Add manual-only relay image publishing by ravarora2 · Pull Request #9303 · block/buzz

ravarora2 · 2026-11-09T21:38:41Z

Summary

Add Manual relay image, a manual-only GitHub Actions workflow that builds and uploads a Buzz relay image from a chosen repository branch, tag or full commit SHA. It does not wait for normal CI checks or require the chosen source to be merged to main.

This PR changes only .github/workflows/docker-manual.yml. It adds no scripts or runbook. The normal Docker release workflow and existing staging-only workflow are unchanged.

What the workflow does

Resolves source_ref to one exact source commit.
Builds the existing Dockerfile's runtime target on native AMD64 and ARM64 runners.
Uploads each architecture to ghcr.io/block/buzz using the existing GITHUB_TOKEN.
Publishes a unique manual-<source-sha12>-<run-id>-<attempt> tag when both builds succeed.
Verifies that the published image contains exactly one runtime for each architecture and that both runtime source labels match the selected commit.
Reports the source SHA, registry tag and combined digest in the run summary and a downloadable JSON artifact.

There are no push, pull-request or scheduled triggers. The workflow does not run the test suite, wait for ci.yml, or require a successful CI qualification. The source must still build successfully, and image verification must succeed before the workflow reports success.

Run from GitHub UI

Open Buzz Actions.
Select Manual relay image.
Click Run workflow and select main or the repository branch containing the workflow definition you want to run.
Enter your block/buzz branch, tag or full SHA in source_ref. Example: fix-db-timeout. The commit must be reachable from a repository branch; PR refs and PR-only commits are rejected.
Click Run workflow and wait for both builds and Publish and verify the combined image to succeed.
Open the run summary and copy its registry tag and digest.

source_ref is the code you want to build. The workflow branch selects the build instructions and may be non-main; CLI --ref selects that branch. Your source branch does not need to merge. This new workflow appears in the UI once its definition is on the default branch.

Run from CLI

You need GitHub CLI authenticated as a collaborator who can run workflows. No repository checkout, laptop Docker setup, AWS login or personal package-publishing token is required.

# First-time GitHub CLI login only; skip if already authenticated.
gh auth login --hostname github.com --web

# Replace this with your Buzz branch, tag or full commit SHA.
export BUZZ_SOURCE_REF='fix-db-timeout'
gh workflow run docker-manual.yml \
  --repo block/buzz --ref main \
  -f source_ref="$BUZZ_SOURCE_REF"

# Find YOUR new run; its title includes the selected source_ref.
gh run list --repo block/buzz --workflow docker-manual.yml \
  --event workflow_dispatch --limit 5

export BUZZ_RUN_ID='REPLACE_WITH_YOUR_RUN_ID'
gh run watch "$BUZZ_RUN_ID" --repo block/buzz --exit-status
gh run view "$BUZZ_RUN_ID" --repo block/buzz --web

Source and workflow selection

Dispatch may use main or another branch in block/buzz. CLI --ref selects the workflow definition; -f source_ref=... separately selects the code to build. For example, --ref feature/build-tooling -f source_ref=fix-db-timeout runs the feature branch's workflow against the fix branch's code. The dispatcher is responsible for selecting trusted workflow instructions.

The resolver has no package-write permission and runs no selected-source scripts. It validates the input, fetches canonical branch histories, and proves the selected commit is reachable from a repository branch before either publishing job can start. A full SHA cannot bypass the PR-ref restriction. Tags that point only to unreachable or PR-only commits are rejected too.

Before this new workflow is registered on the default branch, its exact definition can be tested through the existing workflow path on the isolated test branch:

gh workflow run docker.yml --repo block/buzz \
  --ref codex/manual-relay-image-test -f source_ref=fix-db-timeout

This runs a fresh build of the selected repository source. It does not modify the default branch's normal workflow.

Image output and deployment

The summary reports an immutable reference such as ghcr.io/block/buzz@sha256:.... The manual-image-<run-id>-<attempt> artifact contains the same digest, source identity and per-architecture digests. Keep the actual manual-* tag as deployment/version metadata alongside the digest. No synthetic sha-* deployment tag or registry alias is emitted.

The image registry is shared by consumers; the workflow does not select staging or production. Downstream deployment configuration selects the image digest and environment. This workflow does not edit deployment manifests, sync Argo CD, restart workloads, overwrite normal release tags, or upload directly to AWS ECR. Any downstream cache import and deployment are separate operations.

