feat(ci): integrate COSE package repository publishing by pront · Pull Request #26753 · vectordotdev/vector

pront · 2026-10-20T19:12:55Z

Summary

Move Vector's apt/yum publication from Datadog release tooling to COSE S3 with a Vector-owned signing key. Merge #26848 first; this integration PR is stacked on its branch.

Changes

Add protected publishing and maintenance workflows with separate signing and AWS jobs, team approval, retry bundles, rollback, and lock recovery.
Install apt/RPM/GPG tools on Ubuntu runners before acquiring credentials, and download the versioned opt-in vdev archive. Publication jobs reuse the prebuilt binary without Docker or rebuilding it.
Add production configuration, the public key, and the setup/migration script. Preserve repository options and existing shared Datadog trust; handle ARMv7 URLs with or without a trailing slash.
Remove the Debian package's Datadog key-package recommendation and replace dd-pkg installation linting with native package checks.

Automated production publication remains disabled. The protected status canary, migration materials, announcement, and routing cutover remain outstanding. Signing trusts authorized GitHub release publishers; independent build-provenance verification is deferred.

References

Prerequisite: feat(vdev): add package repository publishing commands #26848.

Vector configuration

No Vector runtime configuration changes. Publisher settings and public signing fingerprints are pinned in distribution/repositories/production.json.

How did you test this PR?

Private native-runner integration passed all 12 jobs. Three fresh runners reused one release archive, fetched and signed real 0.59.0/0.60.0 packages, then exercised S3 publication, exact-byte retries, and interrupted rollback. Installation, upgrade, downgrade, recovery, and package lint passed on Ubuntu 20.04, Debian 13, and AlmaLinux 8/9, each on amd64 and arm64.
Installer tests previously covered fresh setup and early/late migration on Debian/Ubuntu and AlmaLinux, plus 28 ARMv7 URL cases and six maintenance output-directory cases. Historical migration evidence.
Workflow formatting/lint passed. The publisher source and dependencies match the tested prerequisite.
The new archive has not been published to the release CDN; the sandbox supplies it locally to the production installer script. Production OIDC status, routing/cutover, native ARMv7, and actual RC client installs remain unverified.

The stacked-base test-deny check still reports the existing zstd advisories. The fix in #26845 has merged into master; the prerequisite PR’s dependency check is green.

Is this a breaking change?

Yes. At cutover, existing apt/yum users must install the new signing key using the migration command.
No

Does this PR include user facing changes?

Yes. The migration announcement and guide will cover the Debian key-package change and repository trust migration before cutover. This PR intentionally uses no-changelog instead of a separate fragment.
No.

Contributor Guidelines

Signed commits; published review history is preserved.

Consume verified release assets, sign with an isolated OpenPGP subkey, and publish incremental apt/yum repositories through conditional S3 writes. Include protected maintenance commands, offline CI coverage, native package checks, and operator documentation. Production publication remains gated until migration cutover. AI assistance: GPT-6 (Codex).

chatgpt-codex-connector · 2026-10-21T14:57:11Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T19:59:53.340127Z	`0c28075`	New commits
🔒 Security Review	✅ Completed 2026-10-28T20:01:24.304332Z	`0c28075`	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

datadoghq-integration

More details

The completed static review identified no actionable correctness defects. Automated publication remains gated off; readiness for production cutover was not established.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 9b15dbc}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7bfc6bf8fc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

… majors

datadoghq-integration

Two of the most critical issues are: the ARMv7 repository URL replacement misses URLs without a trailing slash, causing HTTP 404 on repo refresh; and enabling default-https-client features in vdev/Cargo.toml introduces a second Rustls provider that conflicts with Vector's Ring provider, causing panics in workspace builds.

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 02eb039}

datadoghq-integration

Two distinct issues were identified: a GitHub Actions concurrency group configuration that can silently drop pending release publications, and a DNF transaction failure caused by unconditionally requesting the full curl package on systems with curl-minimal installed.

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 04afe1b}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a63c2a645b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

datadoghq-integration

More details

The static review identified no reportable defect in publication retries, rollback, or repository trust migration. Production publishing and native package-client integration were not rerun.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit b11727b}

Preserve curl-minimal during RPM prerequisite repair and verify the published opt-in vdev archive before execution. AI assistance: GPT-6 (Codex).

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0c28075e82

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-28T19:59:49Z

+for path in "${candidates[@]}"; do
+    [[ -f "$path" && "$path" != "$source_file" ]] || continue
+    if [[ "$path" == "$timber_file" && "${CSM_MIGRATE:-false}" == true ]]; then continue; fi
+    if awk '!/^[[:space:]]*[#;]/ && /vector-[0-9]+|^\[vector\]/ { found=1 } END { exit !found }' "$path"; then


Detect indented duplicate RPM repository sections

When another .repo file defines an indented header such as [vector], this preflight does not detect it because the header pattern is anchored at column one, even though the migration parser later explicitly accepts leading whitespace around [vector]. The script therefore creates a second repository with the same ID instead of refusing the ambiguous configuration, leaving DNF/YUM to resolve conflicting repository settings; allow leading whitespace in this predicate.

