nordisk/dwarves
pipelines/release-build.runa.ron
// release-build.runa.ron — the SHAPE of every SLSA release build (lane RELBUILD-RUNA).
//
// A release build is a Runa pipeline: `dwarves release-build` plans one per request
// (`dwarves_slsa::runner::release_pipeline`) and the release runner (`relbuild`, on
// dwarf's host) runs it through the forge's Runa runner with CI's caps and cancel. Its
// runs are this pipeline's runs: `dwarves history`, the Pipeline tab, the server's
// History / GetRunReport / StepLog. This file is that plan for an example release (one
// repository, one crate, one binary); a test keeps it equal to the code. Run releases
// with `dwarves release-build request …`, never with `dwarves run` on this file: its
// Forge steps belong to the release runner.
(
name: "release-build",
triggers: [
Manual,
],
stages: [
(
name: "sources",
needs: [],
steps: [
Forge(
action: "slsa.checkout",
args: [
"example",
],
),
],
),
(
name: "seal-sources",
needs: [
"sources",
],
steps: [
Forge(
action: "slsa.seal-sources",
args: [],
),
],
),
(
name: "fetch",
needs: [
"seal-sources",
],
steps: [
Sandbox(
image: "localhost/nordisk-cargo-toolchain@sha256:875a7a325dfe7f6b838535d085a2a502e8ad250076c947f6d023b1e224f03334",
cmd: [
"cargo",
"vendor",
"--locked",
"--versioned-dirs",
"/vendor/crates",
],
env: [
("CARGO_HOME", "/cargo-home"),
("HOME", "/tmp"),
("CARGO_TERM_COLOR", "never"),
],
mounts: [
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/src",
path: "/src",
read_only: true,
),
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/vendor",
path: "/vendor",
read_only: false,
),
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/fetch-home",
path: "/cargo-home",
read_only: false,
),
],
tmpfs: [
(
path: "/tmp",
size_mb: 1024,
),
],
network: true,
workdir: "/src/example",
),
],
),
(
name: "probe-lock",
needs: [
"fetch",
],
steps: [
Sandbox(
image: "localhost/nordisk-cargo-toolchain@sha256:875a7a325dfe7f6b838535d085a2a502e8ad250076c947f6d023b1e224f03334",
cmd: [
"cargo",
"generate-lockfile",
],
env: [
("CARGO_HOME", "/cargo-home"),
("HOME", "/tmp"),
("CARGO_TERM_COLOR", "never"),
],
mounts: [
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/src",
path: "/src",
read_only: true,
),
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/vendor",
path: "/vendor",
read_only: false,
),
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/fetch-home",
path: "/cargo-home",
read_only: false,
),
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/probe",
path: "/probe",
read_only: false,
),
],
tmpfs: [
(
path: "/tmp",
size_mb: 1024,
),
],
network: true,
workdir: "/probe",
),
],
),
(
name: "probe-vendor",
needs: [
"probe-lock",
],
steps: [
Sandbox(
image: "localhost/nordisk-cargo-toolchain@sha256:875a7a325dfe7f6b838535d085a2a502e8ad250076c947f6d023b1e224f03334",
cmd: [
"cargo",
"vendor",
"--locked",
"--versioned-dirs",
"--no-delete",
"/vendor/crates",
],
env: [
("CARGO_HOME", "/cargo-home"),
("HOME", "/tmp"),
("CARGO_TERM_COLOR", "never"),
],
mounts: [
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/src",
path: "/src",
read_only: true,
),
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/vendor",
path: "/vendor",
read_only: false,
),
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/fetch-home",
path: "/cargo-home",
read_only: false,
),
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/probe",
path: "/probe",
read_only: false,
),
],
tmpfs: [
(
path: "/tmp",
size_mb: 1024,
),
],
network: true,
workdir: "/probe",
),
],
),
(
name: "vendor-check",
needs: [
"probe-vendor",
