chore: sync upstream dstack and validate alpha fork

.github/workflows/docker-build-check.yml

@@ -11,23 +11,27 @@ name: Docker Build Check
 # does.
 on:
   push:
-    branches: [ next, 'release/**' ]
+    branches: [ alpha, next, 'release/**' ]
     paths:
       - 'dstack/**'
       - 'rust-toolchain.toml'
       - '.github/workflows/docker-build-check.yml'
       - '.github/workflows/kms-release.yml'
       - '.github/workflows/gateway-release.yml'
       - '.github/workflows/verifier-release.yml'
+      - '.github/workflows/local-key-provider-release.yml'
+      - '.github/workflows/mkosi-build.yml'
   pull_request:
-    branches: [ next, 'release/**' ]
+    branches: [ alpha, next, 'release/**' ]
     paths:
       - 'dstack/**'
       - 'rust-toolchain.toml'
       - '.github/workflows/docker-build-check.yml'
       - '.github/workflows/kms-release.yml'
       - '.github/workflows/gateway-release.yml'
       - '.github/workflows/verifier-release.yml'
+      - '.github/workflows/local-key-provider-release.yml'
+      - '.github/workflows/mkosi-build.yml'
 
 env:
   DSTACK_REV: ${{ github.event.pull_request.head.sha || github.sha }}
@@ -52,6 +56,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
+      - name: Install workflow contract parser
+        run: python3 -m pip install PyYAML==6.0.3
       - name: Test release build orchestration
         run: python3 -m unittest discover -s dstack/build/shared/tests -v
 
@@ -187,6 +193,32 @@ jobs:
             DSTACK_REV=${{ env.DSTACK_REV }}
             DSTACK_SRC_URL=${{ env.DSTACK_SRC_URL }}
 
+      - name: Verify offline one-shot rejection contract
+        run: |
+          python3 - <<'PYTEST'
+          import json
+          import pathlib
+          import subprocess
+          import tempfile
+
+          with tempfile.TemporaryDirectory() as directory:
+              request = pathlib.Path(directory) / "invalid.json"
+              request.write_text(json.dumps({"attestation": "00"}))
+              result = subprocess.run(
+                  ["docker", "run", "--rm", "--network=none",
+                   "-v", f"{directory}:/evidence", "dstack-verifier-check:latest",
+                   "--config", "/etc/dstack/dstack-verifier.toml",
+                   "--verify", "/evidence/invalid.json"],
+                  capture_output=True, text=True, timeout=30,
+              )
+              assert result.returncode == 1, (result.returncode, result.stderr)
+              response = json.loads(result.stdout)
+              assert response["is_valid"] is False, response
+              assert isinstance(response["details"], dict), response
+              assert response["reason"], response
+              print("Real verifier CLI rejects malformed attestation with one JSON response")
+          PYTEST
+
       - name: Verify pinned packages (runtime)
         run: |
           dstack/build/shared/verify-pinned-packages.sh dstack-verifier-check:latest \

.github/workflows/gateway-cluster-tests.yml

@@ -14,7 +14,7 @@ name: Gateway cluster tests
 # this replaces could not do.
 on:
   push:
-    branches: [ next, 'release/**' ]
+    branches: [ alpha, next, 'release/**' ]
     paths:
       - 'dstack/gateway/**'
       - 'dstack/cert-client/**'
@@ -24,7 +24,7 @@ on:
       - 'dstack/crates/mock-attestation/**'
       - '.github/workflows/gateway-cluster-tests.yml'
   pull_request:
-    branches: [ next, 'release/**' ]
+    branches: [ alpha, next, 'release/**' ]
     paths:
       - 'dstack/gateway/**'
       - 'dstack/cert-client/**'

