Publish per-artifact layers as multi-arch OCI indexes: by jacobweinstock · Pull Request #39 · tinkerbell/captain

jacobweinstock · 2026-03-06T04:22:10Z

Description

Each artifact file is now its own layer so registries deduplicate shared blobs between per-arch and combined images. All three images (amd64, arm64, combined) are multi-arch OCI indexes.

Add --target flag (amd64/arm64/both) separate from --arch
Remove index subcommand; publish creates all three images
Update tag to tag all three images via tag_all
Add recap messages to publish, pull, and tag
Fix crane tarball filename in Dockerfile.release
Update CI to use target matrix and remove create-artifact-index job

Fixes: #

How Has This Been Tested?

How are existing users impacted? What migration steps/scripts do we need?

Checklist:

I have:

updated the documentation and/or roadmap (if required)
added unit or e2e tests
provided instructions on how to upgrade

Each artifact file is now its own layer so registries deduplicate shared blobs between per-arch and combined images. All three images (amd64, arm64, combined) are multi-arch OCI indexes. - Add --target flag (amd64/arm64/both) separate from --arch - Remove index subcommand; publish creates all three images - Update tag to tag all three images via tag_all - Add recap messages to publish, pull, and tag - Fix crane tarball filename in Dockerfile.release - Update CI to use target matrix and remove create-artifact-index job Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>

Copilot

Pull request overview

This PR updates the release artifact publishing flow so each artifact file is pushed as its own OCI layer (enabling registry blob deduplication) and so the published references are multi-arch OCI indexes. It also updates the release CLI and GitHub Actions workflows to align with the new publish/pull/tag semantics.

Changes:

Refactors captain/oci.py publish/pull/tag logic to push deterministic per-file layers and create multi-arch indexes for per-arch and combined images.
Updates build.py release CLI to add --target and remove the index subcommand; tag now tags all related images.
Adjusts CI/release workflows to publish/pull using target and removes the separate “create index” CI job; fixes crane tarball handling in Dockerfile.release.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
`captain/oci.py`	Implements per-artifact deterministic layers, new multi-arch index publishing flow, and `tag_all`.
`captain/cli.py`	Adds `--target`, removes `release index`, and switches `release tag` to tag all images.
`Dockerfile.release`	Fixes crane tarball download/extract path consistency.
`.github/workflows/release.yml`	Pulls amd64/arm64/both artifacts and uploads them to GitHub Releases; updates tagging step text.
`.github/workflows/ci.yml`	Publishes per-target images (amd64/arm64/both) and removes the standalone index creation job.

Comments suppressed due to low confidence (1)

captain/cli.py:1160

The release subcommands accept --target (and docker-mode forwards TARGET=...), but release tag currently ignores it and always calls oci.tag_all(...). This is confusing for users and makes the CLI contract inconsistent. Either (a) make tag respect --target (tag only the requested per-arch image and/or the combined one as appropriate), or (b) don’t register --target for the tag subcommand so it can’t be provided.

    elif sub == "tag":
        version = rest[0]
        oci.tag_all(
            registry=registry,
            repository=repository,
            artifact_name=artifact_name,
            src_tag=tag,
            new_tag=version,
            logger=rlog,
        )

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>

…ction: Avoids leftover intermediate tags in the registry by capturing each platform manifest digest and passing digest refs to crane index append. Removes the redundant artifacts.collect_kernel() call from publish(); _collect_arch_artifacts already handles kernel collection. Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

crane.digest() was using raw subprocess.run instead of the shared util.run() helper used by every other function in the module. README GitHub Release section claimed all three image variants were pulled; the workflow only pulls the combined image. Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

captain/cli.py:412

--git-sha (and --version-exclude, below) are release-wide inputs used by version-tag resolution, not target-specific knobs. Consider moving these out of the "target" argument group (e.g., into _add_release_base_flags) so they’re always parsed for publish, pull, and tag and work consistently via env vars in CI.

