Add PR build validation for the independent dev-base image family

coilyco-ops commented

2026-07-10 18:55:02 +00:00

Owner

workflow: pull-request-and-merge

Current state

PR #541 is closed and unmerged. AOS #689 replaced the old tier graph with five independent Ubuntu language images and one full compatibility image. Main still does not build the image family on pull requests.

Goal

A pull request that breaks an image Dockerfile, common installer, build plan, or in-image Ward gate fails before merge without publishing registry artifacts.

Scope

AOS adds a pull-request build-only job with no registry credentials and no push.
The job derives affected tiers from the canonical tier specification and always includes the necessary full composition check when shared or graft inputs change.
PR validation uses one local architecture and bounded caches rather than performing the production multi-architecture export fan-out.
The build path exercises the same Dockerfiles, build arguments, and verification scripts used by publication.
The job runs the in-image Ward doctor gate where the affected tier owns that contract.
Branch protection requires the resulting status context after the workflow proves stable.

Done

A PR with a broken language image, common installer, or full graft fails its own CI.
PR validation publishes no image and receives no registry write credential.
Production publication and PR validation share their build and verification definitions.
Repository validation passes.

workflow: pull-request-and-merge ## Current state PR #541 is closed and unmerged. AOS #689 replaced the old tier graph with five independent Ubuntu language images and one `full` compatibility image. Main still does not build the image family on pull requests. ## Goal A pull request that breaks an image Dockerfile, common installer, build plan, or in-image Ward gate fails before merge without publishing registry artifacts. ## Scope * AOS adds a pull-request build-only job with no registry credentials and no push. * The job derives affected tiers from the canonical tier specification and always includes the necessary `full` composition check when shared or graft inputs change. * PR validation uses one local architecture and bounded caches rather than performing the production multi-architecture export fan-out. * The build path exercises the same Dockerfiles, build arguments, and verification scripts used by publication. * The job runs the in-image Ward doctor gate where the affected tier owns that contract. * Branch protection requires the resulting status context after the workflow proves stable. ## Done * A PR with a broken language image, common installer, or full graft fails its own CI. * PR validation publishes no image and receives no registry write credential. * Production publication and PR validation share their build and verification definitions. * Repository validation passes.

coilyco-ops added the

labels

2026-07-10 18:55:02 +00:00

coilyco-ops referenced this issue

2026-07-10 18:55:02 +00:00

publish-dev-base red on main: stale WARD_VERSION, swagger-lock vs ward doctor, dep-bump gate deadlock #452

coilyco-ops referenced this issue from a commit

2026-07-10 22:06:21 +00:00

ci: run the dev-base build + main-only validations on PRs as build-only checks

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-10 22:07:14 +00:00

Run the dev-base docker build + main-only validations on PRs as build-only checks #456

coilyco-ops referenced this issue

2026-07-10 22:07:42 +00:00

Require the ci / build-dev-base status context in branch protection #457

coilyco-ops referenced this issue

2026-07-10 22:20:25 +00:00

publish-dev-base red on main: stale WARD_VERSION, swagger-lock vs ward doctor, dep-bump gate deadlock #452

coilyco-ops commented

2026-07-10 22:20:50 +00:00

Author

Owner

WARD-OUTCOME: submitted

details

workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA)

PR: #456 (branch issue-454, head 7c51971). Deliverable: the build/verify half of publish-dev-base factored into the shared actions/dev-base-build composite, ci.yml runs it on every pull_request build-only (no push, no tag, no registry auth) plus a compute-only tag-bump dry run in gate, release.yml re-consumes the same composite with push: "true", docs walkthrough at docs/pr-dev-base-build-validation.md, contract tests in tests/test_dev_base_build_action.py. 463 tests and the full pre-commit suite green locally.

Check state at handoff: ci / gate green (including the new steps). ci / build-dev-base red - deliberately left so, because it is the live aos#452 incident surfaced pre-merge, which is this feature's acceptance behavior. Verified across ward versions (matrix posted on aos#452 and PR #456): no shipped ward passes doctor against the lock-less bundle, unblock is ward-side (ward#1064). The check goes green with zero further change to this branch once aos#452's pin bump lands, since PR and publish share one definition. Merging now is safe: release.yml behavior on main is unchanged.

