Repository navigation
Reusable publish-fragment workflow, and the render diff on the app PR #135
Description
Parent
JorisJonkers-dev/deploy-kit#195
What to build
- A reusable
publish-fragmentworkflow application repositories call on a release tag. It validates the project file with the pinned deploy-kit, resolves every image (and the migration image) to a digest, writes the images-lock share and the migration proof, pushes the keyless-signed OCI Intent Fragment carrying the release version, and dispatches composition inJorisJonkers-dev/estatewith a GitHub App token. - A reusable step that posts the render diff of a PR's project-file change as a PR comment.
Acceptance criteria
- home-portal publishes through it on a tag, and composition runs from the dispatch.
- actionlint passes; every logic step is a deploy-kit CLI call.
Activity
ExtraToast commentedon Oct 2, 2026
The dispatch App exists (JorisJonkers-dev/estate#1):
estate-dispatch, id5165539. Permissions:actions: write,contents: read,statuses: write,metadata: read. Installed on all repositories in the org.ESTATE_DISPATCH_APP_IDand org secretESTATE_DISPATCH_APP_PRIVATE_KEY, both with visibilityall. A caller's reusable workflow reads them asvars.ESTATE_DISPATCH_APP_IDandsecrets.ESTATE_DISPATCH_APP_PRIVATE_KEY(passsecrets: inherit, or the secret by name).JorisJonkers-dev/estate, e.g.actions/create-github-app-tokenwithowner: JorisJonkers-devandrepositories: estate.compose.ymlon estate is still the canary stage,workflow_dispatchonly. Composition workflow: compose, sign, pin, and report estate#2 defines the real trigger and its inputs.https://github.com/JorisJonkers-dev/estate/.github/workflows/compose.yml@refs/heads/main. Fragments are signed by the publishing repository's own identity, not this one.ExtraToast commentedon Oct 3, 2026
Two things this ticket was waiting on have landed:
deploy-kit validate,publishandcomposeare onmain. Ship the deploy-kit command in the published package deploy-kit#229 (shipping the command in the published package) is still in triage, so a workflow cannotnpxit from a release yet.JorisJonkers-dev/liquibase-runner/actions/migration-proof. It runs the three migration-safety obligations against a throwaway Postgres and writesmigration-proof.ymlbeside the project file.publish-fragmentshould run after it, because the fragment's digest covers the proof. Its inputs are in that repository's README.ExtraToast commentedon Oct 3, 2026
#136 merged the two pieces this ticket asks for: the reusable
publish-fragment.ymlworkflow and theactions/render-diffstep. The ticket stays open for its acceptance line, home-portal publishing through it on a tag. What that still needs:deploy-kitbin to the package; it reaches callers with the next release (chore(main): release 0.3.0 deploy-kit#75). A caller pinning an earlier release fails the workflow's install step, by design, with a message saying so.actions/publish-fragment, notmain.compose.yml, which is still the canary. That ticket also builds the step that pulls the estate's inputs, andactions/render-diffreads the directory it leaves:platform/,fragments/<project>/,cluster-state.yml, and optionallyheld/,pins.jsonandprevious/.package.jsonand lockfile pinning@jorisjonkers-dev/deploy-kit, a tag-triggered job that calls the workflow after its images are built, andsecrets: inheritor the dispatch App's key by name.For JorisJonkers-dev/estate#2: fragments are signed by
https://github.com/JorisJonkers-dev/github-workflows/.github/workflows/publish-fragment.yml@<ref>, and the publishing repository is in the certificate (--certificate-github-workflow-repository).latestonghcr.io/jorisjonkers-dev/intent-<project>only moves forward, and every release also has its own version tag.ExtraToast commentedon Oct 4, 2026
#138 added the images-lock share:
publish-fragment.ymltakes animages-lock-artifactinput and hands the lock todeploy-kit publish --images-lock, which packs only the aliases the project file names. That closes the "images-lock share" item in the list above on this side; the option itself lands in deploy-kit with JorisJonkers-dev/deploy-kit#238.For the caller (JorisJonkers-dev/home-portal#70): the build job writes
images.lock.yml(anImagesLockdocument: each image the release pushed, by digest, with the numeric uid and gid it runs as), uploads it as an artifact, and passes the artifact's name. deploy-kit's workedproject-publish-fragment.ymlshows one way to write it. Composition resolves a Project only from its own share and the Platform document's lock, so every alias the project file names has to be in one of the two.