feat(ci): integrate COSE package repository publishing

.github/actions/package-repository-tools/action.yml

@@ -0,0 +1,34 @@
+name: Pull package repository image
+description: Pull the selected immutable publisher image from private GHCR storage.
+inputs:
+  image:
+    description: Publisher image pinned by its full GHCR SHA-256 digest
+    required: true
+  token:
+    description: GitHub token with read access to the container package
+    required: true
+outputs:
+  image:
+    description: Exact image reference used by this job
+    value: ${{ steps.pull.outputs.image }}
+runs:
+  using: composite
+  steps:
+    - id: pull
+      shell: bash
+      env:
+        PUBLISHER_IMAGE: ${{ inputs.image }}
+        GHCR_TOKEN: ${{ inputs.token }}
+      run: |
+        [[ "$PUBLISHER_IMAGE" =~ ^ghcr\.io/vectordotdev/[a-z0-9._/-]+@sha256:[0-9a-f]{64}$ ]] || {
+          echo 'Set PACKAGE_REPOSITORIES_IMAGE to the digest reported by Package Repository Image.' >&2
+          exit 1
+        }
+        # Keep registry credentials in memory and remove them before any signing/AWS step.
+        export DOCKER_CONFIG
+        DOCKER_CONFIG=$(mktemp -d /dev/shm/package-registry.XXXXXX)
+        trap 'rm -rf "$DOCKER_CONFIG"' EXIT
+        printf '%s' "$GHCR_TOKEN" | docker login ghcr.io --username "$GITHUB_ACTOR" --password-stdin
+        docker pull "$PUBLISHER_IMAGE"
+        docker tag "$PUBLISHER_IMAGE" vector-package-publisher:local
+        echo "image=$PUBLISHER_IMAGE" >> "$GITHUB_OUTPUT"

.github/workflows/changes.yml

@@ -52,6 +52,8 @@ on:
         value: ${{ jobs.source.outputs.website_tests }}
       install:
         value: ${{ jobs.source.outputs.install }}
+      package_repositories:
+        value: ${{ jobs.source.outputs.package_repositories }}
       actionlint:
         value: ${{ jobs.source.outputs.actionlint }}
       prettier:
@@ -187,6 +189,7 @@ jobs:
       markdown: ${{ steps.filter.outputs.markdown }}
       scripts: ${{ steps.filter.outputs.scripts }}
       install: ${{ steps.filter.outputs.install }}
+      package_repositories: ${{ steps.filter.outputs.package_repositories }}
       k8s: ${{ steps.filter.outputs.k8s }}
       website_only: ${{ steps.filter.outputs.website == 'true' && steps.filter.outputs.not_website == 'false' }}
       website_tests: ${{ steps.website_filter.outputs.website_tests }}
@@ -283,6 +286,15 @@ jobs:
               - ".github/workflows/install-sh.yml"
               - "distribution/install.sh"
               - ".github/workflows/changes.yml"
+            package_repositories:
+              - "distribution/repositories/**"
+              - "vdev/**"
+              - "Cargo.toml"
+              - "Cargo.lock"
+              - "rust-toolchain.toml"
+              - ".github/actions/package-repository-tools/**"
+              - ".github/workflows/package-repositories*.yml"
+              - ".github/workflows/changes.yml"
             k8s:
               - "src/sources/kubernetes_logs/**"
               - "lib/k8s-e2e-tests/**"

