feat: pro rock in ACR by zhijie-yang · Pull Request #1153 · canonical/oci-factory

zhijie-yang · 2026-07-17T08:39:02Z

Jobs to be done: Rebuild, Continuous scanning

I have signed the CLA?
I am following the CONTRIBUTING guidelines

Description

Add support for building and releasing Ubuntu Pro Rocks to a private Azure Container Registry.

Changes

Extend the image trigger schema with upload[*].pro.services (user-facing) and pro-release (no user-facing).
Validate supported, unique Ubuntu Pro services.
Build Pro images using centrally managed Pro credentials.
Encrypt Pro OCI archives with GPG while stored as workflow artifacts.
Publish Pro images exclusively to ACR and track them in _pro_releases.json. (no uploads to GHCR)
Keep public GHCR, Docker Hub, ECR, GitHub Release, and documentation flows unchanged.
Add Pro-aware rebuild, vulnerability-scan, release, and continuous-testing workflows.
Cache encrypted archives and decrypt them only in ephemeral test jobs.
Add unit, integration, workflow-contract, and publishing tests.
Document Pro image configuration and current limitations.

Limitations

Pro support is currently a preview.
Existing Pro revisions cannot be promoted using pro-release; releases must be done via a rebuild.
Pro releases do not update registry documentation, as ACR does not have a WebUI for the docs.

Testing

All PR checks pass, including pytest, bats, workflow contract tests, and mock-rock build, test, and release workflows.

Related issues

Picture of a cool rock:

Jobs to be done: Rebuild, Continuous scanning

Test-Rock previously either cached the decrypted, unpacked image (as on main) or, for encrypted Pro artifacts, skipped the cache and re-ran a per-job prepare-rock-for-testing action to download + decrypt + convert. The former persists Pro (private) image bytes unencrypted at rest in the Actions cache, violating the Pro invariant that image archives stay gpg-encrypted while exchanged and retained; the latter duplicated logic across every test job and disabled caching for Pro. Unify both paths: configure-tests now caches the OCI archive exactly as downloaded (still gpg-encrypted for Pro) under the run-scoped key, and each test job restores it, decrypts locally into its ephemeral workspace when a passphrase is present, then converts to the layout it needs. The cache therefore only ever holds encrypted bytes for Pro images, while public images are unaffected. - Drop the redundant `encrypted-artifact` input; Pro is detected solely by the presence of `pro-artifact-passphrase`, matching main and the rocks-template caller (which never set the input). - Remove the "Determine artifact type" / "Validate passphrase" steps and all `encrypted-artifact == ...` cache gating. - Delete the now-superseded prepare-rock-for-testing composite action. - Image.yaml: stop passing `encrypted-artifact` to Test-Rock. - Update workflow contract tests to assert the unified flow.

zhijie-yang · 2026-07-23T09:38:31Z

+      - name: Encrypt pro artifact
+        if: ${{ matrix.pro-services != '' }}
+        uses: ./.github/actions/crypt-artifact
+        with:
+          mode: encrypt
+          input-path: ${{ steps.rename-oci-archive.outputs.name }}
+          passphrase: ${{ secrets.ROCKS_PRO_ARTIFACT_PASSPHRASE }}
+          output-path: ${{ steps.rename-oci-archive.outputs.name }}.gpg
+


See if this can be optimized, we can just rename the downloaded artifact, and choose to keep the encrypted artifact during the decryption.

zhijie-yang · 2026-07-23T09:56:44Z

+      is-public-release: ${{ steps.release-type.outputs.is-public-release }}
+      is-pro-release: ${{ steps.release-type.outputs.is-pro-release }}


Consider refactoring these two boolean names to contains-x-release to reduce the ambiguity.

zhijie-yang · 2026-07-23T09:58:21Z

Revisit this to see if we can avoid any changes to this established workflow.

These changes seem more like a drive-by to me. Afaict they are not really required for any of the workflows to run correctly right? Since the inputs and outputs remain the same.

If so, I'd move this to a separate refactor PR.