Manual images do not receive the normal CI deployment-eligibility attestation. They are not automatically eligible for canonical promotion. The selected code and any skipped checks must be evaluated before an explicit deployment.

Testing

The earlier implementation completed a real two-architecture build and publish in run 42704887052. Its image was also verified in the downstream ECR cache.

The build-and-publish path passed run 42713322329 for unmerged source beda6eeaec8ca4a00231a05a079eb168d2a6aec2. Both native builds and combined-image verification succeeded. That run predates the source restrictions added during review.

The current resolver and workflow-origin guard were executed directly from this YAML against local Git fixtures: 19 source cases and 3 origin cases passed. These include accepting internal branches/tags/ancestor SHAs and rejecting PR refs, the raw SHA of a PR-only commit, unreachable tags, malformed inputs and a foreign repository. Main and non-main workflow refs are both accepted in block/buzz. Live resolution of a block/buzz feature branch also passed. The exact image verifier passed valid-image cases and rejected missing/duplicate platforms, wrong architecture and wrong source. No deployment was started.

Full local just ci stopped at the existing mobile formatting check (exit 65), with an unresolved flutter_lints/flutter.yaml include. The repository-wide check is not green; no mobile source was changed by this PR.

Related issue

No matching issue found. The existing staging-dev workflow publishes to a distinct staging-only package and accepts branches/tags; this workflow adds general manual publication and raw commit selection.

Signed-off-by: Ravneet Arora <[email protected]>

github-actions · 2026-11-09T22:44:29Z

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

Exact PR diff: 402bd1897f8b7a822819e13fe8afa20037dd1865...55260c24ffb3aa4f7b5bec3b15d5a5c12ff6a56c

Model: gpt-6.1-sol

💡 Click "edited" above to see earlier reviews for this PR.

Review Summary

Overall Risk: NONE

Reviewed source resolution, publishing permissions, cache separation, digest verification, and surrounding release paths. No concrete findings identified in the authorized PR range.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

Review used read-only inspection. Workflows, builds, and tests were not executed; external action implementations were not verified.

_{Generated by Codex Security Review |

Requested by: @ravarora2 |

Workflow run}

Signed-off-by: Ravneet Arora <[email protected]>

TheSentinel454

🤖 Three recommended blockers inline (canonical package target, PR-ref builds with packages: write, misleading sha-<7> deployment tag) plus two optional notes.

TheSentinel454 · 2026-11-09T23:08:40Z

+  cancel-in-progress: false
+
+env:
+  IMAGE_NAME: ${{ vars.GHCR_IMAGE != '' && vars.GHCR_IMAGE || 'ghcr.io/block/buzz' }}


🤖 This publishes CI-unqualified, unmerged builds into the canonical public ghcr.io/block/buzz package that operators and distributors pull. docker.yml deliberately gates that package on a same-SHA CI qualification plus provenance attestation, and staging-dev-relay-image.yml already exists to keep pre-merge images in a separate ghcr.io/block/buzz-staging-dev package. Could this extend staging-dev-relay-image.yml (add full-SHA input) instead of adding a second, parallel manual workflow that targets the release package?

🤖 Keeping ghcr.io/block/buzz for the requested operator-triggered emergency deployment path, including production. Extending a staging-only publisher would not cover that requirement. This remains an explicit exception to normal CI qualification: it publishes unique manual-* tags, does not overwrite normal release tags or issue deployment-eligibility attestations, and does not deploy automatically. The package-separation concern is understood; this revision intentionally retains the requested destination.

TheSentinel454 · 2026-11-09T23:08:40Z

+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          ref: ${{ inputs.source_ref }}


🤖 Accepting refs/pull/NUMBER/head (L10) lets a dispatch build fork-contributed source in a job holding packages: write. A Dockerfile # syntax= frontend from that source runs inside BuildKit with session access to the registry credentials. staging-dev-relay-image.yml rejects refs/pull/* for this reason. Please reject PR refs and validate source_ref the same way (character allowlist, length, no ..).

🤖 Fixed in 17416ca (retained in current head 55260c2). Input validation rejects PR refs, unsupported characters, excessive length, .., option-like inputs and .lock suffixes. The read-only resolver fetches canonical branch histories and requires the selected commit—including a raw SHA or tag target—to be reachable from a block/buzz branch before publishing jobs can start. It runs no selected-source scripts. Tested 19 source cases, including rejection of a PR-only commit supplied directly by SHA and a tag pointing to an unreachable commit; live internal-branch resolution also passed.