Retrospective: the factoring itself felt clean (the composite is a near-verbatim lift of the publish steps, with push-only side effects fail-closed behind the input). The surprise was the first live run instantly reproducing aos#452 - validating the feature but denying a green check. Second surprise: .ward/ bundle vs ward-version doctor compatibility has no valid pairing at all right now, which was worth pinning down empirically (source-built v0.604.0, tested v0.605.0, read ward HEAD) rather than assuming a pin bump would do. Confidence in the change itself: high. Confidence the red check clears without touching this branch: high, contingent on ward#1064-class work.

Follow-ups filed: #457 (make ci / build-dev-base required in branch protection - deferred deliberately, and this run's token got 403 on /branch_protections). aos#452 carries the remaining red-main work with the fresh diagnosis. Branch-protection audit of other main-only workflows: mirror-to-github.yml deploy stays main-only, dep-bump.yml/freshness.yml scheduled stay as-is, release plan/doctor validations brought onto PRs per the issue.

WARD-OUTCOME: submitted <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA) PR: #456 (branch `issue-454`, head 7c51971). Deliverable: the build/verify half of `publish-dev-base` factored into the shared `actions/dev-base-build` composite, `ci.yml` runs it on every pull_request build-only (no push, no tag, no registry auth) plus a compute-only tag-bump dry run in `gate`, release.yml re-consumes the same composite with `push: "true"`, docs walkthrough at `docs/pr-dev-base-build-validation.md`, contract tests in `tests/test_dev_base_build_action.py`. 463 tests and the full pre-commit suite green locally. Check state at handoff: `ci / gate` green (including the new steps). `ci / build-dev-base` red - deliberately left so, because it is the live aos#452 incident surfaced pre-merge, which is this feature's acceptance behavior. Verified across ward versions (matrix posted on aos#452 and PR #456): no shipped ward passes doctor against the lock-less bundle, unblock is ward-side (ward#1064). The check goes green with zero further change to this branch once aos#452's pin bump lands, since PR and publish share one definition. Merging now is safe: release.yml behavior on main is unchanged. Retrospective: the factoring itself felt clean (the composite is a near-verbatim lift of the publish steps, with push-only side effects fail-closed behind the input). The surprise was the first live run instantly reproducing aos#452 - validating the feature but denying a green check. Second surprise: `.ward/` bundle vs ward-version doctor compatibility has no valid pairing at all right now, which was worth pinning down empirically (source-built v0.604.0, tested v0.605.0, read ward HEAD) rather than assuming a pin bump would do. Confidence in the change itself: high. Confidence the red check clears without touching this branch: high, contingent on ward#1064-class work. Follow-ups filed: #457 (make `ci / build-dev-base` required in branch protection - deferred deliberately, and this run's token got 403 on `/branch_protections`). aos#452 carries the remaining red-main work with the fresh diagnosis. Branch-protection audit of other main-only workflows: `mirror-to-github.yml` deploy stays main-only, `dep-bump.yml`/`freshness.yml` scheduled stay as-is, release plan/doctor validations brought onto PRs per the issue. </details>

coilyco-ops commented

2026-07-10 22:52:30 +00:00

Author

Owner

WARD-OUTCOME: blocked 🛑

details

workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA)

PR: #456. ci / gate is green on run 1014. ci / build-dev-base is red on the same run after 2m24s. The branch content is merged with main, but the dev-base build still fails in the shared build/verify step. The blocker is still the ward-side bundle compatibility issue already diagnosed in the thread, so this repo cannot clear the check alone.

Retrospective: the wiring held. The surprise was that the main merge did not move the live build result. Confidence: high in the diagnosis, low that more repo-only edits will help. Follow-up: wait for the ward-side fix, then rerun the PR.

WARD-OUTCOME: blocked 🛑 <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA) PR: #456. `ci / gate` is green on run 1014. `ci / build-dev-base` is red on the same run after 2m24s. The branch content is merged with `main`, but the dev-base build still fails in the shared build/verify step. The blocker is still the ward-side bundle compatibility issue already diagnosed in the thread, so this repo cannot clear the check alone. Retrospective: the wiring held. The surprise was that the `main` merge did not move the live build result. Confidence: high in the diagnosis, low that more repo-only edits will help. Follow-up: wait for the ward-side fix, then rerun the PR. </details>

coilyco-ops commented

2026-07-14 09:16:26 +00:00

Author

Owner

WARDED_WORKFLOW: blocked 🛑

details

workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, review gate skipped by ~/.ward/config.yaml default)

PR: #456. ci / gate passed on run 1233. ci / build-dev-base failed on the same run after 3m25s. The branch change here was doc-only, so the failure is still the shared dev-base build path, not this docs edit. Confidence: high that this is the same external blocker seen before. Follow-up: wait for the ward-side build/doctor compatibility fix, then rerun the PR.