These changes aren't a drive-by refactor — they're required for Pro support, which is why the inputs/outputs are unchanged (the behavior change is internal to how Pro artifacts are handled).

Previously configure-tests unpacked the rock once and cached the unpacked OCI layout, which every downstream test job restored. For Pro images that would mean the decrypted image content sits in the shared, run-scoped cache — defeating the reason we GPG-encrypt the artifact in the first place.

To keep the property "cache encrypted archives, decrypt only in ephemeral test jobs", the restructuring:

caches the raw archive (<name> / <name>.gpg) instead of the unpacked layout, and

moves the Decrypt Rock + Unpack Rock steps out of the shared job into each individual test job, so decryption happens only inside the short-lived job that needs it and the plaintext is never persisted to the cache.

Public (non-Pro) images are unaffected: the Decrypt Rock step is gated on ARTIFACT_PASSPHRASE != '', so for them it's a no-op and the unpack behaves as before.

Given that, I'd prefer to keep it in this PR rather than split it, since the Pro test flow doesn't work correctly without it. Happy to revisit if you still see a piece here that's genuinely independent of Pro.

Yes, this is essentially what I flagged back in: https://github.com/canonical/oci-factory/pull/706/changes#r2623388879 but wasn't ever addressed. Happy to keep it in this PR 👍

lczyk

as discussed on 1-1, overall approach looks good. a couple of drive-bys but i personally don't mind. i found a small pile of things to look at though:

worth failing fast in the matrix on an upload[*] entry with pro: but no release:
pro build metadata in Swift records digest: "" (the GHCR push is skipped), so a Pro revision has no content identity anywhere once the artifact expires.
pro archives are uploaded with default retention (90 day). retention-days: 1 ??
Create Git tag runs for Pro too. just flagging.
upload-rock/action.yml still decrypts with a <name>* glob while everything else moved to <name>.gpg.
docker is unpinned in tests/etc/requirements.txt while everything else there is pinned.

and inline comments ofc

Co-authored-by: Marcin Konowalczyk <marcin.konowalczyk@canonical.com>

github-actions · 2026-07-30T09:33:14Z

The Docker repository for this image does not exist yet. Merging of this repo is blocked.
Run ID: 30531125111 ; Attempt: 1

See logs.

github-actions · 2026-07-30T09:36:04Z

The Docker repository for this image does not exist yet. Merging of this repo is blocked.
Run ID: 30531314343 ; Attempt: 1

See logs.

lczyk

#1153 (comment) was really my only blocker. everything else is flags / nice-to-have's so +1 from me

github-actions · 2026-07-30T10:11:05Z

The Docker repository for this image does not exist yet. Merging of this repo is blocked.
Run ID: 30533672959 ; Attempt: 1

See logs.

lczyk

yep. f2a3f98 is even better. now approve ;)

github-actions · 2026-07-30T12:37:48Z

The Docker repository for this image does not exist yet. Merging of this repo is blocked.
Run ID: 30543325089 ; Attempt: 1

See logs.

alesancor1

First pass

Overall the code looks good, I can see it's quite polished already after a couple iterations with @lczyk (thanks!).

For now, just a couple of nits and a bigger concern, check below:

alesancor1 · 2026-07-30T14:30:12Z

These changes seem more like a drive-by to me. Afaict they are not really required for any of the workflows to run correctly right? Since the inputs and outputs remain the same.

If so, I'd move this to a separate refactor PR.

github-actions · 2026-08-21T10:14:23Z

The Docker repository for this image does not exist yet. Merging of this repo is blocked.
Run ID: 32471687513 ; Attempt: 1

See logs.

github-actions · 2026-08-21T10:40:09Z

The Docker repository for this image does not exist yet. Merging of this repo is blocked.
Run ID: 32473659861 ; Attempt: 1

See logs.

github-actions · 2026-08-21T12:23:16Z

The Docker repository for this image does not exist yet. Merging of this repo is blocked.
Run ID: 32481618009 ; Attempt: 1

See logs.

alesancor1

Happy with the current state of this, thanks!

