Build caching for the deploy actions (sccache) — sub-plan 1: container digest-pin gate

.dockerignore

@@ -0,0 +1,21 @@
+**
+!.dockerignore
+!.tool-versions
+!.github/
+!.github/actions/
+!.github/actions/deploy-fastly/
+!.github/actions/deploy-fastly/versions.json
+!.github/docker/
+!.github/docker/build-app-cli/
+!.github/docker/build-app-cli/Dockerfile
+!.github/docker/build-app-cli/fixtures/
+!.github/docker/build-app-cli/fixtures/gnu-smoke.rs
+!.github/docker/build-app-cli/fixtures/provenance/
+!.github/docker/build-app-cli/fixtures/provenance/**
+!.github/docker/build-app-cli/fixtures/wasm-smoke.rs
+!.github/docker/build-app-cli/image-context-paths.txt
+!.github/docker/build-app-cli/provenance.schema.json
+!.github/docker/build-app-cli/verify-toolchain.sh
+!.github/tools/
+!.github/tools/edgezero-provenance-validator/
+!.github/tools/edgezero-provenance-validator/**

.github/CODEOWNERS

@@ -0,0 +1,108 @@
+/.dockerignore @stackpop/edgezero-build-container-gate-reviewers
+/.github/CODEOWNERS @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/assert-build-container-app-token.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/assert-build-container-completion.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/assert-build-container-context.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/assert-build-container-dispatch-context.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/build-container-workflows.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/check-action-pins.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/check-build-container-publisher.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/check-doc-action-pins.mjs @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/check-doc-action-pins.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/check-doc-action-pins.test.mjs @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/check-image-pin.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/classify-build-container-change.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/install-actionlint.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/install-yq.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/release-approval-gate.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/run-actionlint.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/run-build-container-gate.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/run.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/select-build-container-range.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/stage-build-context.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/update-image-pin-pr.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/verify-build-container-publication.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/verify-gate-rotation-lock.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/verify-published-image.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/verify-release-prerequisites.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/verify-toolchain.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/write-image-release-record.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-core/tests/write-publisher-prerequisite.test.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/actions/deploy-fastly/versions.json @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/Dockerfile @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/assert-build-container-app-token.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/assert-build-container-completion.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/assert-build-container-context.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/assert-build-container-dispatch-context.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/check-build-container-publisher.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/check-image-pin.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/classify-build-container-change.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/gnu-smoke.rs @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-base256.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-checksum.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-duplicate.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-embedded-nul.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-end-block.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-extra-end-block.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-extra.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-gnu.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-header.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-link.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-max-size.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-octal-digit.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-octal-padding.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-order.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-padding.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-pax.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-size-limit.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-size.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-sparse.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-special.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-trailing.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/archive-traversal.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/elf-malformed/app-cli @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/expected-duplicate.json @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/invalid/meta-missing-interpreter.json @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/valid/archive.tar @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/valid/dynamic-meta.json @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/valid/elf-static/app-cli @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/valid/expected.json @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/provenance/valid/static-meta.json @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/fixtures/wasm-smoke.rs @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/gate-paths.txt @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/image-context-paths.txt @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/provenance.schema.json @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/release-approval-gate.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/run-build-container-gate.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/select-build-container-range.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/stage-build-context.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/update-image-pin-pr.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/verify-build-container-publication.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/verify-gate-rotation-lock.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/verify-published-image.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/verify-release-prerequisites.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/verify-toolchain.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/write-image-release-record.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/docker/build-app-cli/write-publisher-prerequisite.sh @stackpop/edgezero-build-container-gate-reviewers
+/.github/tools/edgezero-provenance-validator/Cargo.lock @stackpop/edgezero-build-container-gate-reviewers
+/.github/tools/edgezero-provenance-validator/Cargo.toml @stackpop/edgezero-build-container-gate-reviewers
+/.github/tools/edgezero-provenance-validator/src/archive.rs @stackpop/edgezero-build-container-gate-reviewers
+/.github/tools/edgezero-provenance-validator/src/command.rs @stackpop/edgezero-build-container-gate-reviewers
+/.github/tools/edgezero-provenance-validator/src/elf.rs @stackpop/edgezero-build-container-gate-reviewers
+/.github/tools/edgezero-provenance-validator/src/extract.rs @stackpop/edgezero-build-container-gate-reviewers
+/.github/tools/edgezero-provenance-validator/src/json_contract.rs @stackpop/edgezero-build-container-gate-reviewers
+/.github/tools/edgezero-provenance-validator/src/lib.rs @stackpop/edgezero-build-container-gate-reviewers
+/.github/tools/edgezero-provenance-validator/src/main.rs @stackpop/edgezero-build-container-gate-reviewers
+/.github/tools/edgezero-provenance-validator/src/orchestration.rs @stackpop/edgezero-build-container-gate-reviewers
+/.github/tools/edgezero-provenance-validator/src/self_test.rs @stackpop/edgezero-build-container-gate-reviewers
+/.github/tools/edgezero-provenance-validator/tests/cli.rs @stackpop/edgezero-build-container-gate-reviewers
+/.github/workflows/build-container-ci.yml @stackpop/edgezero-build-container-gate-reviewers
+/.github/workflows/publish-build-container.yml @stackpop/edgezero-build-container-gate-reviewers
+/.github/workflows/rotate-build-container-gate.yml @stackpop/edgezero-build-container-gate-reviewers
+/.github/zizmor.yml @stackpop/edgezero-build-container-gate-reviewers
+/.tool-versions @stackpop/edgezero-build-container-gate-reviewers
+/docs/package-lock.json @stackpop/edgezero-build-container-gate-reviewers
+/docs/package.json @stackpop/edgezero-build-container-gate-reviewers
+/scripts/install-actionlint.sh @stackpop/edgezero-build-container-gate-reviewers
+/scripts/install-yq.sh @stackpop/edgezero-build-container-gate-reviewers
+/scripts/run-actionlint.sh @stackpop/edgezero-build-container-gate-reviewers