TheSentinel454 · 2026-11-09T23:08:40Z

+          jq -n --arg image "$pinned" --arg tag "$image" --arg digest "$merged_digest" \
+            --arg sha "$SOURCE_SHA" --arg source "$source_url" --argjson platforms "$runtime_digests" \
+            '{image:$image, tag:$tag, digest:$digest, source_sha:$sha, source_url:$source,
+              platforms:$platforms, deployment_tag:("sha-" + $sha[0:7]),


🤖 deployment_tag: sha-<7> (also printed at L191) names a tag this workflow never publishes. It matches the canonical docker.yml tag pattern that downstream deployment checks accept as CI-qualified, so the summary nudges operators to label an unqualified image as if it were a normal main build. Please drop it and keep manual-* plus the digest as the only identifiers.

🤖 Fixed in 17416ca. Removed deployment_tag and the synthetic sha-<7> summary entry; the hosted and laptop publishers now retain only the actual manual-* registry tag and verified digest as image identifiers. Companion deployment validation explicitly accepts the two manual tag formats while preserving digest pins and matching rendered identity. Manual tags remain ineligible as automated promotion targets; a normal release may replace an existing manual image with a different digest. Publisher/deployment identity tests and all 44 promotion-guard tests passed.

TheSentinel454 · 2026-11-09T23:08:40Z

+on:
+  workflow_dispatch:
+    inputs:
+      source_ref:
+        description: Branch, tag, full commit SHA, or refs/pull/NUMBER/head to build
+        required: true
+        type: string
+


🤖 Optional: unlike staging-dev-relay-image.yml, nothing enforces github.ref == refs/heads/main or github.repository == block/buzz, so a branch copy of this file (like the codex/manual-relay-image-test branch overlaying docker.yml) can publish with unreviewed instructions. Consider the same guard step.

🤖 Added the github.repository == block/buzz guard. We are intentionally retaining dispatch from non-main repository branches because running a branch-specific workflow definition is part of the requested operator/test flow. --ref selects that workflow definition; source_ref separately selects the code to build. The dispatcher must trust the selected workflow branch. The brief main-only restriction was removed in 55260c2, and the test branch matches the current definition. Tests confirm both main and non-main refs are accepted in block/buzz while a foreign repository is rejected.

TheSentinel454 · 2026-11-09T23:08:40Z

+concurrency:
+  group: manual-relay-image-${{ github.run_id }}
+  cancel-in-progress: false


🤖 Optional: a concurrency group keyed on github.run_id never contends, so this block does nothing. Suggest removing it.

🤖 Removed in 17416ca. The group was unique to each run and did not provide cross-run concurrency control.

Signed-off-by: Ravneet Arora <[email protected]>

TheSentinel454

🤖 LGTM at 55260c2. PR refs and PR-only SHAs are now rejected, the synthetic sha-<7> tag is gone, and the buzz Kargo warehouse only admits main-* tags, so manual-* images never auto-promote. Publishing to the canonical package is accepted as the explicit emergency path described above.

…e-mode * origin/main: ci(docker): skip relay image publishes for main pushes outside the build context (#9310) Add manual-only relay image publishing (#9303) fix(mobile): bump Flutter to 3.47.9 for Android TLS fix (#9309) Serve video and poster previews for invite links (#9306) docs: point the README to Buzz 1.0 in block/buzz-app (#9296) fix(db): give the replica-fence probe its own pool and instrument it (#9297) fix(relay): never close connections when cross-node fan-out falls behind (#9302) test: fix timing-dependent unit tests in buzz-cli, buzz-agent and buzz-admin (#9273) fix(ci): classify hermit retry timeouts by watchdog kill, not whole seconds (#9274) test(ios): wait for a key, foreground-active window before presenting in RunnerTests (#9275) test(desktop): wait on real readiness signals in audience and community-rail specs (#9277) Signed-off-by: Will Pfleger <[email protected]>

* origin/main: Add swipeable photo stacks and native iOS gallery preview (#9259) ci(docker): skip relay image publishes for main pushes outside the build context (#9310) Add manual-only relay image publishing (#9303) fix(mobile): bump Flutter to 3.47.9 for Android TLS fix (#9309) Serve video and poster previews for invite links (#9306) docs: point the README to Buzz 1.0 in block/buzz-app (#9296) Signed-off-by: Philip Azar <[email protected]>