Is there any chance you could provide a test run before merging?

alesancor1 · 2026-08-22T10:40:17Z

Yes, this is essentially what I flagged back in: https://github.com/canonical/oci-factory/pull/706/changes#r2623388879 but wasn't ever addressed. Happy to keep it in this PR 👍

zhijie-yang force-pushed the ROCKS-2675/enable-ecr-rework branch 7 times, most recently from b79f5c6 to 224baa8 Compare July 17, 2026 15:12

zhijie-yang added 2 commits July 18, 2026 00:54

feat: pro rock in ACR (WIP)

fb79f7c

Jobs to be done: Rebuild, Continuous scanning

chore: fixes from GPT-5.6 Sol high

27d800d

zhijie-yang force-pushed the ROCKS-2675/enable-ecr-rework branch from 224baa8 to 27d800d Compare July 18, 2026 21:45

zhijie-yang added 6 commits July 18, 2026 23:54

feat: add prepare-rock-for-testing action

5be2a4e

doc: add pro-related docs

a311224

test: add test for pro feature

5970ef1

chore: American English for atrifact

b2070dd

feat: auto rebuild for pro images

3d870b2

chore: doc

1c4daa1

zhijie-yang commented Jul 20, 2026

View reviewed changes

Comment thread .github/workflows/Image.yaml Outdated

zhijie-yang added 3 commits July 20, 2026 19:21

feat: continuous testing

f8532a8

fix: test required package

a38f2bb

zhijie-yang changed the title ~~feat: pro rock in ACR (WIP)~~ feat: pro rock in ACR Jul 21, 2026

zhijie-yang marked this pull request as ready for review July 21, 2026 10:32

zhijie-yang requested a review from alesancor1 as a code owner July 21, 2026 10:32

canonical deleted a comment from github-actions Bot Jul 21, 2026

lczyk self-requested a review July 22, 2026 12:46

zhijie-yang commented Jul 23, 2026

View reviewed changes

lczyk requested changes Jul 25, 2026

View reviewed changes

zhijie-yang and others added 4 commits July 28, 2026 17:34

chore: Update README.md

1ff3576

Co-authored-by: Marcin Konowalczyk <marcin.konowalczyk@canonical.com>

chore: update according to code review

58312e6

Merge branch 'main' into ROCKS-2675/enable-ecr-rework

c57fd66

Merge branch 'main' into ROCKS-2675/enable-ecr-rework

6208d1c

fix: test

1d12f65

lczyk approved these changes Jul 30, 2026

View reviewed changes

This comment was marked as resolved.

Sign in to view

fix: bind mount local artifact into skopeo container

f2a3f98

lczyk approved these changes Jul 30, 2026

View reviewed changes

fix: gpg substring removal

54f6260

alesancor1 requested changes Jul 30, 2026

View reviewed changes

chore: code review from alesancor

3d77caa

Merge branch 'main' into ROCKS-2675/enable-ecr-rework

85ffdd1

chore: trigger CI

0f4ecef

zhijie-yang requested a review from alesancor1 August 21, 2026 13:20

alesancor1 approved these changes Aug 22, 2026

View reviewed changes

		is-public-release: ${{ steps.release-type.outputs.is-public-release }}
		is-pro-release: ${{ steps.release-type.outputs.is-pro-release }}

Uh oh!

Conversation

zhijie-yang commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes

Limitations

Testing

Related issues

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lczyk left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 30, 2026

Uh oh!

github-actions Bot commented Jul 30, 2026

Uh oh!

lczyk left a comment

Choose a reason for hiding this comment

Uh oh!

This comment was marked as resolved.

Uh oh!

github-actions Bot commented Jul 30, 2026

Uh oh!

lczyk left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 30, 2026

Uh oh!

alesancor1 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Aug 21, 2026

Uh oh!

github-actions Bot commented Aug 21, 2026

Uh oh!

github-actions Bot commented Aug 21, 2026

Uh oh!

alesancor1 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

zhijie-yang commented Jul 17, 2026 •

edited

Loading

lczyk left a comment •

edited

Loading