.github/actions/build-app-cli/action.yml

@@ -245,7 +245,7 @@ runs:
     # step's note): a custom provider secret should be scoped to the one step that
     # needs it, never to job-level `env:` shared with the build.
     - name: Upload CLI artifact
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v7.0.1
       env:
         FASTLY_API_TOKEN: ""
         FASTLY_SERVICE_ID: ""

.github/actions/config-push-fastly/action.yml

@@ -120,7 +120,7 @@ runs:
       run: exec "$GITHUB_ACTION_PATH/scripts/validate.sh"
 
     - name: Download CLI artifact
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@v8.0.1
       with:
         name: ${{ inputs['app-cli-artifact'] }}
         path: ${{ steps.ws.outputs.root }}/cli-download

.github/actions/deploy-core/tests/assert-build-container-app-token.test.sh

@@ -0,0 +1,117 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+ASSERT="$DIR/../../../docker/build-app-cli/assert-build-container-app-token.sh"
+WORK=$(mktemp -d)
+WORK=$(cd -- "$WORK" && pwd -P)
+trap 'rm -rf "$WORK"' EXIT
+FAKE_BIN="$WORK/bin"
+mkdir -p "$FAKE_BIN"
+
+cat >"$FAKE_BIN/curl" <<'SH'
+#!/usr/bin/env bash
+set -euo pipefail
+fixture=$(cd -- "$(dirname -- "$0")" && pwd)
+[[ "$LC_ALL" == C ]]
+[[ -z "${GITHUB_TOKEN+x}${GH_TOKEN+x}${HTTPS_PROXY+x}${HTTP_PROXY+x}${ALL_PROXY+x}${HOME+x}${XDG_CONFIG_HOME+x}${CURL_HOME+x}" ]]
+printf '%s\n' "$@" >"$fixture/args"
+cat >"$fixture/config"
+cat "$fixture/reply"
+SH
+chmod 0755 "$FAKE_BIN/curl"
+
+pass=0
+fail=0
+
+write_reply() {
+  local full_name=${1:-stackpop/edgezero} status=${2:-200}
+  local version=${3:-2026-03-10} media=${4:-application/json}
+  jq -cn --arg full_name "$full_name" \
+    '{id:123456789,full_name:$full_name,private:false,visibility:"public"}' >"$FAKE_BIN/body"
+  {
+    cat "$FAKE_BIN/body"
+    printf '\n%s\n%s\n%s' "$status" "$version" "$media"
+  } >"$FAKE_BIN/reply"
+}
+
+run_assert() {
+  PATH="$FAKE_BIN:$PATH" \
+    EDGEZERO_APP_TOKEN="${TOKEN:-fixture-token}" \
+    EDGEZERO_INSTALLATION_ID="${INSTALLATION_ID:-12345}" \
+    EDGEZERO_EXPECTED_INSTALLATION_ID="${EXPECTED_INSTALLATION_ID:-12345}" \
+    bash "$ASSERT"
+}
+
+assert_pass() {
+  local description=$1
+  if run_assert >"$WORK/stdout" 2>"$WORK/stderr" &&
+    [[ ! -s "$WORK/stdout" && ! -s "$WORK/stderr" ]]; then
+    printf '  \033[32mok\033[0m   %s\n' "$description"