.github/workflows/package-repositories-image.yml

@@ -0,0 +1,90 @@
+name: Package Repository Image
+
+on:
+  workflow_dispatch:
+
+permissions: {}
+
+# Rebuild manually after publisher/dependency changes or to refresh OS packages.
+# A successful build does not change the image selected for production jobs.
+concurrency:
+  group: package-repositories-image
+  cancel-in-progress: false
+
+jobs:
+  # Build without package-signing or AWS credentials; publish only from master.
+  build:
+    if: github.repository_id == '146327667' && github.ref == 'refs/heads/master'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    permissions:
+      contents: read
+      packages: write
+    env:
+      IMAGE_NAME: ghcr.io/vectordotdev/vector-package-publisher
+    outputs:
+      image: ${{ steps.publish.outputs.image }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - name: Build, check and publish a private image
+        id: publish
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          package="orgs/vectordotdev/packages/container/${IMAGE_NAME##*/}"
+          metadata="$RUNNER_TEMP/package-image.json"
+          gh api "$package" > "$metadata" || jq -e '.status == "404"' "$metadata" >/dev/null
+          jq -e '.status == "404" or .visibility == "private"' "$metadata" >/dev/null
+
+          revision=$(git rev-parse HEAD)
+          tag="$IMAGE_NAME:$revision-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          docker build --pull --no-cache --tag "$tag" \
+            --label "org.opencontainers.image.source=https://github.com/$GITHUB_REPOSITORY" \
+            --label "org.opencontainers.image.revision=$revision" \
+            --file distribution/repositories/Dockerfile .
+          docker run --rm "$tag" --help
+          docker run --rm --entrypoint sh "$tag" -ec \
+            'for tool in vdev apt-ftparchive dpkg-deb createrepo_c rpm rpmsign gpg; do command -v "$tool"; done'
+
+          # Registry credentials stay in memory; the new GHCR package is private by default.
+          export DOCKER_CONFIG
+          DOCKER_CONFIG=$(mktemp -d /dev/shm/package-registry.XXXXXX)
+          trap 'rm -rf "$DOCKER_CONFIG"' EXIT
+          printf '%s' "$GH_TOKEN" | docker login ghcr.io --username "$GITHUB_ACTOR" --password-stdin
+          docker push "$tag"
+          test "$(gh api "$package" --jq .visibility)" = private
+          image=$(docker inspect --format '{{index .RepoDigests 0}}' "$tag")
+          [[ "$image" == "$IMAGE_NAME@sha256:"* ]]
+          echo "image=$image" >> "$GITHUB_OUTPUT"
+
+  # Pull from GHCR on a fresh runner before showing the digest operators can select.
+  verify:
+    needs: build
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: ./.github/actions/package-repository-tools
+        with:
+          image: ${{ needs.build.outputs.image }}
+          token: ${{ github.token }}
+      - name: Check the pulled image and report the manual selection command
+        env:
+          PUBLISHER_IMAGE: ${{ needs.build.outputs.image }}
+        run: |
+          docker run --rm vector-package-publisher:local --help
+          {
+            echo 'Set the repository variable below to select this image for future publishing and maintenance runs.'
+            echo '```sh'
+            printf 'gh variable set PACKAGE_REPOSITORIES_IMAGE --repo %s --body %s\n' "$GITHUB_REPOSITORY" "$PUBLISHER_IMAGE"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/package-repositories-maintenance.yml

