Skip to content

docs(infra): note agent-image publish lane superseded-in-part by unified release lane (RIG-1746) #740

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mattwilkinsonn merged 2 commits into from
Aug 30, 2026
+18 −0
Merged

docs(infra): note agent-image publish lane superseded-in-part by unified release lane (RIG-1746) #740

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
80fcdb3
docs(infra): note agent-image publish lane superseded-in-part by unif…
rigel-mintaka Aug 30, 2026
42f61a3
docs(infra): list linux/amd64 platform contract in stays-live enumera…
rigel-mintaka Aug 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions docs/designs/infra/ci/compass-agent-image-publish/design.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,24 @@ Tracking: RIG-1690 (blocks compass-native RIG-1683/T2, RIG-1685/T4, RIG-1687/T6)
> sealed design corpus (`docs/designs/infra/ci/`) because that is where the wave's design
> records freeze; the `docs/designs/product/*` cross-references (e.g. DL-112)
> are paths in this (sealed) corpus.
>
> **Superseded in part** (RIG-1746, Matt 2026-08-25): the *CI-placement*
> decision below — a separate `.github/workflows/publish-agent-image.yml`
> workflow (§"CI placement — a separate least-privilege workflow, a principled
> exception to ONE-JOB") — is superseded by the unified release lane
> ([`compass-unified-release-lane.md`](../../../platform/compass-unified-release-lane.md),
> DL-298–301). That lane RELOCATES this lane's per-push publish DUTY verbatim —
> the same `publish.sh` no-args call, the same closure-paths gate, the same
> serialize / immutability / two-copy-coherence / least-privilege /
> off-hot-path posture — into a `publish-image` job, and the standalone
> workflow FILE retires in a two-PR staged delete (land the fold, observe one
> green per-push run, then delete). Every OTHER decision here stays live and is
> carried into that lane unchanged: the tag name/tag contract (`:git-<sha>`
> immutable pin + `:latest` fallback), the build-once/push-each-tag skopeo
> mechanism, the `GITHUB_TOKEN` + `REGISTRY_AUTH_FILE` auth pin, the
> `linux/amd64` single-arch platform contract, and the public-visibility
> ruling. This record therefore remains the cited authority
> for the baked `:git-<sha>` pin.

## Problem / Intent

Expand Down
Loading