Consume Ward release artifacts in dev-base and workflow bootstrap #606

New issue

Closed

opened 2026-07-18 04:27:26 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-07-18 04:27:26 +00:00

Member

workflow: pull-request-and-merge

Current state

AOS now routes trusted dev-base publication to the dedicated docker-build lane, preserves runner capacity four, and leaves ordinary jobs on the general pool. That half of the original issue is complete.

Two source-build paths remain:

docker/dev-base/Dockerfile clones Ward and runs go build in the hidden Ward/AOS builder used by every independent language image.
scripts/install-workflow-ward.sh clones Ward and runs go build for workflow gates.

Goal

AOS consumes Ward's architecture-matched release artifacts instead of rebuilding Ward from source.

Scope

The image builder downloads ward-linux-${TARGETARCH} and SHA256SUMS for the pinned version, verifies the checksum, and installs the verified binary.
The workflow installer applies the same release-artifact and checksum contract for the runner architecture.
AOS removes Ward source clones, Ward module downloads, and Ward go build calls from both paths.
AOS preserves the late ward doctor compatibility gate against the real .ward bundle.
Tests cover architecture mapping, checksum failure, and the absence of Ward source builds.

Done

No AOS image or workflow path builds Ward from source.
Both architectures consume the exact Ward release bytes and fail closed on checksum mismatch.
The real AOS bundle passes the candidate Ward doctor gate.
Repository validation passes.

workflow: pull-request-and-merge ## Current state AOS now routes trusted dev-base publication to the dedicated `docker-build` lane, preserves runner capacity four, and leaves ordinary jobs on the general pool. That half of the original issue is complete. Two source-build paths remain: * `docker/dev-base/Dockerfile` clones Ward and runs `go build` in the hidden Ward/AOS builder used by every independent language image. * `scripts/install-workflow-ward.sh` clones Ward and runs `go build` for workflow gates. ## Goal AOS consumes Ward's architecture-matched release artifacts instead of rebuilding Ward from source. ## Scope * The image builder downloads `ward-linux-${TARGETARCH}` and `SHA256SUMS` for the pinned version, verifies the checksum, and installs the verified binary. * The workflow installer applies the same release-artifact and checksum contract for the runner architecture. * AOS removes Ward source clones, Ward module downloads, and Ward `go build` calls from both paths. * AOS preserves the late `ward doctor` compatibility gate against the real `.ward` bundle. * Tests cover architecture mapping, checksum failure, and the absence of Ward source builds. ## Done * No AOS image or workflow path builds Ward from source. * Both architectures consume the exact Ward release bytes and fail closed on checksum mismatch. * The real AOS bundle passes the candidate Ward doctor gate. * Repository validation passes.

coilyco-ops changed title from ~~Finish the AOS side of the Ward build unstick with the dedicated runner and release artifacts~~ to Consume Ward release artifacts in dev-base and workflow bootstrap

2026-07-24 06:47:08 +00:00

coilyco-ops added the

autonomy

async-consult

priority

labels

2026-07-29 03:44:51 +00:00

coilyco-ops added

priority

autonomy

headless

and removed