ci(canvas): deterministic ordered canvas deploy + digest-pin (core#2226) #2233

Merged

hongming merged 1 commits from fix/core2226-canvas-ordered-deploy into main 2026-06-04 09:04:19 +00:00

Conversation 2 Commits 1 Files Changed 3

+206 -51

hongming commented 2026-06-04 08:59:54 +00:00

Owner

Copy Link

Copy Source

Closes #2226

Problem

The standalone molecule-ai/canvas image had no ordered/verified deploy — unlike the platform (publish-workspace-server-image.yml: build → push :staging-<sha> → fleet redeploy → re-point :latest after /buildinfo verify). publish-canvas-image.yml only built+pushed :latest + :sha-<sha>, and docker-compose.yml:170 referenced canvas:latest unpinned (standing TODO: pin canvas ECR image digest). Tenants/hosts only picked up new canvas as a side effect of the platform fleet-redeploy pulling the mutable :latest — non-deterministic and unverifiable, hence the advisory "Canvas Deploy Reminder".

Fix — mirror the platform's ordered deploy

publish-canvas-image.yml

• build-and-push now pushes :staging-<sha> + :staging-latest (+ legacy :sha-<sha> for back-compat) and no longer moves :latest — an unpromoted/red build can never become the prod-blessed tag.
• New promote-canvas job (needs: build-and-push, if: push && main): waits for green main CI on this SHA via the same prod-auto-deploy.py wait-ci SSOT the platform deploy-production uses, then re-points :latest to the verified :staging-<sha> by digest (imagetools create, no rebuild). So :latest == the last CI-green canvas, and platform + canvas advance :latest off the identical signal/SHA. Honors the PROD_AUTO_DEPLOY_DISABLED kill-switch; reuses the platform's writable-HOME/continue-on-error patterns.

docker-compose.yml — canvas image pins via CANVAS_IMAGE_TAG (default latest = prod-blessed; set staging-<sha> or staging-<sha>@<digest> for a fully reproducible deploy). Resolves the standing TODO: pin canvas ECR image digest. Local-dev build: context unchanged.

ci.yml — replaced the advisory "Canvas Deploy Reminder" (which prescribed a manual docker compose pull canvas) with "Canvas Deploy Status" recording that the ordered deploy is now handling it. (This job was never a required branch-protection context; advisory-only.)

New deploy sequence

canvas/** merge to main → build+push :staging-<sha>/:staging-latest → promote-canvas waits green main CI on the SHA → promote :latest → :staging-<sha> by digest. Image always exists in ECR before :latest is re-pointed (mirrors the platform build-then-deploy ordering).

How it's verified

The platform's per-tenant /buildinfo already proves the tenant canvas: prod tenants serve canvas baked into platform-tenant (Dockerfile.tenant Stage 2 builds canvas/ at the same SHA), which is already ordered + /buildinfo-verified. This PR makes the standalone molecule-ai/canvas image (the co-located docker-compose canvas / canvas.moleculesai.app surface) equally deterministic: CI-green gate + immutable :staging-<sha> + digest-pin. The canvas process has no /buildinfo of its own today, so the served-SHA assertion is not yet possible for the standalone image — flagged below.

Validation

• python3 -c "yaml.safe_load(...)" parses all 3 edited files.
• lint-workflow-yaml.py — clean (no Gitea-1.22.6-hostile shapes).
• docker compose config validates; CANVAS_IMAGE_TAG default→:latest, override→:staging-<sha> both resolve; local-dev build: intact.
• pytest test_prod_auto_deploy.py test_ci_required_drift.py test_ci_workflow_bookkeeping.py — 49 passed (covers the reused wait-ci + the job rename).

Flags / follow-ups (no CP-side dependency required)

• No CP endpoint change needed. This is self-contained in core (CI workflow + compose). redeploy-fleet is unchanged — it deploys platform-tenant (which already bakes canvas), so the prod tenant fleet's canvas is already ordered+verified. This PR closes the gap for the standalone canvas image.
• Follow-up (filed-worthy): a canvas /buildinfo endpoint would let promote-canvas assert the served SHA like the platform does. Tracked in #2226's "verify per-tenant via a canvas /buildinfo" item; not built here (would touch the Next.js app + needs a deploy surface to poll).
• :staging-latest/:staging-<sha> tag scheme is new for this repo's canvas image; any external consumer pinning the legacy :sha-<sha> keeps working (still pushed).