.github/workflows/gateway-e2e-tests.yml

@@ -15,7 +15,7 @@ name: Gateway e2e tests
 # cluster mTLS path that a harness with the checks switched off cannot reach.
 on:
   push:
-    branches: [ next, 'release/**' ]
+    branches: [ alpha, next, 'release/**' ]
     paths:
       - 'dstack/gateway/**'
       - 'dstack/cert-client/**'
@@ -27,7 +27,7 @@ on:
       - 'tools/mock-cf-dns/**'
       - '.github/workflows/gateway-e2e-tests.yml'
   pull_request:
-    branches: [ next, 'release/**' ]
+    branches: [ alpha, next, 'release/**' ]
     paths:
       - 'dstack/gateway/**'
       - 'dstack/cert-client/**'

.github/workflows/gateway-proxy-tests.yml

@@ -16,7 +16,7 @@ name: Gateway proxy tests
 # anything else was using TLS.
 on:
   push:
-    branches: [ next, 'release/**' ]
+    branches: [ alpha, next, 'release/**' ]
     paths:
       - 'dstack/gateway/**'
       - 'dstack/vendor/ktls/**'
@@ -28,7 +28,7 @@ on:
       - 'sdk/simulator/**'
       - '.github/workflows/gateway-proxy-tests.yml'
   pull_request:
-    branches: [ next, 'release/**' ]
+    branches: [ alpha, next, 'release/**' ]
     paths:
       - 'dstack/gateway/**'
       - 'dstack/vendor/ktls/**'

.github/workflows/gateway-release.yml

@@ -45,18 +45,22 @@ jobs:
 
       # Manual runs rebuild an existing release tag, not the selected branch.
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && env.RELEASE_TAG || github.sha }}
 
-      - name: Log in to Docker Hub
-        uses: docker/login-action@v3
+      - name: Normalise registry owner
+        run: echo "OWNER_LC=${GITHUB_REPOSITORY_OWNER,,}" >> "$GITHUB_ENV"
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
-          username: ${{ vars.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Resolve the revision to build
         run: echo "GIT_REV=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
@@ -71,7 +75,7 @@ jobs:
           METADATA_FILE: ${{ runner.temp }}/build-metadata.json
           GIT_REV: ${{ env.GIT_REV }}
           IMAGE_VERSION: ${{ env.VERSION }}
-          IMAGE_NAME: ${{ vars.DOCKERHUB_ORG }}/dstack-gateway:${{ env.VERSION }}
+          IMAGE_NAME: ghcr.io/${{ env.OWNER_LC }}/dstack-gateway:${{ env.VERSION }}
           IMAGE_SOURCE_URL: ${{ github.server_url }}/${{ github.repository }}
           DSTACK_SRC_URL: ${{ github.server_url }}/${{ github.repository }}.git
         run: |
@@ -84,23 +88,35 @@ jobs:
           fi
           echo "digest=$digest" >> "$GITHUB_OUTPUT"
 
+      - name: Verify anonymous pull access
+        env:
+          IMAGE_DIGEST: ${{ steps.build-and-push.outputs.digest }}
+        run: |
+          token=$(curl -fsSL \
+            "https://ghcr.io/token?scope=repository:${OWNER_LC}/dstack-gateway:pull" \
+            | jq -er .token)
+          curl -fsSL -o /dev/null \
+            -H "Authorization: Bearer $token" \
+            -H "Accept: application/vnd.oci.image.manifest.v1+json" \
+            "https://ghcr.io/v2/${OWNER_LC}/dstack-gateway/manifests/$IMAGE_DIGEST"
+
       - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@v1
+        uses: actions/attest-build-provenance@92c65d2898f1f53cfdc910b962cecff86e7f8fcc # v1
         with:
-          subject-name: "docker.io/${{ vars.DOCKERHUB_ORG }}/dstack-gateway"
+          subject-name: "ghcr.io/${{ env.OWNER_LC }}/dstack-gateway"
           subject-digest: ${{ steps.build-and-push.outputs.digest }}
           push-to-registry: true
 
