HWLAB Code Queue
99 lines
3.1 KiB
Markdown
99 lines
3.1 KiB
Markdown
# HWLAB DEV Artifact Publish
|
|
|
|
`scripts/dev-artifact-publish.mjs` is the DEV-only build and publish path for
|
|
D601 local/internal registry artifacts. It does not deploy workloads, read
|
|
secrets, enable PROD, or push to GHCR/Docker Hub/other third-party registries.
|
|
|
|
## Scope
|
|
|
|
- Environment: `dev`.
|
|
- Namespace: `hwlab-dev`.
|
|
- Default registry prefix: `127.0.0.1:5000/hwlab`.
|
|
- Base image: resolved by `scripts/preflight-dev-base-image.mjs` from
|
|
`HWLAB_DEV_BASE_IMAGE` or a local `node:20-*` Docker image. There is no
|
|
network pull or third-party fallback; the build runs with `--pull=false`.
|
|
- Image tag: first seven characters of the Git commit used as build source.
|
|
- Required image labels:
|
|
- `hwlab.pikastech.local/repo`
|
|
- `hwlab.pikastech.local/commit`
|
|
- `hwlab.pikastech.local/service-id`
|
|
- `hwlab.pikastech.local/environment=dev`
|
|
|
|
## Commands
|
|
|
|
Static check:
|
|
|
|
```sh
|
|
node --check scripts/preflight-dev-base-image.mjs
|
|
node --check scripts/src/dev-base-image-preflight.mjs
|
|
node --check scripts/dev-artifact-publish.mjs
|
|
```
|
|
|
|
Base image preflight:
|
|
|
|
```sh
|
|
node scripts/preflight-dev-base-image.mjs
|
|
```
|
|
|
|
Preflight and report generation:
|
|
|
|
```sh
|
|
node scripts/dev-artifact-publish.mjs --preflight
|
|
```
|
|
|
|
Build only:
|
|
|
|
```sh
|
|
node scripts/dev-artifact-publish.mjs --build
|
|
```
|
|
|
|
Build and publish to the D601 local/internal registry:
|
|
|
|
```sh
|
|
node scripts/dev-artifact-publish.mjs --publish
|
|
```
|
|
|
|
Use `--registry-prefix` only for another localhost/private/internal D601
|
|
registry prefix. The script rejects third-party registry hosts and any prefix
|
|
that names PROD. Use `--base-image` only to override `HWLAB_DEV_BASE_IMAGE` with
|
|
an approved local image for that run.
|
|
|
|
## Report
|
|
|
|
The script writes `reports/dev-gate/dev-artifacts.json`. The file is kept in the
|
|
existing DEV gate report envelope for compatibility with
|
|
`scripts/validate-dev-gate-report.mjs`, while the `artifactPublish` object is
|
|
the HWLAB#35-specific publish record.
|
|
|
|
Each service record contains:
|
|
|
|
- `serviceId`
|
|
- `image`
|
|
- `imageTag`
|
|
- `digest`
|
|
- `runtimeKind`
|
|
- `implementationState`
|
|
- `entrypoint`
|
|
|
|
`digest` is only set to a registry digest after `docker push` succeeds and the
|
|
push output contains a digest. The script records blockers instead of claiming a
|
|
publish when build, push, base image, registry, contract, or safety checks fail.
|
|
|
|
The report also includes `artifactPublish.baseImagePreflight` with the image
|
|
source, local tag, local image ID, `publishUsable` gate, blockers, and next
|
|
steps. When that preflight is blocked, artifact publish is blocked and no build
|
|
or push is attempted.
|
|
|
|
## Known Implementation States
|
|
|
|
- `repo-entrypoint`: the repository has `cmd/<serviceId>/main.mjs`.
|
|
- `static-web-wrapper`: the cloud web static files are packaged behind a small
|
|
health/static-file wrapper.
|
|
- `repo-bundle`: the image packages repository-owned skill artifacts.
|
|
- `library-only`: the repository has library code but no executable package bin.
|
|
- `missing-runtime-entrypoint`: the image is only a health placeholder and is
|
|
not a real service implementation.
|
|
|
|
Runtime implementation blockers do not fake a service implementation. They are
|
|
recorded as the next minimum work needed after artifact publication.
|