_var], preflighted fail-loud. NoGIT_REVISIONbuild-arg: the action's--labelvalues override the signer Dockerfile's same-key LABEL (verified empirically).latestbelongs to CI's forward-only gate); the bot README paragraph is refreshed (it also mis-stated that the push runs in parallel with the deploy — the job needs the deploy and the release).Rollout prerequisites (before the next
release-quoter-bot)DOCKER_SIGNER_REPOSITORY=quoter-signerto thequoter-bot-dockerhubGitHub environment (preflight fails loud without it;fail-fast: falsekeeps the bot leg publishing regardless).morphoorg/quoter-signeron Docker Hub as public — it is not publicly visible today (hub API 404), and auto-creation on push would inherit the namespace default privacy.Validation
pnpm format:check,pnpm lint,pnpm knipclean;pnpm testgreen (3027 passed — the 4 failing fork/e2e files needRPC_URL_8453, absent in this worktree, unrelated).railway.utils.test.tspass (the reviewer caught that renaming theQuoter-bot-imagecaller job broke them — the rename is reverted, only its comment changed).latesthazard, first-publish provisioning — both incorporated), 1 nit (stale README name, fixed).Not funds-at-risk: no calldata, signing policy, or bot behavior changes — CI publishing only, and the OIDC no-static-credential posture is unchanged.
🤖 Generated with Claude Code