@@ -0,0 +1,232 @@
+name: Package Repository Maintenance
+
+on:
+  workflow_dispatch:
+    inputs:
+      operation:
+        description: Inspect state, restore a package selection, or recover an abandoned lock
+        type: choice
+        options: [status, rollback, recover-lock]
+        default: status
+      snapshot:
+        description: Exact archived snapshot SHA-256 for rollback
+        type: string
+      expected_version:
+        description: Exact control-object S3 version reported by status, for lock recovery
+        type: string
+      confirm_owner_stopped:
+        description: The previous workflow/process and its in-flight writes have stopped
+        type: boolean
+        default: false
+
+permissions: {}
+
+concurrency:
+  group: package-repositories
+  cancel-in-progress: false
+
+jobs:
+  # Inspect S3 state, prepare a rollback, or recover a lock with the publishing role.
+  # Capture PACKAGE_REPOSITORIES_IMAGE once so every rollback job uses the same digest.
+  # Available even when automated publication is disabled. Recovery requires the exact
+  # control version, a stopped owner and an expired 65-minute recovery window.
+  maintain:
+    if: github.repository_id == '146327667' && github.ref == 'refs/heads/master'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    outputs:
+      publisher_image: ${{ steps.image.outputs.image }}
+    environment: package-repositories-publishing
+    permissions:
+      contents: read
+      packages: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - name: Validate the requested maintenance operation
+        env:
+          OPERATION: ${{ inputs.operation }}
+          SNAPSHOT: ${{ inputs.snapshot }}
+          EXPECTED_VERSION: ${{ inputs.expected_version }}
+          OWNER_STOPPED: ${{ inputs.confirm_owner_stopped }}
+        run: |
+          case "$OPERATION" in
+            status) ;;
+            rollback) [[ "$SNAPSHOT" =~ ^[0-9a-f]{64}$ ]] ;;
+            recover-lock) test -n "$EXPECTED_VERSION" && test "$OWNER_STOPPED" = true ;;
+            *) exit 1 ;;
+          esac
+      - uses: ./.github/actions/setup
+        with:
+          vdev: true
+          mold: false
+      - uses: ./.github/actions/package-repository-tools
+        id: image
+        with:
+          image: ${{ vars.PACKAGE_REPOSITORIES_IMAGE }}
+          token: ${{ github.token }}
+      - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
+        with:
+          role-to-assume: ${{ vars.PACKAGE_REPOSITORIES_ROLE_ARN }}
+          aws-region: us-east-1
+          role-duration-seconds: 900
+          role-session-name: package-maintenance-${{ github.run_id }}
+          allowed-account-ids: "486234852809"
+          unset-current-credentials: true
+      - name: Prepare rollback or run maintenance, and record the current state
+        env:
+          PACKAGE_REPOSITORIES_ROLE_ARN: ${{ vars.PACKAGE_REPOSITORIES_ROLE_ARN }}
+          OPERATION: ${{ inputs.operation }}
+          SNAPSHOT: ${{ inputs.snapshot }}
+          EXPECTED_VERSION: ${{ inputs.expected_version }}
+        run: |
+          case "$OPERATION" in
+            status) ;;
+            rollback)
+              "$VDEV" release repositories rollback base "$SNAPSHOT"
+              ;;
+            recover-lock)
+              "$VDEV" release repositories recover-lock \
+                --expected-version "$EXPECTED_VERSION" --confirm-owner-stopped
+              ;;
+          esac
+          "$VDEV" release repositories status > target/package-repository-status.json
+          cat target/package-repository-status.json
+          {
+            echo '```json'
+            cat target/package-repository-status.json
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        if: inputs.operation == 'rollback'
+        with:
+          name: package-repository-rollback-base
+          path: target/package-repositories/
+          retention-days: 1
+          if-no-files-found: error
+
+  # Refresh apt dates/signatures so cached clients accept the archived package selection.
+  # Reuse saved rollback output on retries; the signing job has no AWS credentials.
+  sign:
+    needs: maintain
+    if: inputs.operation == 'rollback'
+    runs-on: ubuntu-24.04
+    environment: package-repositories-signing
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          vdev: true
+          mold: false
+      - uses: ./.github/actions/package-repository-tools
+        with:
+          image: ${{ needs.maintain.outputs.publisher_image }}
+          token: ${{ github.token }}
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: package-repository-rollback-base
+          path: target/package-repositories
+      - id: cached
+        run: |
+          if test -f target/package-repositories/result/manifest.json; then
+            echo 'ready=true' >> "$GITHUB_OUTPUT"
+          fi
+      - name: Sign fresh apt roots for the selected archived indexes
+        if: steps.cached.outputs.ready != 'true'
+        env:
+          PACKAGE_SIGNING_SUBKEY: ${{ secrets.PACKAGE_SIGNING_SUBKEY }}
+          PACKAGE_SIGNING_PASSPHRASE: ${{ secrets.PACKAGE_SIGNING_PASSPHRASE }}
+        run: '"$VDEV" release repositories rollback prepare'
+      # Private material stays in the container's tmpfs, outside this artifact.
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: package-repository-rollback-signed
+          path: target/package-repositories/
+          retention-days: 1
+          if-no-files-found: error
+
+  # Restore the selected repository state under the shared S3 lock, rejecting stale plans.
+  # Uses AWS OIDC without the signing key; installed clients are not downgraded.
+  publish:
+    needs: [maintain, sign]
+    runs-on: ubuntu-24.04
+    environment: package-repositories-publishing
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      packages: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          vdev: true
+          mold: false
+      - uses: ./.github/actions/package-repository-tools
+        with:
+          image: ${{ needs.maintain.outputs.publisher_image }}
+          token: ${{ github.token }}
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: package-repository-rollback-signed
+          path: target/package-repositories
+      - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
+        with:
+          role-to-assume: ${{ vars.PACKAGE_REPOSITORIES_ROLE_ARN }}
+          aws-region: us-east-1
+          role-duration-seconds: 900
+          allowed-account-ids: "486234852809"
+          unset-current-credentials: true
+      - name: Publish the fresh rollback against its expected repository state
+        env:
+          PACKAGE_REPOSITORIES_ROLE_ARN: ${{ vars.PACKAGE_REPOSITORIES_ROLE_ARN }}
+        run: |
+          "$VDEV" release repositories rollback publish
+          "$VDEV" release repositories status > target/package-repository-status.json
+          cat target/package-repository-status.json
+          {
+            echo '```json'
+            cat target/package-repository-status.json
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  # Verify the restored indexes and fresh signed roots through public HTTPS.
+  endpoints:
+    needs: [maintain, publish]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          vdev: true
+          mold: false
+      - uses: ./.github/actions/package-repository-tools
+        with:
+          image: ${{ needs.maintain.outputs.publisher_image }}
+          token: ${{ github.token }}
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: package-repository-rollback-signed
+          path: target/package-repositories
+      - name: Verify the selected indexes and fresh roots through public HTTPS
+        run: '"$VDEV" release repositories rollback verify'