WARDED_WORKFLOW: blocked 🛑 <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, review gate skipped by ~/.ward/config.yaml default) PR: #456. `ci / gate` passed on run 1233. `ci / build-dev-base` failed on the same run after 3m25s. The branch change here was doc-only, so the failure is still the shared dev-base build path, not this docs edit. Confidence: high that this is the same external blocker seen before. Follow-up: wait for the ward-side build/doctor compatibility fix, then rerun the PR. </details>

coilyco-ops commented

2026-07-14 10:07:57 +00:00

Author

Owner

Director burn-down update from 2026-07-14: PR #456 is open but Forgejo reports mergeable: false. ward ops forgejo pr update coilyco-flight-deck agentic-os 456 returned 409 Conflict with merge failed because of conflict, so this branch needs repair once the dispatch broker is reachable again.

Director burn-down update from 2026-07-14: PR #456 is open but Forgejo reports `mergeable: false`. `ward ops forgejo pr update coilyco-flight-deck agentic-os 456` returned 409 Conflict with `merge failed because of conflict`, so this branch needs repair once the dispatch broker is reachable again.

coilysiren referenced this issue from coilyco-flight-deck/ward

2026-07-14 15:27:09 +00:00

director should emit colorized, space buffered, visually distinct messages about the categories of actions its performing on startup #1283

coilyco-ops commented

2026-07-14 15:37:18 +00:00

Author

Owner

WARDED_WORKFLOW: blocked 🛑

details

workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA)

PR: #456. ci / gate passed on the reopened run. ci / build-dev-base failed again after 4m4s on the merge ref for this PR. The branch-protection write for main is still blocked from this runner with 403 on the Forgejo branch-protection API, so the required-check follow-up cannot be completed from here. Confidence: high this is the same external dev-base blocker seen before. Follow-up: wait on the ward-side build/doctor compatibility fix and the admin-side protection update, then rerun.

Retrospective: the branch wiring held, and the failure reproduced exactly as before. The surprise was that reopening the PR immediately re-queued the same failing merge-ref run without any new code drift.

WARDED_WORKFLOW: blocked 🛑 <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA) PR: #456. `ci / gate` passed on the reopened run. `ci / build-dev-base` failed again after 4m4s on the merge ref for this PR. The branch-protection write for `main` is still blocked from this runner with 403 on the Forgejo branch-protection API, so the required-check follow-up cannot be completed from here. Confidence: high this is the same external dev-base blocker seen before. Follow-up: wait on the ward-side build/doctor compatibility fix and the admin-side protection update, then rerun. Retrospective: the branch wiring held, and the failure reproduced exactly as before. The surprise was that reopening the PR immediately re-queued the same failing merge-ref run without any new code drift. </details>

coilyco-ops referenced this issue from a commit

2026-07-14 19:03:51 +00:00

ci: run the dev-base build + main-only validations on PRs as build-only checks

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-14 19:03:58 +00:00

Run the dev-base docker build + main-only validations on PRs as build-only checks #536

coilyco-ops commented

2026-07-14 19:04:46 +00:00

Author

Owner

WARDED_WORKFLOW: #536

details

workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA)

felt: clean after the rebase onto current main. the snag was container disk pressure, so full pre-commit could not finish here.
confidence: high on the CI wiring, medium on merge readiness until the director clears PR 536.
surprises: the old PR branch could not be updated without a force push, so a fresh branch and PR were needed.
follow-ups: director merge PR 536, then close the stale PR 456 if it stays redundant.