       - name: GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           tag_name: ${{ env.RELEASE_TAG }}
           target_commitish: ${{ env.GIT_REV }}
           name: "Gateway Release v${{ env.VERSION }}"
           body: |
             ## Docker Image Information
 
-            **Image**: `docker.io/${{ vars.DOCKERHUB_ORG }}/dstack-gateway:${{ env.VERSION }}`
+            **Image**: `ghcr.io/${{ env.OWNER_LC }}/dstack-gateway:${{ env.VERSION }}`
 
             **Digest (SHA256)**: `${{ steps.build-and-push.outputs.digest }}`
 

.github/workflows/kms-release.yml

@@ -45,7 +45,7 @@ jobs:
 
       # Manual runs rebuild an existing release tag, not the selected branch.
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && env.RELEASE_TAG || github.sha }}
 
@@ -56,14 +56,18 @@ jobs:
             dstack/kms/auth-eth/lib/openzeppelin-contracts-upgradeable \
             dstack/kms/auth-eth/lib/openzeppelin-foundry-upgrades
 
-      - name: Log in to Docker Hub
-        uses: docker/login-action@v3
+      - name: Normalise registry owner
+        run: echo "OWNER_LC=${GITHUB_REPOSITORY_OWNER,,}" >> "$GITHUB_ENV"
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
-          username: ${{ vars.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Resolve the revision to build
         run: echo "GIT_REV=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
@@ -78,7 +82,7 @@ jobs:
           METADATA_FILE: ${{ runner.temp }}/build-metadata.json
           GIT_REV: ${{ env.GIT_REV }}
           IMAGE_VERSION: ${{ env.VERSION }}
-          IMAGE_NAME: ${{ vars.DOCKERHUB_ORG }}/dstack-kms:${{ env.VERSION }}
+          IMAGE_NAME: ghcr.io/${{ env.OWNER_LC }}/dstack-kms:${{ env.VERSION }}
           IMAGE_SOURCE_URL: ${{ github.server_url }}/${{ github.repository }}
           DSTACK_SRC_URL: ${{ github.server_url }}/${{ github.repository }}.git
         run: |
@@ -91,24 +95,35 @@ jobs:
           fi
           echo "digest=$digest" >> "$GITHUB_OUTPUT"
 
+      - name: Verify anonymous pull access
+        env:
+          IMAGE_DIGEST: ${{ steps.build-and-push.outputs.digest }}
+        run: |
+          token=$(curl -fsSL \
+            "https://ghcr.io/token?scope=repository:${OWNER_LC}/dstack-kms:pull" \
+            | jq -er .token)
+          curl -fsSL -o /dev/null \
+            -H "Authorization: Bearer $token" \
+            -H "Accept: application/vnd.oci.image.manifest.v1+json" \
+            "https://ghcr.io/v2/${OWNER_LC}/dstack-kms/manifests/$IMAGE_DIGEST"
+
       - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@v1
+        uses: actions/attest-build-provenance@92c65d2898f1f53cfdc910b962cecff86e7f8fcc # v1
         with:
-          subject-name: "docker.io/${{ vars.DOCKERHUB_ORG }}/dstack-kms"
+          subject-name: "ghcr.io/${{ env.OWNER_LC }}/dstack-kms"
           subject-digest: ${{ steps.build-and-push.outputs.digest }}
           push-to-registry: true
 
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@v1
+        uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1
 
       - name: Compile contracts with Foundry
         run: |
           cd dstack/kms/auth-eth
-          forge install
           forge build
 
       - name: GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           tag_name: ${{ env.RELEASE_TAG }}
           target_commitish: ${{ env.GIT_REV }}
@@ -119,7 +134,7 @@ jobs:
           body: |
             ## Docker Image Information
 
-            **Image**: `docker.io/${{ vars.DOCKERHUB_ORG }}/dstack-kms:${{ env.VERSION }}`
+            **Image**: `ghcr.io/${{ env.OWNER_LC }}/dstack-kms:${{ env.VERSION }}`
 