],
steps: [
Forge(
action: "slsa.vendor-check",
args: [],
),
],
),
(
name: "package-0-example",
needs: [
"vendor-check",
],
steps: [
Sandbox(
image: "localhost/nordisk-cargo-toolchain@sha256:875a7a325dfe7f6b838535d085a2a502e8ad250076c947f6d023b1e224f03334",
cmd: [
"cargo",
"package",
"--locked",
"--offline",
"--no-verify",
"--registry",
"crates-io",
"-p",
"example",
"--target-dir",
"/target/example",
],
env: [
("CARGO_HOME", "/cargo-home"),
("HOME", "/tmp"),
("CARGO_TERM_COLOR", "never"),
("CARGO_BUILD_JOBS", "4"),
("GIT_CONFIG_COUNT", "2"),
("GIT_CONFIG_KEY_0", "safe.directory"),
("GIT_CONFIG_VALUE_0", "*"),
("GIT_CONFIG_KEY_1", "lfs.storage"),
("GIT_CONFIG_VALUE_1", "/lfs"),
],
mounts: [
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/src",
path: "/src",
read_only: true,
),
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/vendor",
path: "/vendor",
read_only: true,
),
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/stage",
path: "/stage",
read_only: true,
),
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/published",
path: "/published",
read_only: true,
),
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/plan",
path: "/plan",
read_only: true,
),
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/target",
path: "/target",
read_only: false,
),
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/cargo-home",
path: "/cargo-home",
read_only: false,
),
],
tmpfs: [
(
path: "/tmp",
size_mb: 2048,
),
(
path: "/lfs",
size_mb: 2048,
),
],
network: false,
workdir: "/src/example/crates/example",
),
],
),
(
name: "stage-0-example",
needs: [
"package-0-example",
],
steps: [
Forge(
action: "slsa.stage",
args: [
"example",
"1.0.0",
],
),
],
),
(
name: "binary-0-example-sources",
needs: [
"stage-0-example",
],
steps: [
Forge(
action: "slsa.prepare-binary",
args: [
"example",
"1.0.0",
],
),
],
),
(
name: "binary-0-example",
needs: [
"binary-0-example-sources",
],
steps: [
Sandbox(
image: "localhost/nordisk-cargo-toolchain@sha256:875a7a325dfe7f6b838535d085a2a502e8ad250076c947f6d023b1e224f03334",
cmd: [
"cargo",
"build",
"--release",
"--locked",
"--offline",
"--bin",
"example",
"--target-dir",
"/target/bin",
],
env: [
("CARGO_HOME", "/cargo-home"),
("HOME", "/tmp"),
("CARGO_TERM_COLOR", "never"),
("CARGO_BUILD_JOBS", "4"),
("GIT_CONFIG_COUNT", "2"),
("GIT_CONFIG_KEY_0", "safe.directory"),
("GIT_CONFIG_VALUE_0", "*"),
("GIT_CONFIG_KEY_1", "lfs.storage"),
("GIT_CONFIG_VALUE_1", "/lfs"),
],
mounts: [
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/src",
path: "/src",
read_only: true,
),
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/vendor",
path: "/vendor",
read_only: true,
),
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/stage",
path: "/stage",
read_only: true,
),
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/published",
path: "/published",
read_only: true,
),
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/plan",
path: "/plan",
read_only: true,
),
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/target",
path: "/target",
read_only: false,
),
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/cargo-home",
path: "/cargo-home",
read_only: false,
),
(
host: "/srv/relbuild/runs/example-1.0.0-20261029T000000Z/work",
path: "/work",
read_only: false,
),
],
tmpfs: [
(
path: "/tmp",
size_mb: 2048,
),
(
path: "/lfs",
size_mb: 2048,
),
],
network: false,
workdir: "/work/example-1.0.0",
),
],
),
(
name: "binary-0-example-out",
needs: [
"binary-0-example",
],
steps: [
Forge(
action: "slsa.collect-binary",
args: [
"example",
"bin",
],
),
],
),
],
)