merge(main): refresh policy finality base

Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>

Author: jyaunches

.github/actions/build-base-image-platform/action.yaml

@@ -4,6 +4,17 @@
 name: build-base-image-platform
 description: Build and publish one immutable base image digest for a platform.
 
+outputs:
+  digest:
+    description: Exact digest for the requested platform.
+    value: ${{ steps.build.outputs.digest }}
+  amd64-digest:
+    description: Exact amd64 digest when this action built the amd64 lane.
+    value: ${{ steps.job-output.outputs.amd64_digest }}
+  arm64-digest:
+    description: Exact arm64 digest when this action built the arm64 lane.
+    value: ${{ steps.job-output.outputs.arm64_digest }}
+
 inputs:
   agent:
     description: Agent identifier used for build arguments and artifact names.
@@ -129,6 +140,7 @@ runs:
           'test -x /usr/bin/dos2unix; test "$(command -v dos2unix)" = /usr/bin/dos2unix; dos2unix --version >/dev/null'
 
     - name: Export platform digest
+      id: job-output
       shell: bash
       env:
         ARCH: ${{ inputs.arch }}
@@ -145,6 +157,7 @@ runs:
         fi
         mkdir -p "$RUNNER_TEMP/digests"
         touch "$RUNNER_TEMP/digests/${ARCH}-${DIGEST#sha256:}"
+        printf '%s_digest=%s\n' "$ARCH" "$DIGEST" >> "$GITHUB_OUTPUT"
 
     - name: Upload platform digest
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.github/actions/publish-base-image-manifest/action.yaml

@@ -4,10 +4,21 @@
 name: publish-base-image-manifest
 description: Validate platform digests and publish one multi-platform base image manifest.
 
+outputs:
+  contract-base64:
+    description: Exact validated base-image contract for dependent jobs.
+    value: ${{ steps.contract-output.outputs.contract_base64 }}
+
 inputs:
   agent:
     description: Agent identifier stored in the managed base image contract.
     required: true
+  amd64-digest:
+    description: Exact amd64 platform digest from the producer job.
+    required: true
+  arm64-digest:
+    description: Exact arm64 platform digest from the producer job.
+    required: true
   display-name:
     description: Agent name used in validation errors.
     required: true
@@ -27,12 +38,23 @@ inputs:
 runs:
   using: composite
   steps:
-    - name: Download platform digests
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        pattern: ${{ inputs.agent }}-base-digest-${{ github.run_id }}-${{ github.run_attempt }}-*
-        path: ${{ runner.temp }}/digests
-        merge-multiple: true
+    - name: Restore exact platform digests
+      shell: bash
+      env:
+        AMD64_DIGEST: ${{ inputs.amd64-digest }}
+        ARM64_DIGEST: ${{ inputs.arm64-digest }}
+      run: |
+        set -euo pipefail
+        for digest in "$AMD64_DIGEST" "$ARM64_DIGEST"; do
+          [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]] || {
+            echo "ERROR: base-image producer output has an invalid digest." >&2
+            exit 1
+          }
+        done
+        digest_root="$RUNNER_TEMP/digests"
+        install -d -m 0700 "$digest_root"
+        touch "$digest_root/amd64-${AMD64_DIGEST#sha256:}"
+        touch "$digest_root/arm64-${ARM64_DIGEST#sha256:}"
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
@@ -65,6 +87,22 @@ runs:
         IMAGE: ${{ inputs.registry }}/${{ inputs.image }}
         TAGS: ${{ steps.meta.outputs.tags }}
       run: bash "$GITHUB_ACTION_PATH/publish.sh"
+    - name: Export managed base image contract
+      id: contract-output
+      shell: bash
+      run: |
+        set -euo pipefail
+        contract="$RUNNER_TEMP/managed-base-contract/contract.json"
+        if [ ! -f "$contract" ] || [ -L "$contract" ]; then
+          echo "ERROR: managed base image contract is missing or is a symbolic link." >&2
+          exit 1
+        fi
+        contract_size="$(wc -c < "$contract" | tr -d '[:space:]')"
+        if [[ ! "$contract_size" =~ ^[1-9][0-9]{0,5}$ ]] || [ "$contract_size" -gt 65536 ]; then
+          echo "ERROR: managed base image contract is empty or oversized." >&2
+          exit 1
+        fi
+        printf 'contract_base64=%s\n' "$(base64 -w 0 "$contract")" >> "$GITHUB_OUTPUT"
     - name: Upload managed base image contract
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:

.github/workflows/base-image-platform.yaml

@@ -0,0 +1,83 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Build base image platform
+
+on:
+  workflow_call:
+    inputs:
+      agent:
+        description: Agent identifier for the base-image build.
+        required: true
+        type: string
+      arch:
+        description: Artifact architecture identifier.
+        required: true
+        type: string
+      platform:
+        description: Docker platform to build.
+        required: true
+        type: string
+      runner:
+        description: GitHub-hosted runner for the target architecture.
+        required: true
+        type: string
+      dockerfile:
+        description: Path to the base-image Dockerfile.
+        required: true
+        type: string
+      image:
+        description: Image repository relative to GHCR.
+        required: true
+        type: string
+      openclaw-version:
+        description: Optional OpenClaw version build argument.
+        required: false
+        type: string
+        default: ""
+    outputs:
+      digest:
+        description: Exact digest for the requested platform.
+        value: ${{ jobs.build.outputs.digest }}
+    secrets:
+      registry_password:
+        description: GHCR publication credential.
+        required: true
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build:
+    name: Build ${{ inputs.agent }} base image (${{ inputs.arch }})
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 60
+    permissions:
+      contents: read
+      packages: write
+    outputs:
+      digest: ${{ steps.platform.outputs.digest }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Build and publish platform digest
+        id: platform
+        uses: ./.github/actions/build-base-image-platform
+        with:
+          agent: ${{ inputs.agent }}
+          arch: ${{ inputs.arch }}
+          platform: ${{ inputs.platform }}
+          dockerfile: ${{ inputs.dockerfile }}
+          image: ${{ inputs.image }}
+          registry: ghcr.io
+          registry-username: ${{ github.actor }}
+          registry-password: ${{ secrets.registry_password }}
+          openclaw-version: ${{ inputs.openclaw-version }}
+          metadata-tags: |
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+            type=ref,event=tag
+            type=sha,prefix=,format=short