        "--git-sha",
        env_var="GITHUB_SHA",
        metavar="SHA",
        default=None,
        help="git commit SHA (default: from git rev-parse HEAD)",

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

1. Fix cli flag not getting plumbed in. 2. Fix git dubious ownership in docker causing tag look ups to fall back to v0.0.0 Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

captain/cli.py:421

_add_release_target_flag() currently defines --git-sha and --version-exclude even though its docstring says it’s only for publish/pull. Since the release tag subcommand help doesn’t include this flag-adder, build.py release tag -h won’t document these options even though _cmd_release reads them (and docker-mode forwards VERSION_EXCLUDE). Consider moving --git-sha/--version-exclude into _add_release_base_flags (or adding them to the tag subcommand’s help adders) and leaving _add_release_target_flag to define only --target.

def _add_release_target_flag(parser: configargparse.ArgParser) -> None:
    """--target flag for publish and pull (not tag)."""
    g = parser.add_argument_group("target")
    g.add_argument(
        "--target",
        env_var="TARGET",
        default=None,
        choices=["amd64", "arm64", "both"],
        help="artifact target (amd64, arm64, or both; default: --arch value)",
    )
    g.add_argument(
        "--git-sha",
        env_var="GITHUB_SHA",
        metavar="SHA",
        default=None,
        help="git commit SHA (default: from git rev-parse HEAD)",
    )
    g.add_argument(
        "--version-exclude",
        env_var="VERSION_EXCLUDE",
        metavar="TAG",
        default=None,
        help="tag to exclude from git-describe version lookup",
    )

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

mergify · 2026-03-06T06:18:48Z

jacobweinstock requested a review from Copilot March 6, 2026 04:22

Copilot started reviewing on behalf of jacobweinstock March 6, 2026 04:22 View session

Copilot AI reviewed Mar 6, 2026

View reviewed changes

Comment thread captain/oci.py

Comment thread captain/oci.py Outdated

Comment thread .github/workflows/release.yml

jacobweinstock added 2 commits March 5, 2026 21:32

Update readme with release details

d3ac8f9

Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>

jacobweinstock requested a review from Copilot March 6, 2026 04:57

Copilot started reviewing on behalf of jacobweinstock March 6, 2026 04:57 View session

Copilot AI reviewed Mar 6, 2026

View reviewed changes

Comment thread .github/workflows/release.yml

Comment thread README.md Outdated

Comment thread captain/crane.py Outdated

jacobweinstock requested a review from Copilot March 6, 2026 05:17

Copilot started reviewing on behalf of jacobweinstock March 6, 2026 05:18 View session

Copilot AI reviewed Mar 6, 2026

View reviewed changes

Comment thread captain/cli.py

Comment thread captain/oci.py

jacobweinstock added 2 commits March 5, 2026 22:36

remove unused flag

388ea90

Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>

fix help menu formatting

5d23ff7

Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>

jacobweinstock requested a review from Copilot March 6, 2026 05:39

Copilot started reviewing on behalf of jacobweinstock March 6, 2026 05:39 View session

Copilot AI reviewed Mar 6, 2026

View reviewed changes

Comment thread captain/cli.py

Comment thread captain/cli.py

Comment thread .github/workflows/ci.yml

Comment thread .github/workflows/release.yml

Fixes:

c1dc649

1. Fix cli flag not getting plumbed in. 2. Fix git dubious ownership in docker causing tag look ups to fall back to v0.0.0 Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>

jacobweinstock requested a review from Copilot March 6, 2026 06:09

Copilot started reviewing on behalf of jacobweinstock March 6, 2026 06:09 View session

Copilot AI reviewed Mar 6, 2026

View reviewed changes

jacobweinstock added the ready-to-merge Signal Mergify to merge the PR label Mar 6, 2026

mergify Bot added the queued label Mar 6, 2026

mergify Bot added a commit that referenced this pull request Mar 6, 2026

Merge of #39

5c529e5

mergify Bot mentioned this pull request Mar 6, 2026

merge queue: embarking main (e40f755) and #39 together #40

Closed

97 tasks

mergify Bot merged commit 7540d73 into tinkerbell:main Mar 6, 2026
19 checks passed

mergify Bot removed the queued label Mar 6, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Publish per-artifact layers as multi-arch OCI indexes:#39

Publish per-artifact layers as multi-arch OCI indexes:#39
mergify[bot] merged 7 commits intotinkerbell:mainfrom
jacobweinstock:all-artifacts-image

jacobweinstock commented Mar 6, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

mergify Bot commented Mar 6, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

jacobweinstock commented Mar 6, 2026

Description

How Has This Been Tested?

How are existing users impacted? What migration steps/scripts do we need?

Checklist:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

mergify Bot commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Queue Status

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mergify Bot commented Mar 6, 2026 •

edited

Loading