Run the dev-base docker build + main-only validations on PRs as build-only checks #536

Closed

coilyco-ops wants to merge 1 commit from issue-454-v2 into main

coilyco-ops commented

2026-07-14 19:03:58 +00:00

Member

This adds a PR-only dev-base build job to ci.yml and keeps the current promote/release publish flow intact. The build-only action exercises the tiered dev-base family and the in-image ward-doctor gate without publish credentials, so Dockerfile or pinned ARG drift fails before merge.

What changed: shared build/verify action, PR build-only job, updated docs/tests for the current workflow split
Why: catch the aos#452 class on the PR that introduces it, instead of after merge
Validation: ward exec test -- tests/test_pull_request_ci_workflow.py tests/test_dev_base_build_action.py, git diff --check; ward exec pre-commit-all hit a container scratch-space limit while bootstrapping hook envs

closes #454
ward.workflow: pull-request-and-merge

This adds a PR-only dev-base build job to `ci.yml` and keeps the current `promote`/`release` publish flow intact. The build-only action exercises the tiered dev-base family and the in-image ward-doctor gate without publish credentials, so Dockerfile or pinned ARG drift fails before merge. - What changed: shared build/verify action, PR build-only job, updated docs/tests for the current workflow split - Why: catch the aos#452 class on the PR that introduces it, instead of after merge - Validation: `ward exec test -- tests/test_pull_request_ci_workflow.py tests/test_dev_base_build_action.py`, `git diff --check`; `ward exec pre-commit-all` hit a container scratch-space limit while bootstrapping hook envs closes #454 ward.workflow: pull-request-and-merge

coilyco-ops added 1 commit

2026-07-14 19:03:58 +00:00

ci: run the dev-base build + main-only validations on PRs as build-only checks

ci / ward-doctor (pull_request) Successful in 3m5s

Details

ci / gate (pull_request) Failing after 4m11s

Details

ci / build-dev-base (pull_request) Failing after 7m53s

Details

402ce230da

Factor the build/verify half of release.yml's publish-dev-base into the
shared ./actions/dev-base-build composite so PR validation and the main
publish run one definition and cannot drift apart. ci.yml gains a
pull_request-only build-dev-base job that builds every tier (exercising
the in-image CLIGUARD_NO_SANDBOX=1 ward doctor gate) with no push, no
tag, and no registry auth, plus a compute-only tag-bump step in gate so
release planning is validated pre-merge. Publish, tag, and the GitHub
mirror stay main-only. The manifest verify loop now derives its tier
refs from the build plan instead of a hand-maintained suffix list.

This is the prevention for the aos#452 class: main going red on a merge
because PRs never exercised what main does.

closes #454

coilyco-ops referenced this pull request

2026-07-14 19:04:46 +00:00

Run the dev-base docker build + main-only validations on PRs as a build-only validation step (prevent the aos#452 main-red class) #454

coilyco-ops closed this pull request

2026-07-15 05:20:57 +00:00