# HWLAB DEV Artifact Publish

`scripts/dev-artifact-publish.mjs` is the DEV-only build and publish path for
D601 local/internal registry artifacts. It does not deploy workloads, read
secrets, enable PROD, or push to GHCR/Docker Hub/other third-party registries.

## Scope

- Environment: `dev`.
- Namespace: `hwlab-dev`.
- Default registry prefix: `127.0.0.1:5000/hwlab`.
- Base image: resolved by `scripts/preflight-dev-base-image.mjs` from
  `HWLAB_DEV_BASE_IMAGE` or a local `node:20-*` Docker image. There is no
  network pull or third-party fallback; the build runs with `--pull=false`.
- Image tag: first seven characters of the Git commit used as build source.
- Required image labels:
  - `hwlab.pikastech.local/repo`
  - `hwlab.pikastech.local/commit`
  - `hwlab.pikastech.local/service-id`
  - `hwlab.pikastech.local/environment=dev`

## Commands

Static check:

```sh
node --check scripts/preflight-dev-base-image.mjs
node --check scripts/src/dev-base-image-preflight.mjs
node --check scripts/dev-artifact-publish.mjs
```

Base image preflight:

```sh
node scripts/preflight-dev-base-image.mjs
```

Preflight and report generation:

```sh
node scripts/dev-artifact-publish.mjs --preflight
```

Build only:

```sh
node scripts/dev-artifact-publish.mjs --build
```

Build and publish to the D601 local/internal registry:

```sh
node scripts/dev-artifact-publish.mjs --publish
```

Use `--registry-prefix` only for another localhost/private/internal D601
registry prefix. The script rejects third-party registry hosts and any prefix
that names PROD. Use `--base-image` only to override `HWLAB_DEV_BASE_IMAGE` with
an approved local image for that run.

## Report

The script writes `reports/dev-gate/dev-artifacts.json`. The file is kept in the
existing DEV gate report envelope for compatibility with
`scripts/validate-dev-gate-report.mjs`, while the `artifactPublish` object is
the HWLAB#35-specific publish record.

Each service record contains:

- `serviceId`
- `image`
- `imageTag`
- `digest`
- `runtimeKind`
- `implementationState`
- `entrypoint`

`digest` is only set to a registry digest after `docker push` succeeds and the
push output contains a digest. The script records blockers instead of claiming a
publish when build, push, base image, registry, contract, or safety checks fail.

The report also includes `artifactPublish.baseImagePreflight` with the image
source, local tag, local image ID, `publishUsable` gate, blockers, and next
steps. When that preflight is blocked, artifact publish is blocked and no build
or push is attempted.

## Known Implementation States

- `repo-entrypoint`: the repository has `cmd/<serviceId>/main.mjs`.
- `static-web-wrapper`: the cloud web static files are packaged behind a small
  health/static-file wrapper.
- `repo-bundle`: the image packages repository-owned skill artifacts.
- `library-only`: the repository has library code but no executable package bin.
- `missing-runtime-entrypoint`: the image is only a health placeholder and is
  not a real service implementation.

Runtime implementation blockers do not fake a service implementation. They are
recorded as the next minimum work needed after artifact publication.