rules(delivery): carried-forward releases — retag unchanged images instead of rebuilding - #293
Merged
Merged
Conversation
…stead of rebuilding (#292) Add delivery rules 11-15: an image's build inputs are its context + in-repo base inputs + resolved external-base digests (11); every published image records a build-input hash in its config (12); a released image with unchanged inputs is retagged from the prior release's digest, never rebuilt (13); an absent/unreadable/mismatched hash counts as changed (14); carrying forward exempts nothing from release gates (15). Principle 9 gains the matching carve-out: a release tag MAY point at a digest produced by an earlier release when build inputs are unchanged. This refines, not repeals, 'different tag, different bits' — carrying the byte-identical digest forward is stricter immutability than a non-reproducible rebuild (v0.1.0 shipped ~6,400 silently stale combos, found only by hand: #233). Keying on a content hash with fail-dirty answers the silent-staleness objection that closed #241; #168 lists this change-detection matrix as its blessed follow-up. Folding external-base digests into the inputs makes an upstream base bump a changed input, so CVE refreshes rebuild naturally (#247 interlock via rule 15). Rules-only PR per contributing/RULES.md rule 2; implementation follows in small PRs (hash primitive + static test, label stamping, freshness status, selective retag). Resolves #292 Signed-off-by: Elron Bandel <elron.bandel@ibm.com>
This was referenced Aug 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves #292.
What
Doctrine-only PR ratifying carried-forward releases: a release retags an unchanged image from the prior release's digest instead of rebuilding it, keyed on a recorded build-input hash.
.agents/delivery/RULES.md— five new rules:.agents/RULES.mdprinciple 9 — one clarifying sentence: a release tag MAY point at an earlier release's digest when build inputs are unchanged. Refines, not repeals, "different tag, different bits" (changelog entry records the reading).Why
Every tag rebuilds ~438 images today, and because builds aren't reproducible, each rebuild of an unchanged artifact ships different bits under the new version — drift the fleet already carries silently (v0.1.0: ~6,400 stale combos, discovered only by hand-inspecting GHCR, #233). Retagging the byte-identical digest is stricter immutability, and the release workflow already uses the mechanism for
:latestpromotion ("imagetools copies the full manifest incl. provenance/SBOM — no rebuild").Prior art: answers the silent-staleness objection that closed #241 (content hash + fail-dirty, not path mapping); implements the change-detection follow-up #168 lists; supersedes the judgment-based
skip_publishedknob (#227) once implementation lands.Compliance until implementation
Rule 14 makes full rebuilds compliant today: while no hash is recorded, every image reads as changed. Implementation follows in small PRs: hash primitive + offline static test → label stamping → freshness status → selective retag + docs page.
Rules checked against
.agents/contributing/RULES.md1–3 (resolves an RFC issue; rules-only PR; this section)..agents/meta/rules/RULES.md4, 6–7, 9–14 (one home; format; addressable; changelog rows; no silent drift; concise/atomic/example-free)..agents/delivery/RULES.md5–7 untouched (trigger, version-agreement gate, crates immutability unchanged).