feat: add Step Functions and Docker Lambda execution

.dockerignore

@@ -6,3 +6,11 @@ docs/
 specs/
 *.md
 LICENSE
+**/.env
+**/.env.*
+**/node_modules
+**/__pycache__
+**/.venv
+**/.pulumi
+.DS_Store
+**/.DS_Store

.github/actions/load-image/action.yml

@@ -5,7 +5,7 @@ runs:
   using: "composite"
   steps:
     - name: Download image artifact
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
       with:
         name: rustack-image
         path: /tmp

.github/workflows/promote-docker.yml

@@ -0,0 +1,60 @@
+name: promote-docker
+
+on:
+  workflow_dispatch:
+    inputs:
+      candidate_run_id:
+        description: Successful same-commit release-docker candidate run
+        required: true
+        type: string
+      qualification_run_id:
+        description: Successful same-commit qualify-workflows run
+        required: true
+        type: string
+      version:
+        description: Numeric major.minor.patch version to promote
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  promote:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      actions: read
+      packages: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+      CANDIDATE_RUN_ID: ${{ inputs.candidate_run_id }}
+      QUALIFICATION_RUN_ID: ${{ inputs.qualification_run_id }}
+      RELEASE_VERSION: ${{ inputs.version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          run-id: ${{ inputs.qualification_run_id }}
+          name: workflows-qualified-release
+          github-token: ${{ github.token }}
+          path: ${{ runner.temp }}/qualification
+      - name: Recheck raw qualification before registry login
+        run: make workflows-release-preflight WORKFLOWS_RELEASE_BUNDLE="${{ runner.temp }}/qualification"
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Promote the qualified archives without rebuilding
+        run: make workflows-release-promote WORKFLOWS_RELEASE_BUNDLE="${{ runner.temp }}/qualification"
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: workflows-promotion-receipt
+          path: ${{ runner.temp }}/qualification/promotion.json
+          if-no-files-found: error

.github/workflows/qualify-workflows.yml

@@ -0,0 +1,54 @@
+name: qualify-workflows
+
+on:
+  workflow_dispatch:
+    inputs:
+      candidate_run_id:
+        description: Successful same-commit release-docker run containing the exact archives
+        required: true
+        type: string
+      evidence_run_id:
+        description: Successful same-commit run containing the complete workflows-evidence artifact
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  assemble:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Fence source runs
+        env:
+          GH_TOKEN: ${{ github.token }}
+          CANDIDATE_RUN_ID: ${{ inputs.candidate_run_id }}
+          EVIDENCE_RUN_ID: ${{ inputs.evidence_run_id }}
+        run: make workflows-release-input-runs
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          run-id: ${{ inputs.evidence_run_id }}
+          name: workflows-evidence
+          github-token: ${{ github.token }}
+          path: ${{ runner.temp }}/qualification
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          run-id: ${{ inputs.candidate_run_id }}
+          pattern: release-candidate-*
+          merge-multiple: true
+          github-token: ${{ github.token }}
+          path: ${{ runner.temp }}/qualification
+      - name: Require complete raw evidence and exact candidates
+        run: make verify-workflows WORKFLOWS_RELEASE_BUNDLE="${{ runner.temp }}/qualification" WORKFLOWS_RELEASE_REPORT="${{ runner.temp }}/qualification/release-report.json"
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: workflows-qualified-release
+          path: ${{ runner.temp }}/qualification/
+          if-no-files-found: error
+          retention-days: 30
+          compression-level: 0

.github/workflows/release-docker.yml

@@ -2,71 +2,63 @@ name: release-docker
 
 on:
   push:
-    tags:
-      - v*
+    tags: [v*]
   workflow_dispatch:
 
+# Candidates are local Docker archives. Publication belongs to promote-docker.
 permissions:
   contents: read
-  packages: write
-
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository_owner }}/rustack
 
 jobs:
-  # Wait for the build workflow to pass before pushing the Docker image.
-  wait-for-build:
-    if: startsWith(github.ref, 'refs/tags/v')
-    runs-on: ubuntu-latest
+  candidate:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - architecture: arm64
+            runner: ubuntu-24.04-arm
+          - architecture: amd64
+            runner: ubuntu-24.04
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 90
     steps:
-      - name: Wait for build workflow
-        uses: lewagon/wait-on-check-action@v1.3.4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.ref }}
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          check-name: build-rust (ubuntu-latest)
-          wait-interval: 15
-          allowed-conclusions: success
-
-  build-and-push:
-    needs: [wait-for-build]
-    if: always() && (needs.wait-for-build.result == 'success' || github.event_name == 'workflow_dispatch')
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Set up QEMU (for multi-arch builds)
-        uses: docker/setup-qemu-action@v3
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Docker metadata
-        id: docker-meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=semver,pattern={{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
-            type=semver,pattern={{major}}.{{minor}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
-            type=semver,pattern={{major}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
-            type=raw,value=latest
-
-      - name: Build and push
-        uses: docker/build-push-action@v6
+          persist-credentials: false
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - name: Allocate candidate directory
+        run: mkdir -m 700 "${{ runner.temp }}/candidate"
+      - name: Build without publication
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.docker-meta.outputs.tags }}
-          labels: ${{ steps.docker-meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          platforms: linux/${{ matrix.architecture }}
+          push: false
+          provenance: false
+          tags: rustack/workflows-release:integration-${{ matrix.architecture }}
+          outputs: type=docker,dest=${{ runner.temp }}/candidate/release-${{ matrix.architecture }}.tar
+          cache-from: type=gha,scope=release-${{ matrix.architecture }}
+          cache-to: type=gha,mode=max,scope=release-${{ matrix.architecture }}
+      - name: Load and seal exact archive
+        env:
+          ARCHITECTURE: ${{ matrix.architecture }}
+          CANDIDATE: ${{ runner.temp }}/candidate
+        run: |
+          docker image load --input "$CANDIDATE/release-$ARCHITECTURE.tar"
+          make workflows-release-seal WORKFLOWS_ARCH="$ARCHITECTURE" WORKFLOWS_RELEASE_BUNDLE="$CANDIDATE"
+      - name: Record execution scope
+        env:
+          ARCHITECTURE: ${{ matrix.architecture }}
+        run: |
+          if [ "$ARCHITECTURE" = amd64 ]; then
+            echo 'D100: distribution build only; Linux x86_64 execution is waived.' >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo 'Candidate awaits complete exact-image platform qualification; no promotion occurred.' >> "$GITHUB_STEP_SUMMARY"
+          fi
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: release-candidate-${{ matrix.architecture }}
+          path: ${{ runner.temp }}/candidate/
+          if-no-files-found: error
+          retention-days: 30
+          compression-level: 0