🤖 Generated with Claude Code

Closes #2226 ## Problem The standalone `molecule-ai/canvas` image had **no ordered/verified deploy** — unlike the platform (`publish-workspace-server-image.yml`: build → push `:staging-<sha>` → fleet redeploy → re-point `:latest` after `/buildinfo` verify). `publish-canvas-image.yml` only built+pushed `:latest` + `:sha-<sha>`, and `docker-compose.yml:170` referenced `canvas:latest` **unpinned** (standing `TODO: pin canvas ECR image digest`). Tenants/hosts only picked up new canvas as a **side effect** of the platform fleet-redeploy pulling the mutable `:latest` — non-deterministic and unverifiable, hence the advisory "Canvas Deploy Reminder". ## Fix — mirror the platform's ordered deploy **`publish-canvas-image.yml`** - `build-and-push` now pushes `:staging-<sha>` + `:staging-latest` (+ legacy `:sha-<sha>` for back-compat) and **no longer moves `:latest`** — an unpromoted/red build can never become the prod-blessed tag. - New **`promote-canvas`** job (`needs: build-and-push`, `if: push && main`): waits for green main CI on this SHA via the **same** `prod-auto-deploy.py wait-ci` SSOT the platform `deploy-production` uses, then re-points `:latest` to the verified `:staging-<sha>` **by digest** (`imagetools create`, no rebuild). So `:latest` == the last CI-green canvas, and **platform + canvas advance `:latest` off the identical signal/SHA**. Honors the `PROD_AUTO_DEPLOY_DISABLED` kill-switch; reuses the platform's writable-HOME/`continue-on-error` patterns. **`docker-compose.yml`** — canvas image pins via `CANVAS_IMAGE_TAG` (default `latest` = prod-blessed; set `staging-<sha>` or `staging-<sha>@<digest>` for a fully reproducible deploy). **Resolves the standing `TODO: pin canvas ECR image digest`.** Local-dev `build:` context unchanged. **`ci.yml`** — replaced the advisory **"Canvas Deploy Reminder"** (which prescribed a manual `docker compose pull canvas`) with **"Canvas Deploy Status"** recording that the ordered deploy is now handling it. (This job was never a required branch-protection context; advisory-only.) ## New deploy sequence `canvas/**` merge to main → build+push `:staging-<sha>`/`:staging-latest` → `promote-canvas` waits green main CI on the SHA → promote `:latest` → `:staging-<sha>` by digest. Image always exists in ECR before `:latest` is re-pointed (mirrors the platform build-then-deploy ordering). ## How it's verified The platform's per-tenant `/buildinfo` already proves the **tenant** canvas: prod tenants serve canvas baked into `platform-tenant` (`Dockerfile.tenant` Stage 2 builds `canvas/` at the same SHA), which is already ordered + `/buildinfo`-verified. This PR makes the **standalone** `molecule-ai/canvas` image (the co-located `docker-compose` canvas / `canvas.moleculesai.app` surface) equally deterministic: CI-green gate + immutable `:staging-<sha>` + digest-pin. The canvas process has no `/buildinfo` of its own today, so the served-SHA assertion is not yet possible for the standalone image — flagged below. ## Validation - `python3 -c "yaml.safe_load(...)"` parses all 3 edited files. - `lint-workflow-yaml.py` — clean (no Gitea-1.22.6-hostile shapes). - `docker compose config` validates; `CANVAS_IMAGE_TAG` default→`:latest`, override→`:staging-<sha>` both resolve; local-dev `build:` intact. - `pytest test_prod_auto_deploy.py test_ci_required_drift.py test_ci_workflow_bookkeeping.py` — 49 passed (covers the reused `wait-ci` + the job rename). ## Flags / follow-ups (no CP-side dependency required) - **No CP endpoint change needed.** This is self-contained in core (CI workflow + compose). `redeploy-fleet` is unchanged — it deploys `platform-tenant` (which already bakes canvas), so the prod tenant fleet's canvas is already ordered+verified. This PR closes the gap for the *standalone* canvas image. - **Follow-up (filed-worthy):** a canvas `/buildinfo` endpoint would let `promote-canvas` assert the **served** SHA like the platform does. Tracked in #2226's "verify per-tenant via a canvas `/buildinfo`" item; not built here (would touch the Next.js app + needs a deploy surface to poll). - `:staging-latest`/`:staging-<sha>` tag scheme is new for this repo's canvas image; any external consumer pinning the legacy `:sha-<sha>` keeps working (still pushed). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

