Skip to content

Image Publication and Pre-Publication Qualification

Protected-main CI treats the controller revision and runtime image identity as separate facts. A documentation-only or other non-image change does not rebuild the MAC or OpenShell runtime image. Instead, CI computes a canonical digest of the files and reviewed build arguments that can affect that image, resolves the corresponding content tag, and reuses its exact OCI digest only after anonymous label, platform, runtime, and GitHub provenance verification.

Candidate validation runs up front on pull requests and pushes. The documentation boundary builds and executes its own ARM64 candidate from the checked-out tree; that local test image is not a published runtime identity. MAC deployment and trusted-certifier image publication wait for full candidate validation and container contracts. OpenShell runtime publication depends only on image-scope qualification; its published digest alone does not establish that the correctness gates passed.

The separate OpenShell tested-marker job waits for runtime publication, dead-code, mainline, compatibility, PostgreSQL, full candidate validation, and container contracts. It tags the exact published digest as tested-<frozen-inputs-sha>. By default, fleet deployment requires that tag to resolve to the requested image digest. The explicit MAC_DEPLOY_ALLOW_UNTESTED_IMAGE=1 override emits a warning and bypasses that check; it is not test qualification. There is no nightly testing schedule.

The owner-private mac.image_publication_identity.v1 artifact binds:

  • the requested controller revision and the revision that originally built the image;
  • the canonical frozen-input digest and content tag;
  • the immutable multi-platform OCI digest;
  • anonymous execution evidence for linux/amd64 and linux/arm64; and
  • verified GitHub provenance for that exact digest and original build revision.

The reviewed OpenShell build-recipe inputs include its Containerfile, copied source and lock files, fixed tool-version arguments, asset preparation script, reviewed checksum registry, Bash contract, and pinned base-image references. Generated .mac-openshell-build-assets are deliberately represented by their reviewed generator, exact checksum registry, and arguments, so a reuse probe avoids the downloads entirely. Change mac.image_frozen_inputs.v1 whenever the fingerprinting boundary or interpretation changes.

This recipe identity is not a claim of bit-for-bit reproducibility. Debian and npm package resolution inside the reviewed Containerfile is not fully pinned to immutable snapshots, so rebuilding the same recipe later can resolve a different OCI digest. Reuse always preserves and verifies the already-built immutable digest; the receipt records that digest and its original provenance as authoritative. A future reproducible-build gate must pin or receipt those resolved package materials before making a stronger claim.

Per-image workflow concurrency is serialized without cancellation. This keeps two protected-main runs from racing to establish the same content tag while retaining the exact immutable digest as the deployment identity.