diff --git a/.rabbit/README.md b/.rabbit/README.md index 0d3b679..d686305 100644 --- a/.rabbit/README.md +++ b/.rabbit/README.md @@ -1,41 +1,34 @@ # Rabbit CI -This directory owns Rabbit-facing repo context for `udx/worker-php`. +`worker-php` publishes the PHP Worker runtime image. It does not own tenant +Rabbit lifecycle manifests, environment configuration, or deployment secrets. -`worker-php` is a runtime image repo. It publishes the Docker image that PHP -Worker-based applications can consume, but it does not own tenant-specific -Rabbit lifecycle manifests or environment config. +## Repository resolution -## Entry Points +[`repo.yaml`](./repo.yaml) is generated by `rabbit.ci`. It records the +repository's observable GitHub delivery shape: branch rules, GitHub Environments, +workflow triggers, and configured secret and variable names. It never includes +secret or variable values. -- Generated repo context: [`context.yaml`](./context.yaml) -- Image release workflow: [`../.github/workflows/docker-ops.yml`](../.github/workflows/docker-ops.yml) -- Worker config contract: [`../worker.yaml`](../worker.yaml) -- Worker config reference: [`../docs/worker-config.md`](../docs/worker-config.md) -- Runtime image contract: [`../Dockerfile`](../Dockerfile) +Regenerate the resolution after changing a GitHub workflow, branch protection, +Environment, or configured secret or variable name: -## Rabbit Delivery Path - -1. Changes to `Dockerfile`, `bin/**`, `ci/**`, `etc/**`, `src/**`, or the - Docker workflow run the Docker operations workflow. -2. The workflow delegates image build, scan, release, and publish behavior to - `udx/reusable-workflows`. -3. The `latest` branch is the release branch for published `worker-php` images. -4. Tenant repos reference the published image from their own Rabbit lifecycle - manifests or deployment config. -5. Tenant runtime values and secrets belong in the tenant repo or target - platform. Image-level defaults and secret references belong in - [`../worker.yaml`](../worker.yaml). +```bash +rabbit.ci +``` -## Repo Context +Review and commit the resulting diff with the source change. Do not edit +`repo.yaml` manually. -[`context.yaml`](./context.yaml) is generated by `dev.kit repo`. Do not edit it -manually. Refresh it after changing repo-owned docs, manifests, workflows, or -runtime contracts: +## Delivery entry points -```bash -dev.kit repo -``` +- Image release workflow: [`../.github/workflows/docker-ops.yml`](../.github/workflows/docker-ops.yml) +- Worker config contract: [`../worker.yaml`](../worker.yaml) +- Worker config reference: [`../docs/worker-config.md`](../docs/worker-config.md) +- Runtime image contract: [`../Dockerfile`](../Dockerfile) -Review the generated context before relying on it in an agent session or Rabbit -CI workflow. +Changes to `Dockerfile`, `bin/**`, `ci/**`, `etc/**`, `src/**`, or the Docker +workflow run the Docker operations workflow. It delegates image build, scan, +release, and publishing to `udx/reusable-workflows`; `latest` is the release +branch. Tenant repositories consume the published image from their own Rabbit +manifests or deployment configuration. diff --git a/.rabbit/context.yaml b/.rabbit/context.yaml deleted file mode 100644 index 9ff6a4a..0000000 --- a/.rabbit/context.yaml +++ /dev/null @@ -1,105 +0,0 @@ -# Generated by dev.kit repo — do not edit manually. -# Run `dev.kit repo` to refresh. -kind: repoContext -version: udx.dev/dev.kit/v1 -generator: - tool: dev.kit - repo: https://github.com/udx/dev.kit - version: 0.20.0 - generated_at: 2026-07-08T15:46:44Z - sources: - homepage: https://udx.dev/kit - repository: https://github.com/udx/dev.kit - package: https://www.npmjs.com/package/@udx/dev-kit - installation: https://github.com/udx/dev.kit/blob/latest/docs/installation.md - -repo: - name: worker-php - archetype: manifest-repo - -# Refs — Direct-read files and paths that define the repo contract. -# Note: Include only files or directories a repo consumer should read before code exploration. -# Note: Prefer README, focused docs, workflows, manifests, and explicit operational files. -# Note: Exclude broad implementation directories unless they are the contract themselves. - -refs: - - ./README.md - - ./Makefile - - ./worker.yaml - - ./.github/workflows - - ./Dockerfile - - ./docs - -# Commands — Canonical repo entrypoints detected from strong repo signals. -# Note: Prefer declared make targets and package scripts before regex matches in docs. -# Note: Emit only commands that can be traced to a concrete source. -# Note: Record the source path so the command can be reviewed and corrected. - -commands: - verify: - run: make test - source: Makefile - build: - run: make build - source: Makefile - run: - run: make run - source: Makefile - -# Dependencies — Meaningful dependency-repo contracts such as reusable workflows, images, or versioned manifests this repo relies on. -# Note: Capture execution-shaping behavior defined outside the current checkout. -# Note: Avoid promoting standard package inventory or ordinary GitHub action refs into top-level context. -# Note: Normalize same-org versioned refs into repo slugs when possible. - -dependencies: - - repo: udx/reusable-workflows - kind: reusable workflow - resolved: true - archetype: manifest-repo - used_by: - - .github/workflows/docker-ops.yml - - repo: usabilitydynamics/udx-worker:0.45.0 - kind: base image - resolved: true - source_repo: udx/worker - archetype: manifest-repo - used_by: - - Dockerfile - - repo: udx/worker - kind: manifest contract (config) - resolved: true - declared_as: udx.io/worker-v1/config - archetype: manifest-repo - used_by: - - worker.yaml - -# Manifests — YAML files that define repo-specific workflow, deploy, or contract behavior. -# Note: Include custom config/manifests that materially shape repo behavior or contract understanding. -# Note: Do not include workflow YAML only because it lives under .github/workflows. -# Note: Promote workflow files only when they declare reusable workflow refs or other repo-specific execution contracts. -# Note: Prefer structured kind and description metadata from the manifest itself. -# Note: Include hidden or nested contract dirs when they contain repo-owned manifests with meaningful metadata. - -manifests: - - path: .github/workflows/docker-ops.yml - kind: githubWorkflow - used_by: - - .rabbit/README.md - - README.md - evidence: - - path reference: .rabbit/README.md - - path reference: README.md - - path: worker.yaml - kind: workerConfig - declared_as: udx.io/worker-v1/config - source_repo: udx/worker - used_by: - - .rabbit/README.md - - README.md - - docs/worker-config.md - evidence: - - version: udx.io/worker-v1/config - - github reference: udx/worker - - path reference: .rabbit/README.md - - path reference: README.md - - path reference: docs/worker-config.md diff --git a/.rabbit/repo.yaml b/.rabbit/repo.yaml new file mode 100644 index 0000000..2fcffbc --- /dev/null +++ b/.rabbit/repo.yaml @@ -0,0 +1,85 @@ +kind: repo +version: udx.dev/rabbit.ci/repo/v1 +repository: + name: worker-php + owner: udx + default_branch: latest +branches: + - name: chore/rabbit-ci-worker-0.52.0 + rules: {} + - name: latest + rules: + allow_deletions: false + allow_force_pushes: false + pull_request: + approvals: 1 + code_owner_review: true + stale_reviews: true + last_push_approval: false + conversation_resolution: true + merge_methods: + - merge + - squash + - rebase + copilot_review: + on_push: true + drafts: false +configuration: + secrets: + organization: + - BITBUCKET_TOKEN + - CONTEXT7_API_KEY + - DEPENDABOT_REVIEWER_TOKEN + repository: + - DOCKER_TOKEN + - GH_TOKEN + variables: + organization: + - DOCKER_LOGIN + - DOCKER_ORG + - GCP_PROJECT_ID + - GCP_REGION + - GCP_WORKLOAD_IDENTITY_PROVIDER + - GH_SERVICE_ACCOUNT_EMAIL + repository: + - DOCKER_REPO +environments: + - name: copilot + branches: + - "*" + approvals: [] + wait_minutes: 0 + admin_bypass: true + secrets: [] + variables: [] +workflows: + - path: .github/workflows/codeql-analysis.yml + triggers: + push: {} + permissions: + contents: read + - path: .github/workflows/docker-dependency-updater.yml + triggers: + schedule: + - cron: 0 5 * * 1 + workflow_dispatch: {} + permissions: + contents: read + - path: .github/workflows/docker-ops.yml + triggers: + push: + paths: + - .github/workflows/docker-ops.yml + - bin/** + - Dockerfile + - etc/** + - ci/** + - src/** + - LICENSE + workflow_dispatch: {} + - path: .github/workflows/tests.yml + triggers: + push: {} + pull_request: {} + permissions: + contents: read diff --git a/Dockerfile b/Dockerfile index 9bcd2e4..862ab85 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # Use the UDX worker as the base image -FROM usabilitydynamics/udx-worker:0.48.0 +FROM usabilitydynamics/udx-worker:0.52.0 # Add metadata labels LABEL maintainer="UDX" diff --git a/README.md b/README.md index 8cb4cb8..cee47e1 100644 --- a/README.md +++ b/README.md @@ -118,9 +118,9 @@ References: ## Rabbit CI -Rabbit-facing repo context lives in [`.rabbit/`](.rabbit/). This image repo publishes the `worker-php` Docker image; it does not own tenant-specific Rabbit lifecycle manifests. +Rabbit CI records this repository's GitHub delivery shape in [`.rabbit/repo.yaml`](.rabbit/repo.yaml). This image repo publishes the `worker-php` Docker image; it does not own tenant-specific Rabbit lifecycle manifests. -See [`.rabbit/README.md`](.rabbit/README.md) for Rabbit CI entry points, delivery notes, and generated repo context handling. +Run `rabbit.ci` after changing the repository's GitHub delivery configuration, including workflows, branch protection, Environments, or configured secret and variable names. Review and commit the generated resolution with the source change. See [`.rabbit/README.md`](.rabbit/README.md) for the resolution boundary and delivery entry points. ## Resources diff --git a/docs/worker-config.md b/docs/worker-config.md index e1b934c..0deeb25 100644 --- a/docs/worker-config.md +++ b/docs/worker-config.md @@ -28,11 +28,9 @@ Validate the manifest syntax before opening a PR: yq e '.' worker.yaml ``` -Refresh generated repo context after changing `worker.yaml` or this reference: - -```bash -dev.kit repo -``` +`worker.yaml` is an image-runtime contract. It is not part of the Rabbit CI +repository resolution; regenerate `.rabbit/repo.yaml` only when the repository's +GitHub delivery shape changes. ## Deployment Behavior