WARDED_WORKFLOW: https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/pulls/536 <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA) felt: clean after the rebase onto current main. the snag was container disk pressure, so full pre-commit could not finish here. confidence: high on the CI wiring, medium on merge readiness until the director clears PR 536. surprises: the old PR branch could not be updated without a force push, so a fresh branch and PR were needed. follow-ups: director merge PR 536, then close the stale PR 456 if it stays redundant. </details>

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-15 01:06:14 +00:00

Validate affected dev-base image builds on pull requests #541

coilyco-ops commented

2026-07-15 01:12:20 +00:00

Author

Owner

WARDED_WORKFLOW: blocked 🛑

details

workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA)

ci / gate passed on PR #541. ci / build-dev-base failed after 4m39s on the same PR. I could not recover a repo-local fix from this run, and the failure still matches the dev-base build/doctor blocker seen before.

felt: clean until the shared dev-base path tripped again.
confidence: high that this is still external to this repo.
surprises: the fresh PR on the current branch did not change the outcome.
follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541.

WARDED_WORKFLOW: blocked 🛑 <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA) ci / gate passed on PR #541. ci / build-dev-base failed after 4m39s on the same PR. I could not recover a repo-local fix from this run, and the failure still matches the dev-base build/doctor blocker seen before. felt: clean until the shared dev-base path tripped again. confidence: high that this is still external to this repo. surprises: the fresh PR on the current branch did not change the outcome. follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541. </details>

coilyco-ops commented

2026-07-15 01:35:42 +00:00

Author

Owner

WARDED_WORKFLOW: blocked 🛑

details

workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA)

ci / ward-doctor failed after 12s, ci / gate failed after 11s, and ci / build-dev-base failed after 3m37s on PR #541.
felt: the PR wiring was straightforward, but the same external dev-base blocker still won.
confidence: high that the remaining failure is external to this repo.
surprises: the build-only job stayed red on the refreshed head even after the branch was rebased onto current main.
follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541.

WARDED_WORKFLOW: blocked 🛑 <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA) ci / ward-doctor failed after 12s, ci / gate failed after 11s, and ci / build-dev-base failed after 3m37s on PR #541. felt: the PR wiring was straightforward, but the same external dev-base blocker still won. confidence: high that the remaining failure is external to this repo. surprises: the build-only job stayed red on the refreshed head even after the branch was rebased onto current main. follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541. </details>

coilyco-ops commented

2026-07-15 03:11:16 +00:00

Author

Owner

WARDED_WORKFLOW: blocked 🛑

details

workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA)

ci / ward-doctor failed after 12s, ci / gate failed after 11s, and ci / build-dev-base failed after 3m37s on PR #541.
I could not recover a repo-local fix from this run.
felt: the PR wiring was straightforward, but the shared dev-base blocker still won.
confidence: high that the remaining failure is external to this repo.
follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541.

WARDED_WORKFLOW: blocked 🛑 <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA) ci / ward-doctor failed after 12s, ci / gate failed after 11s, and ci / build-dev-base failed after 3m37s on PR #541. I could not recover a repo-local fix from this run. felt: the PR wiring was straightforward, but the shared dev-base blocker still won. confidence: high that the remaining failure is external to this repo. follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541. </details>

coilyco-ops commented

2026-07-15 03:11:27 +00:00

Author

Owner

WARDED_WORKFLOW: blocked 🛑

details

workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA)

felt: the wiring was straightforward, but the shared dev-base blocker still won.
confidence: high that the remaining failure is external to this repo.
surprises: the build-only job stayed red on the refreshed head even after the branch was rebased onto current main.
follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541.

WARDED_WORKFLOW: blocked 🛑 <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA) felt: the wiring was straightforward, but the shared dev-base blocker still won. confidence: high that the remaining failure is external to this repo. surprises: the build-only job stayed red on the refreshed head even after the branch was rebased onto current main. follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541. </details>

coilyco-ops commented

2026-07-15 03:42:02 +00:00

Author

Owner

WARDED_WORKFLOW: failed ❌

details

workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA)

ci / ward-doctor passed, ci / gate passed, and ci / build-dev-base failed after 7m50s on PR #541.
felt: the merge held, but the shared dev-base build/doctor path still tripped.
confidence: high the blocker is external to this repo.
surprises: the refreshed head kept the same failure.
follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541.

WARDED_WORKFLOW: failed ❌ <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA) ci / ward-doctor passed, ci / gate passed, and ci / build-dev-base failed after 7m50s on PR #541. felt: the merge held, but the shared dev-base build/doctor path still tripped. confidence: high the blocker is external to this repo. surprises: the refreshed head kept the same failure. follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541. </details>

coilyco-ops commented

2026-07-15 03:42:20 +00:00

Author

Owner

WARDED_WORKFLOW: failed ❌

details

workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA)

ci / ward-doctor passed, ci / gate passed, and ci / build-dev-base failed after 7m50s on PR #541.
felt: the merge wiring held, but the shared dev-base build/doctor path still tripped.
confidence: high the blocker is external to this repo.
surprises: the refreshed head kept the same failure.
follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541.

