Automate provenance-bound Agent Relay release candidates

Merged
KH
1h ago
+774-0

Summary

  • add workflow_dispatch and component-published intake for Sessions, Control, and Webapp
  • fail closed on strict SemVer, digest, source commit, component/repository allowlist, and GitHub build-provenance verification
  • maintain a versioned release values overlay plus provenance ledger on release/agent-relay-X.Y.Z
  • open or update the release PR with an idempotent verified-pins table

Safety

  • dispatch data cannot choose a registry, source repository, workflow, branch path, or repository path
  • candidate values remain separate from approved customer profiles until acceptance
  • this PR does not tag, publish, or deploy anything

Verification

  • 5 focused unit tests pass
  • generated overlay parses and an EKS/RDS umbrella renders with all expected image surfaces
  • actionlint 1.7.12 passes
  • live provenance spot-check: current Control and Webapp pins pass exact-source verification; the older Sessions alpha.5 pin has no GitHub attestation and is correctly rejected

Follow-up

The acceptance/approval tag gate and release install-pack assets will land as separate reviewed PRs.

Autofix with [code]smith
Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.

Summary by cubic

Automates Agent Relay release candidate intake: a new workflow and companion script verify component build provenance, pin the verified images to release/agent-relay-X.Y.Z branches, and keep the tracking PR updated. Nothing is tagged, published, or deployed by this PR; the acceptance/approval tag gate will land separately.

New Features

  • Ingests component pins from manual workflow dispatch or component-published events for sessions-pipeline, relay-control, and relay-webapp; 8 focused unit tests now run in the lint workflow.
  • Fails closed on strict SemVer, lowercase sha256 digest, full source commit, allowlisted component/repository pairs, GitHub attestation verification, a blocked-digest list for withdrawn relayscrubber sessions images, and a scrub-bindgen pin fetched from the exact source revision.
  • Retries rejected pushes up to 5 times when concurrent component publications race, refetching the winning branch and reapplying the component so no event is lost.
  • Keeps a versioned pins.json provenance ledger and generated values.yaml overlay per release branch, and rewrites the PR's verified-pins table from the latest remote head, retrying if another run pushes mid-update.