Co-Authored-By: Claude Opus 5.5 <[email protected]> * origin/main: (22 commits) chore(deps): bump hickory-proto to 0.26.2 for RUSTSEC-2026-0487..0491 (#9351) feat(mobile/ios): show the message's own text in notifications (#9346) feat(mobile): prefill the agents you last tagged in a conversation (#9248) feat(mobile): start a Solo chat from a message or inbox row (#9251) feat(mobile): link to Builderlab web from Settings (#9300) fix(relay): bound invite preview host lookup (#9308) fix(relay): saturate filter limits instead of casting (#9230) fix(mobile): tell same-name agents apart in Solo (#9321) fix(mobile): join an open channel from the chat footer (#9253) fix(relay): fence pending subscriptions on close or replacement (#2382) fix(mobile): hide archived people and agents from choices; give them their own members section (#9320) Add video stacks and native iOS zoom playback (#9316) Support PNG and HEIC photos in the native iOS zoom gallery (#9314) fix(mobile): list known people in recipient pickers before a name is typed (#9311) feat(mobile): mark edited messages after the body (#8863) Add swipeable photo stacks and native iOS gallery preview (#9259) ci(docker): skip relay image publishes for main pushes outside the build context (#9310) Add manual-only relay image publishing (#9303) fix(mobile): bump Flutter to 3.47.9 for Android TLS fix (#9309) Serve video and poster previews for invite links (#9306) ... Signed-off-by: Philip Azar <[email protected]>

Add manual relay image publishing

9c7d25b

Signed-off-by: Ravneet Arora <[email protected]>

ravarora2 closed this Nov 9, 2026

Keep manual image publishing self-contained

beda6ee

Signed-off-by: Ravneet Arora <[email protected]>

ravarora2 reopened this Nov 9, 2026

ravarora2 changed the title ~~Add manual relay image publishing~~ Add manual-only relay image publishing Nov 9, 2026

ravarora2 marked this pull request as ready for review November 9, 2026 22:41

ravarora2 requested a review from a team as a code owner November 9, 2026 22:41

ravarora2 temporarily deployed to codex-review November 9, 2026 22:42 — with GitHub Actions Inactive

ravarora2 requested a review from TheSentinel454 November 9, 2026 22:42

github-actions Bot added the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 9, 2026

Report source tag for manual image deployment

013a5bf

Signed-off-by: Ravneet Arora <[email protected]>

github-actions Bot removed the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 9, 2026

ravarora2 temporarily deployed to codex-review November 9, 2026 22:55 — with GitHub Actions Inactive

github-actions Bot added the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 9, 2026

ravarora2 requested a review from salman1993 November 9, 2026 23:03

TheSentinel454 reviewed Nov 9, 2026

View reviewed changes

Restrict manual sources and preserve manual identity

17416ca

Signed-off-by: Ravneet Arora <[email protected]>

ravarora2 temporarily deployed to codex-review November 9, 2026 23:32 — with GitHub Actions Inactive

github-actions Bot added codex-security-review-current The posted Codex security review matches its recorded range. and removed codex-security-review-current The posted Codex security review matches its recorded range. labels Nov 9, 2026

Allow manual workflow dispatch from repository branches

55260c2

Signed-off-by: Ravneet Arora <[email protected]>

github-actions Bot removed the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 9, 2026

ravarora2 temporarily deployed to codex-review November 9, 2026 23:35 — with GitHub Actions Inactive

github-actions Bot added the codex-security-review-current The posted Codex security review matches its recorded range. label Nov 9, 2026

TheSentinel454 approved these changes Nov 10, 2026

View reviewed changes

ravarora2 merged commit 3e9d2e9 into main Nov 10, 2026
42 checks passed

ravarora2 deleted the codex/manual-relay-image branch November 10, 2026 00:10

Conversation

ravarora2 commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What the workflow does

Run from GitHub UI

Run from CLI

Source and workflow selection

Image output and deployment

Testing

Related issue

Uh oh!

github-actions Bot commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔐 Codex Security Review

Review Summary

Findings

Notes

Uh oh!

TheSentinel454 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

TheSentinel454 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ravarora2 commented Nov 9, 2026 •

edited

Loading

github-actions Bot commented Nov 9, 2026 •

edited

Loading