+    pass=$((pass + 1))
+  else
+    cat "$WORK/stdout" "$WORK/stderr" >&2
+    printf '  \033[31mFAIL\033[0m %s\n' "$description" >&2
+    fail=$((fail + 1))
+  fi
+}
+
+assert_fail() {
+  local description=$1
+  if run_assert >"$WORK/stdout" 2>"$WORK/stderr"; then
+    printf '  \033[31mFAIL\033[0m %s\n' "$description" >&2
+    fail=$((fail + 1))
+  elif [[ -s "$WORK/stdout" ]]; then
+    cat "$WORK/stdout" >&2
+    printf '  \033[31mFAIL\033[0m %s emitted stdout\n' "$description" >&2
+    fail=$((fail + 1))
+  else
+    printf '  \033[32mok\033[0m   %s\n' "$description"
+    pass=$((pass + 1))
+  fi
+}
+
+echo '== protected publisher App token probe =='
+write_reply
+assert_pass 'exact installation token can read only the expected repository identity'
+if grep -qF 'Authorization: Bearer fixture-token' "$FAKE_BIN/config" &&
+  ! grep -qF 'fixture-token' "$FAKE_BIN/args"; then
+  printf '  \033[32mok\033[0m   token is passed through config stdin and never argv\n'
+  pass=$((pass + 1))
+else
+  printf '  \033[31mFAIL\033[0m token is passed through config stdin and never argv\n' >&2
+  fail=$((fail + 1))
+fi
+if awk 'previous == "--connect-timeout" && $0 == "10" { found = 1 } { previous = $0 } END { exit !found }' \
+  "$FAKE_BIN/args"; then
+  printf '  \033[32mok\033[0m   API probe fixes the connection timeout at 10 seconds\n'
+  pass=$((pass + 1))
+else
+  printf '  \033[31mFAIL\033[0m API probe fixes the connection timeout at 10 seconds\n' >&2
+  fail=$((fail + 1))
+fi
+
+INSTALLATION_ID=12346
+assert_fail 'action installation output must equal protected environment value'
+unset INSTALLATION_ID
+EXPECTED_INSTALLATION_ID=012345
+assert_fail 'installation IDs must be canonical positive integers'
+unset EXPECTED_INSTALLATION_ID
+TOKEN=$'bad\ntoken'
+assert_fail 'line-breaking token is rejected'
+unset TOKEN
+
+write_reply other/repository
+assert_fail 'repository substitution is rejected'
+write_reply stackpop/edgezero 302
+assert_fail 'redirect response is rejected'
+write_reply stackpop/edgezero 200 2022-11-28
+assert_fail 'wrong selected API version is rejected'
+write_reply stackpop/edgezero 200 2026-03-10 text/json
+assert_fail 'wrong response media type is rejected'
+
+if ((fail)); then
+  printf '\n%d passed, %d failed\n' "$pass" "$fail" >&2
+  exit 1
+fi
+printf '\n%d passed, %d failed\n' "$pass" "$fail"