             **Digest (SHA256)**: `${{ steps.build-and-push.outputs.digest }}`
 

.github/workflows/local-key-provider-release.yml

@@ -25,48 +25,76 @@ jobs:
   build-and-release:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v7
-
-      - name: Parse version from tag
+      - name: Parse and check version
         env:
           DISPATCH_VERSION: ${{ inputs.version }}
         run: |
-          if [[ "$GITHUB_REF" == refs/tags/local-key-provider-v* ]]; then
-            VERSION=${GITHUB_REF#refs/tags/local-key-provider-v}
-          else
+          if [ "$GITHUB_EVENT_NAME" = workflow_dispatch ]; then
             VERSION=$DISPATCH_VERSION
+          else
+            case "$GITHUB_REF" in
+              refs/tags/local-key-provider-v*) VERSION=${GITHUB_REF#refs/tags/local-key-provider-v} ;;
+              *) echo "Expected a local-key-provider-v* tag" >&2; exit 1 ;;
+            esac
+          fi
+          if [[ ! "$VERSION" =~ ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$ ]]; then
+            echo "Version must be a valid Docker tag" >&2
+            exit 1
           fi
           echo "VERSION=$VERSION" >> "$GITHUB_ENV"
-          echo "Parsed version: $VERSION"
+          echo "RELEASE_TAG=local-key-provider-v$VERSION" >> "$GITHUB_ENV"
+
+      # Manual runs rebuild an existing release tag, not the selected branch.
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && env.RELEASE_TAG || github.sha }}
 
-      # ghcr.io requires a lowercase owner; the org is mixed-case.
       - name: Normalise registry owner
         run: echo "OWNER_LC=${GITHUB_REPOSITORY_OWNER,,}" >> "$GITHUB_ENV"
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
+
+      - name: Resolve the revision to build
+        run: echo "GIT_REV=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
 
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
           context: dstack
           file: dstack/local-key-provider/build/Dockerfile.key-provider
           push: true
           tags: ghcr.io/${{ env.OWNER_LC }}/local-key-provider:${{ env.VERSION }}
+          labels: |
+            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.revision=${{ env.GIT_REV }}
+            org.opencontainers.image.version=${{ env.VERSION }}
           platforms: linux/amd64
           provenance: false
 
+      - name: Verify anonymous pull access
+        env:
+          IMAGE_DIGEST: ${{ steps.build-and-push.outputs.digest }}
+        run: |
+          token=$(curl -fsSL \
+            "https://ghcr.io/token?scope=repository:${OWNER_LC}/local-key-provider:pull" \
+            | jq -er .token)
+          curl -fsSL -o /dev/null \
+            -H "Authorization: Bearer $token" \
+            -H "Accept: application/vnd.oci.image.manifest.v1+json" \
+            "https://ghcr.io/v2/${OWNER_LC}/local-key-provider/manifests/$IMAGE_DIGEST"
+
       - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest-build-provenance@8beda2b7ed98355c0e97c0a63bec38ae472e66c4 # v4
         with:
           subject-name: "ghcr.io/${{ env.OWNER_LC }}/local-key-provider"
           subject-digest: ${{ steps.build-and-push.outputs.digest }}
@@ -91,10 +119,11 @@ jobs:
           echo "MRSIGNER=$MRSIGNER" >> "$GITHUB_ENV"
 
       - name: GitHub Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@5113cdc90fd4d541c801c55356214017bf5ae34b # v3
         with:
           name: "Local Key Provider Release v${{ env.VERSION }}"
-          tag_name: local-key-provider-v${{ env.VERSION }}
+          tag_name: ${{ env.RELEASE_TAG }}
+          target_commitish: ${{ env.GIT_REV }}
           files: local-key-provider.sig.json
           body: |
             ## Docker Image Information