ci: add pmat comply, binary artifact upload, and ghcr.io image push#1
Closed
noahgift wants to merge 1 commit into
Closed
ci: add pmat comply, binary artifact upload, and ghcr.io image push#1noahgift wants to merge 1 commit into
noahgift wants to merge 1 commit into
Conversation
The `gate` matrix gains a `pmat comply` step (stable-toolchain only — pmat's deps may exceed our 1.85.0 MSRV, and compliance is project-level). Two new jobs run on push to main and tag pushes: - `build-binary` — static musl build of the `etl` CLI, uploaded as the `etl-x86_64-unknown-linux-musl` workflow artifact. On vX.Y.Z tag pushes the binary is also attached to the GitHub Release via softprops. - `build-image` — multi-stage musl/scratch container build pushed to `ghcr.io/paiml/shipping-rust`. Tags: `latest` on main, `vX.Y.Z` and `vX.Y` on semver tags, plus a short-sha tag for traceability. Uses GHA-backed buildx cache. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
3 tasks
Contributor
Author
|
Closing in favor of two split PRs that ship the same intent more cleanly:
The diff here was conflicting with main and CI was failing — superseded rather than rebased. |
noahgift
added a commit
that referenced
this pull request
Apr 28, 2026
pmat is paiml's quality + compliance tool — runs the same ruleset that gates other paiml repos. Installed via the existing prebuilt-CLI pattern (same shape as bashrs + pv: download tarball, extract, add to PATH) rather than `cargo install pmat --locked` which would burn ~3 min per CI run compiling from source. Stable-only — same reasoning as bashrs + pv: the lint runs once across the toolchain matrix, while the MSRV (1.85.0) matrix entry still proves the workspace itself builds. This is the only piece of #1 worth keeping. The binary-upload + GHCR push from #1 was superseded by today's tag-driven release.yml (#7), which is the architecturally correct home for those (separate from the CI gate, fires on tags only). Closing #1 in favor of that split. Verified: `pmat comply` exits 0 on shipping-rust today. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
gatejob gains apmat complystep (stable toolchain only — pmat's transitive deps may exceed our 1.85.0 MSRV, and compliance is project-level).build-binaryjob: static musl build of theetlCLI uploaded as theetl-x86_64-unknown-linux-muslworkflow artifact on push to main; onvX.Y.Ztag pushes the same binary is attached to the GitHub Release.build-imagejob: multi-stage musl/scratch container pushed toghcr.io/paiml/shipping-rust. Tags follow docker/metadata-action defaults —lateston main,vX.Y.ZandvX.Yon semver tags, plus a short-sha tag for traceability. Uses GHA-backed buildx cache.Both new jobs depend on
gateand only run on push/dispatch (PRs still get the full gate matrix; image push is naturally restricted to whereGITHUB_TOKENhaspackages: write).Test plan
gate (1.85.0)passes — fmt / clippy / doc / test / 100% coverage / audit / deny / size budget / bench-smoke.gate (stable)passes — same as above, pluspmat comply.build-binaryproducesetl-x86_64-unknown-linux-muslartifact downloadable from the workflow run.build-imagepush lands atghcr.io/paiml/shipping-rust:latestafter merge to main.docker pull ghcr.io/paiml/shipping-rust:latest && printf 'id,fruit,weight_g\n1,apple,150\n' | docker run --rm -i ghcr.io/paiml/shipping-rust:latestround-trips a JSON Lines record post-merge.🤖 Generated with Claude Code