feat(ci): split artifact builds from deployment

2026-08-25 10:58:14 +02:00
parent c8bc0ff58d
commit 7625cab0d3
4 changed files with 148 additions and 4 deletions
@@ -97,3 +97,11 @@ the command line as build arguments. The Dockerfile consumes them with
 `RUN --mount=type=secret,id=<id>,required=true ...`.

 Candidate pipelines build every artifact once, push `sha-<commit>`, resolve the registry digest and deploy applications in dependency order. A pull request into a promotion branch must originate from `source.branch`; it pulls and verifies the already tested `sha-<commit>` candidates without rebuilding or deploying them. Promotion pushes require a merge parent with an identical Git tree, pull the existing candidate, verify required container files, add the SemVer alias, deploy the exact digests, create the immutable tag and publish the canonical Gitea release. Tag creation does not trigger another scoped pipeline because the workflow listens only to branch pushes.
+
+Scoped workflows can distribute version 2 artifact builds across independent
+runner jobs by invoking the action with `mode: build` and a zero-based
+`artifact-index`. A final job invokes `mode: coordinate` after all build jobs.
+Candidate tags are the synchronization boundary, so exact digests never depend
+on matrix output merging. Published candidates also maintain a per-image
+`buildcache` tag with inline BuildKit metadata for ephemeral runners. Version 1
+manifests remain on the serial coordinator compatibility path.