hongming added 1 commit 2026-06-04 08:59:55 +00:00

ci(canvas): deterministic ordered canvas deploy + digest-pin (core#2226) ... 41b842cc98

The standalone molecule-ai/canvas image previously only built+pushed
:latest + :sha-<sha> with no deploy step, and docker-compose referenced
canvas:latest UNPINNED. Tenants/hosts picked up new canvas only as a side
effect of the platform fleet-redeploy pulling :latest — non-deterministic
and unverifiable, hence the advisory "Canvas Deploy Reminder".

Mirror the platform's ordered deploy (publish-workspace-server-image.yml):

- publish-canvas-image.yml: build job now pushes :staging-<sha> +
  :staging-latest (+ legacy :sha-<sha>) and no longer moves :latest. New
  promote-canvas job waits for green main CI on the SHA (same
  prod-auto-deploy wait-ci SSOT the platform deploy uses), then re-points
  :latest to the verified :staging-<sha> by digest (imagetools create).
  So :latest == last CI-green canvas, and platform+canvas advance off the
  identical signal/SHA. Honors the PROD_AUTO_DEPLOY_DISABLED kill-switch.

- docker-compose.yml: canvas image pins via CANVAS_IMAGE_TAG (default
  latest = prod-blessed; set staging-<sha> or staging-<sha>@<digest> for a
  reproducible deploy). Resolves the standing TODO: pin canvas ECR digest.
  Local-dev `build:` context unchanged.

- ci.yml: replace the advisory "Canvas Deploy Reminder" (prescribed a
  manual docker compose pull) with "Canvas Deploy Status" recording that
  the ordered deploy is handling it.

Closes #2226

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hongming added the tier:low label 2026-06-04 09:02:54 +00:00

core-qa approved these changes 2026-06-04 09:02:56 +00:00

core-qa left a comment

Member

Copy Link

Copy Source

QA approve. Ordered+digest-pinned canvas deploy (promote-canvas via the platform prod-auto-deploy SSOT); replaces advisory reminder. Found tenants bake canvas into platform-tenant (already ordered) so no CP change; only the standalone canvas image made deterministic. 49 tests pass, YAMLs+compose validate.

QA approve. Ordered+digest-pinned canvas deploy (promote-canvas via the platform prod-auto-deploy SSOT); replaces advisory reminder. Found tenants bake canvas into platform-tenant (already ordered) so no CP change; only the standalone canvas image made deterministic. 49 tests pass, YAMLs+compose validate.

core-security approved these changes 2026-06-04 09:02:57 +00:00

core-security left a comment

Member

Copy Link

Copy Source

Security approve. CI/workflow+compose only; digest-pin tightens (not loosens) reproducibility; honors PROD_AUTO_DEPLOY_DISABLED. No auth surface change.

Security approve. CI/workflow+compose only; digest-pin tightens (not loosens) reproducibility; honors PROD_AUTO_DEPLOY_DISABLED. No auth surface change.

hongming commented 2026-06-04 09:02:58 +00:00

Author

Owner

Copy Link

Copy Source

/qa-recheck

/qa-recheck

hongming commented 2026-06-04 09:03:00 +00:00

Author

Owner

Copy Link

Copy Source

/security-recheck

/security-recheck

hongming merged commit 28519c6dbe into main 2026-06-04 09:04:19 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

core-qa

core-security

Labels

Clear labels

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

platform/go

Go platform test issues

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label tier:low

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

3 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#2233