WARDED_WORKFLOW: failed ❌ <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (in-container review gate intentionally skipped, the temporary ward default pending brokered QA) ci / ward-doctor passed, ci / gate passed, and ci / build-dev-base failed after 7m50s on PR #541. felt: the merge wiring held, but the shared dev-base build/doctor path still tripped. confidence: high the blocker is external to this repo. surprises: the refreshed head kept the same failure. follow-ups: wait for the ward-side build/doctor compatibility fix, then rerun PR #541. </details>

~~coilyco-ops referenced this issue 2026-07-18 04:27:26 +00:00~~

Consume Ward release artifacts in dev-base and workflow bootstrap #606

coilyco-ops referenced this issue

2026-07-22 08:14:56 +00:00

publish-dev-base red on main: stale WARD_VERSION, swagger-lock vs ward doctor, dep-bump gate deadlock #452

coilyco-ops changed title from ~~Run the dev-base docker build + main-only validations on PRs as a build-only validation step (prevent the aos#452 main-red class)~~ to Add PR build validation for the independent dev-base image family

2026-07-24 06:47:15 +00:00

coilyco-ops added

and removed

labels

2026-07-29 06:27:44 +00:00

coilyco-ops referenced this issue from a commit

2026-07-29 12:53:10 +00:00

ci(dev-base): validate affected PR image builds

coilyco-ops referenced this issue from a commit

2026-07-29 13:13:19 +00:00

fix(ci): compose PR images through local builder

coilyco-ops referenced this issue from a commit

2026-07-29 13:38:36 +00:00

fix(ci): link local image targets with Buildx Bake

coilyco-ops closed this issue

2026-07-29 13:52:26 +00:00

coilyco-ops commented

2026-07-29 13:53:21 +00:00

Author

Owner

WARD-WORKFLOW: done ✅

details

workflow: merge-remote-main; review summary: skipped (the in-container review gate was intentionally skipped because implementation and QA are role-separated; QA is a separate, opt-in exact-commit verification role bound to candidate f9f16cce)

PR #541 merged as d0c30496. ci / ward-doctor, ci / gate, and ci / build-dev-base passed; the image job completed in 13m3s without registry credentials or pushes.

felt: clean once Buildx Bake expressed the independent-image graph.
confidence: high.
surprises: Docker’s local driver dropped the runner daemon; isolated target links removed that pressure and kept full composition local.
follow-ups: #457 remains the admin-scoped required-status protection change.

WARD-WORKFLOW: done ✅ <details><summary>details</summary> workflow: merge-remote-main; review summary: skipped (the in-container review gate was intentionally skipped because implementation and QA are role-separated; QA is a separate, opt-in exact-commit verification role bound to candidate f9f16cce) PR #541 merged as d0c30496. ci / ward-doctor, ci / gate, and ci / build-dev-base passed; the image job completed in 13m3s without registry credentials or pushes. felt: clean once Buildx Bake expressed the independent-image graph. confidence: high. surprises: Docker’s local driver dropped the runner daemon; isolated target links removed that pressure and kept full composition local. follow-ups: #457 remains the admin-scoped required-status protection change. </details>

coilyco-ops commented

2026-07-29 13:53:37 +00:00

Author

Owner

WARD-WORKFLOW: reservation-released

release details

Run finished with WARD-WORKFLOW: done ✅.

ward container reap released container engineer-codex-agentic-os-454 (--harness codex): the terminal outcome supersedes the reservation, so a later redispatch no longer needs --override-reservation.

— Codex, via ward agent

WARD-WORKFLOW: reservation-released <details><summary>release details</summary> Run finished with `WARD-WORKFLOW: done ✅`. `ward container reap` released container `engineer-codex-agentic-os-454` (`--harness codex`): the terminal outcome supersedes the reservation, so a later redispatch no longer needs `--override-reservation`. </details>  — Codex, via `ward agent`

Rows
Columns

Add PR build validation for the independent dev-base image family #454

Current state

Goal

Scope

Done