Useful? React with 👍 / 👎.

pront added the no-changelog Changes in this PR do not need user-facing explanations in the release changelog label Oct 20, 2026

pront added 10 commits October 21, 2026 09:58

feat(ci): add COSE package repository setup and migration

e0eb2fb

fix(ci): refresh signed metadata when rolling back package repositories

ee156ee

docs(packaging): note removal of Datadog key recommendation

0f62aa7

refactor(ci): keep package repository fixtures in the private sandbox

8ebff2e

docs(packaging): use the migration announcement for release notes

d501fb6

refactor(releasing): implement package repository publishing in Rust

4a1efdc

fix(releasing): reuse signed bundles across archive encodings

a292175

docs(releasing): explain package repository jobs inline

92355eb

refactor(releasing): simplify package repository verification

9b15dbc

pront force-pushed the pront-cose-package-publisher branch from 700c6a3 to 9b15dbc Compare October 21, 2026 14:44

pront marked this pull request as ready for review October 21, 2026 14:48

pront requested a review from a team as a code owner October 21, 2026 14:48

datadoghq-integration Bot reviewed Oct 21, 2026

View reviewed changes

pront added 2 commits October 21, 2026 16:26

Merge master before updating package publisher tooling

6444bea

Use the standard vdev installer for package repository jobs

7bfc6bf

chatgpt-codex-connector Bot reviewed Oct 21, 2026

View reviewed changes

Comment thread distribution/repositories/setup.sh Resolved

Comment thread distribution/repositories/setup.sh Resolved

Comment thread vdev/src/commands/release/repositories/publisher/inputs.rs Resolved

pront added 2 commits October 21, 2026 18:33

fix(releasing): correct ARMv7 repository setup and reject unsupported…

8f4dc4f

… majors

Merge master and refresh package publisher vdev version

fefeb0f

github-actions Bot added the domain: vdev label Oct 22, 2026

pront removed the domain: vdev label Oct 22, 2026

Use a manually published GHCR image for package repositories

02eb039

pront marked this pull request as draft October 26, 2026 13:56

pront marked this pull request as ready for review October 26, 2026 14:01

datadoghq-integration Bot reviewed Oct 26, 2026

View reviewed changes

Comment thread distribution/repositories/setup.sh Resolved

Comment thread distribution/repositories/setup.sh Resolved

Comment thread .github/workflows/package-repositories-maintenance.yml Resolved

Comment thread vdev/Cargo.toml Resolved

pront added 4 commits October 26, 2026 12:37

fix(releasing): migrate ARMv7 repository URLs without trailing slashes

6092717

fix(ci): create the package repository status output directory

c676cd6

fix(releasing): use Ring for publisher AWS clients

6c34189

feat(vdev): add package repository publishing commands

2162f20

pront mentioned this pull request Oct 26, 2026

feat(vdev): add package repository publishing commands #26848

Merged

2 of 4 tasks

Merge vdev publisher prerequisite for #26848

04afe1b

pront changed the title ~~feat(ci): add COSE package repository publishing~~ feat(ci): integrate COSE package repository publishing Oct 26, 2026

pront changed the base branch from master to pront-vdev-package-repositories October 26, 2026 17:31

github-actions Bot removed the domain:vdev Anything related to the vdev tooling label Oct 26, 2026

pront added 3 commits October 26, 2026 13:45

feat(vdev): make package repository commands opt in

15f76d6

fix(ci): load opt-in vdev from the publisher image

885653e

Merge opt-in package repository tooling

6dbe965

datadoghq-integration Bot reviewed Oct 26, 2026

View reviewed changes

Comment thread .github/workflows/package-repositories.yml Resolved

Comment thread distribution/repositories/setup.sh Resolved

pront added 3 commits October 26, 2026 15:15

refactor(vdev): run package repository tooling natively

d0bb35a

refactor(ci): install package publishing tools on the runner

edcba5f

Merge native package repository tooling

a63c2a6

chatgpt-codex-connector Bot reviewed Oct 26, 2026

View reviewed changes

Comment thread .github/actions/package-repository-tools/action.yml Resolved

Comment thread .github/actions/package-repository-tools/action.yml Resolved

docs(ci): document interrupted package upload recovery

b11727b

Base automatically changed from pront-vdev-package-repositories to master October 26, 2026 22:53

datadoghq-integration Bot reviewed Oct 26, 2026

View reviewed changes

pront added 2 commits October 26, 2026 21:13

Merge master after package repository tooling landed

cb9f6b1

fix(ci): pin publisher tools and preserve queued releases

0c28075

Preserve curl-minimal during RPM prerequisite repair and verify the published opt-in vdev archive before execution. AI assistance: GPT-6 (Codex).

chatgpt-codex-connector Bot reviewed Oct 28, 2026

View reviewed changes

Conversation

pront commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

References

Vector configuration

How did you test this PR?

Is this a breaking change?

Does this PR include user facing changes?

Contributor Guidelines

Uh oh!

chatgpt-codex-connector Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

datadoghq-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

datadoghq-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

datadoghq-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

datadoghq-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Oct 28, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

pront commented Oct 20, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 21, 2026 •

edited

Loading