Separate artifact build inputs from deployment secrets

[shiny-code-bot]

Finish Line

Artifact publication accepts Launchplane's build-only runtime payload without requiring deployment database/master secrets, while all runtime/deploy commands retain their existing fail-closed secret checks.

Current Status

State: In progress/Now. CM's supported main-branch artifact workflow failed in run 29626583285 with trace launchplane_req_568fa32b9add4111bbeca7301917bc05 before build because devkit required ODOO_MASTER_PASSWORD, ODOO_DB_USER, and ODOO_DB_PASSWORD. Launchplane's artifact-input route intentionally returns only non-secret build inputs. The same CM artifact already passed locally when build-only inputs were supplied alongside temporary placeholders, proving the image/dependency path itself is sound.

Next action: separate artifact-publish required-key validation from runtime/deploy required-key validation, add regression coverage for Launchplane's minimal payload, run full devkit gates, merge, and retry the exact failed workflow.

Blocked by: none.

Waiting for: implementation only; no operator input.

Last verified: July 18, 2026.

Scope

• Let runtime publish load typed context/instance/build inputs without enforcing unrelated stack deployment secrets.
• Continue validating any stack-required key that is itself an artifact build input.
• Preserve the full required environment gate for runtime select/inspect/up/build/workflow/restore and other deploy-capable commands.
• Keep Launchplane artifact publication non-secret; do not add dummy or real DB/master secrets to GitHub workflows.
• Add focused regression tests and update artifact-publish documentation where needed.

Acceptance Criteria

• A non-local artifact publish payload containing only context, instance, Odoo version, immutable base inputs, and source/auth inputs reaches the artifact build path.
• ODOO_MASTER_PASSWORD, ODOO_DB_USER, and ODOO_DB_PASSWORD are not required or transmitted for artifact publication.
• Artifact inputs that erase a stack-required build key still fail before push.
• Non-publish runtime commands still fail closed when stack required values are missing.
• Full devkit tests, Ruff, package build, CLI smoke, CI, CodeQL, and the real CM artifact workflow pass.
• No secret value, placeholder secret, or deployment authority is added to checked-in config or workflow payloads.

Relationships

• Blocks cbusillo/launchplane#1768.
• Regression follow-up to cbusillo/odoo-devkit#80.
• Failure evidence: cbusillo/odoo-tenant-cm workflow run 29626583285.

Decisions

• Fix the consumer contract in devkit; do not weaken Launchplane's non-secret artifact-input boundary.
• Filter stack required keys to artifact-publish input keys instead of disabling build-input validation wholesale.

[shiny-code-bot]

Completed by PR #86, merged as f72b08f5cf4ec940c55e6005fd15fbf77e8813d0.

Evidence:

• 214 devkit tests passed with 1 skip; Ruff, format, package build, CLI smoke, JetBrains inspection, CI, CodeQL, and post-merge gates passed;
• CM workflow run 29626583285 attempt 2 advanced through the full build/push path without deployment secrets, proving the publish-only boundary fix;
• the final fresh CM workflow 29628203239 completed successfully and persisted the artifact.

The artifact-publish secret-boundary regression is resolved.