Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

.gitea/workflows/public-candidate-acceptance.yml

@@ -1,6 +1,6 @@
 name: Public candidate server acceptance
 
-# Builds only an exact, curated public-source commit in a disposable Compose namespace. This job
+# Builds only an exact, curated public-source commit in a disposable validation Compose namespace. This job
 # never calls the Unraid deploy controller and cannot select the production deployment action.
 on:
   workflow_dispatch:
@@ -14,6 +14,11 @@ on:
         required: true
         default: https://modelforge.example.test
         type: string
+      retain_image_bundle:
+        description: Retain the verified four-image Docker bundle for P12-P15 qualification
+        required: false
+        default: false
+        type: boolean
   workflow_call:
     inputs:
       source_commit:
@@ -24,6 +29,11 @@ on:
         description: Bare API origin compiled into the candidate Console image
         required: true
         type: string
+      retain_image_bundle:
+        description: Retain the verified four-image Docker bundle for P12-P15 qualification
+        required: false
+        default: false
+        type: boolean
 
 permissions:
   contents: read
@@ -140,14 +150,23 @@ jobs:
         shell: bash
         env:
           PUBLIC_API_ORIGIN: ${{ inputs.public_api_origin }}
+          RETAIN_IMAGE_BUNDLE: ${{ inputs.retain_image_bundle }}
+          SOURCE_COMMIT: ${{ inputs.source_commit }}
         run: |
           set -euo pipefail
           cd "${PUBLIC_SOURCE}"
-          python3 scripts/rc_server_acceptance.py \
-            --public-api-origin "${PUBLIC_API_ORIGIN}" \
-            --trivy "${TRIVY}" \
-            --output acceptance-evidence \
+          arguments=(
+            --public-api-origin "${PUBLIC_API_ORIGIN}"
+            --canonical-source-commit "${SOURCE_COMMIT}"
+            --trivy "${TRIVY}"
+            --output acceptance-evidence
             --project-suffix "${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          )
+          if [[ "${RETAIN_IMAGE_BUNDLE}" == "true" ]]; then
+            arguments+=(--retain-image-bundle)
+          fi
+          python3 scripts/rc_server_acceptance.py \
+            "${arguments[@]}"
 
       - name: Always remove acceptance Docker resources
         if: always()
@@ -157,7 +176,7 @@ jobs:
           cleanup_failed=0
           suffix="$(printf '%s' "${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" \
             | tr '[:upper:]' '[:lower:]' | tr -cd '[:alnum:]' | tail -c 24)"
-          project="modelforge-rc-${suffix}"
+          project="modelforge-validation-${suffix}"
           for kind in container volume network; do
             while IFS= read -r resource; do
               [[ -n "${resource}" ]] || continue
@@ -171,7 +190,7 @@ jobs:
           done
 
           if [[ -n "${PUBLIC_SOURCE:-}" && -d "${PUBLIC_SOURCE}/.git" ]]; then
-            candidate_commit="$(git -C "${PUBLIC_SOURCE}" rev-parse HEAD 2>/dev/null)"
+            canonical_commit="${{ inputs.source_commit }}"
             version="$(tr -d '\r\n' < "${PUBLIC_SOURCE}/VERSION" 2>/dev/null)"
             for image in modelforge-api modelforge-web modelforge-node-agent \
                          modelforge-runtime-worker; do
@@ -179,7 +198,7 @@ jobs:
               revision="$(docker inspect --format \
                 '{{index .Config.Labels "org.opencontainers.image.revision"}}' \
                 "${tag}" 2>/dev/null)"
-              if [[ -n "${candidate_commit}" && "${revision}" == "${candidate_commit}" ]]; then
+              if [[ "${revision}" == "${canonical_commit}" ]]; then
                 docker image rm --force "${tag}" || cleanup_failed=1
               fi
             done
@@ -208,6 +227,8 @@ jobs:
             ${{ env.PUBLIC_SOURCE }}/acceptance-evidence/*.json
             ${{ env.PUBLIC_SOURCE }}/acceptance-evidence/*.txt
             ${{ env.PUBLIC_SOURCE }}/acceptance-evidence/release/*.json
+            ${{ env.PUBLIC_SOURCE }}/acceptance-evidence/release/*.tar
+            ${{ env.PUBLIC_SOURCE }}/acceptance-evidence/release/*.tar.gz
             ${{ env.PUBLIC_SOURCE }}/acceptance-evidence/release/*SHA256SUMS
           if-no-files-found: warn
           retention-days: 90