chore(release): merge werf v3 into delivery-kit - #225
Draft
alexey-igrychev wants to merge 239 commits into
Draft
Conversation
Signed-off-by: Ilya Lesikov <ilya@lesikov.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com> # Conflicts: # pkg/deploy/helm_for_werf_helm/chart_extender_for_werf_helm/helpers_for_werf_helm/service_values.go
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com> # Conflicts: # cmd/werf/common/components_manager.go
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com> # Conflicts: # cmd/werf/bundle/publish/publish.go # docs/_includes/reference/cli/werf_bundle_apply.md # docs/_includes/reference/cli/werf_converge.md # docs/_includes/reference/cli/werf_plan.md # docs/_includes/reference/cli/werf_render.md # go.mod # go.sum
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com> # Conflicts: # pkg/deploy/helm_for_werf_helm/chart_extender_for_werf_helm/helpers_for_werf_helm/service_values.go
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>
Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com> # Conflicts: # go.mod # go.sum
Remove all Ansible-related code, config parsing, CLI flags, tests, Stapel container packages, and documentation (EN/RU) for the Ansible builder in Stapel build instructions. Only the Shell builder remains. Deleted: - pkg/build/builder/ansible.go, ansible_assets.go, ansible_assets_data.go - pkg/build/builder/ansible/ (Python scripts, static embed) - pkg/config/ansible.go, ansible_task.go, raw_ansible.go, raw_ansible_task.go - test/legacy_e2e/suites/ansible/ (16 test files) - stapel/omnibus/config/software/ansible.rb Modified: - Removed Ansible branches from builder selection, config parsing, conveyor checks, and CLI env annotations - Relocated shared Extra struct and inlined mkdirP in shell.go - Cleaned Stapel Dockerfile and omnibus dependency - Updated all EN/RU docs and data YAML files Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
Remove deprecated artifact image type from werf codebase: - Rename ArtifactExport → Export, rawArtifactExport → rawExport - Delete StapelImageArtifact struct and artifact parsing logic - Remove artifact/fromArtifact/ArtifactName fields from config structs - Remove artifact directive references from parser and validator - Clean up build pipeline (dependencies, imports, image checks) - Update test fixtures to use image with final: false - Remove artifact references from documentation and data files BREAKING CHANGE: The artifact directive is no longer supported. Use image with final: false instead. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
Bring the SBOM documentation update from delivery-kit main into the v3 branch. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
## Summary Cached content anchors from Git-backed images are now reused even when the source commit recorded by an existing stage is unavailable. Ordinary Git stages retain commit validation because they need history to generate patches. ## What - A cached content anchor with a matching digest is selected without requiring its recorded Git commit to exist. - Non-anchor Git stages continue to reject cached stages whose recorded commits are unavailable. ## Why The terminal Git stage serving as a content anchor inherited ordinary stage selection, which validates the cached stage's recorded commit. A content anchor is content-addressed, so that validation wrongly prevents reuse when the commit is unavailable despite an intact remote stage. Selecting it through the base-stage policy removes the unnecessary Git dependency without weakening patch-stage safety. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
Bring the content-anchor reuse fix from the current upstream v3 branch into delivery-kit. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
Include signing and dm-verity mutation stages in content-anchor dependency calculation instead of inheriting the BaseStage panic. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
Use the v3 Docker backend mode in build E2E coverage and restore strict image-spec port assertions. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
Keep the English and Russian template documentation aligned with the v3 removal of Ansible, artifact images, and the Stapel docker directive. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
Include the packages stage in holistic checksums, accept packages stage dependencies, and use the content-tag descriptor when a cached image has no built stage image. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
Tag external fixture images and use exact v3 digest and backend-specific exposed-port expectations. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
Clear WERF_DISABLE_AUTO_HOST_CLEANUP during regeneration so local and CI output use the same default. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
Include SBOM enablement in anchor digests and use cached content-tag image information when no stage image was built. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
Require generated packages shell instructions before accepting git.stageDependencies.packages. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
The v3 Docker backend build error no longer prints the "Code: 127" prefix; keep asserting the pm-not-found diagnostic that still surfaces. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
The v3 stapel toolchain dropped the embedded cat binary, so resolving PACKAGES_VERSION/REGISTRY from /run/secrets produced an empty value and failed the packages stage on a scratch base. Read the secret with stapel head, which stays embedded and scratch-safe; the bash $(<file) builtin cannot be used because the surrounding 2>/dev/null || true guard turns it into a bare redirection that yields nothing. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
Pin the delivery-kit release to the werf v3 base merged into this branch (3.0.0-test.1), per the merge-upstream -dk.N policy. release-please reads this Release-As footer on push to main; CHANGELOG and the manifest are left for release-please. Release-As: v3.0.0-test.1-dk.1 Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
The `--local-resource-validation` flag is not needed anymore as we embedded schemas to the binary. So, we may validate by kubeconform even without network access. Signed-off-by: Ilya Drey <ilya.drey@flant.com>
…rf#7752) ## Summary Agents verifying a change in this repo prove conditions from shell output — a match count, or a command "succeeding". Both can report success while being structurally incapable of reporting failure: a mis-typed `grep -c` pattern yields the same `0` as a genuinely absent condition, and `… | grep x || echo clean` always prints `clean` because a pipeline returns only its last command's status. `AGENTS.md` now forbids citing such a check until a failing case has been shown to look different from a passing one. ## What - The delta in what an agent produces: a count- or status-based verification is now accompanied by a control proving the check *can* fail, or restructured so failure is visible (`if` / `$?` instead of `|| echo`). Neither a bare count nor a bare "the command succeeded" is acceptable as evidence. - VERIFIED: the rule's own text is checked the way it prescribes — `^- NEVER` returns 15 hits as a known-positive control, `^- NEVER cite a count` returns 1, and the superseded wording returns 0. - No `task` target, `.golangci.yml` rule or CI check is added: the rule governs commands an agent composes in a shell at runtime, which leave no artifact for a check to read. - The `NEVER trust LSP/gopls diagnostics … as proof of build failure` rule directly above is unchanged; the new line joins it as the same class of rule. ## Why Three incidents, two mechanisms. First: patch-equivalent commits counted with `git range-diff … | grep -c ' = '` returned 0 of 7 and read as a broken rebase. The rebase was correct — git's column spacing differed from what the pattern assumed. Then, within the hour of the first wording landing, its own author broke the rule twice more by a different route: `… | grep -E '<pattern>' || echo none` and `… | grep … | head || echo accepted`. A pipeline reports only its last command's status, so the `||` branch can never run and the reassuring message always prints. One of the two produced a false `rejected` in a push test that was deciding a finding's severity. The first wording named `grep -c`/`wc -l` only and would not have caught either recurrence. Both mechanisms share one shape and one direction of failure: the check does not merely stop working, it reports success. That is worse than having no check, because the result then gets cited as proof. Rejected alternative: a linter or `task` target flagging `grep -c` or `|| echo`. These commands are composed ad hoc in a shell and never committed, so there is no artifact for a check to inspect. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
## Summary `review/SKILL.md` referenced a PR's description only as a source for deriving DoD criteria, so a reviewing agent read it as input and never checked it as an artifact. The skill now states that the description's own claims are subject to review, and why that matters more here than in most repositories. ## What - The delta in what a reviewing agent produces: a finding is now raised when the PR description asserts a property the review disproves, instead of only when code does. Previously such a contradiction went unreported even with findings that directly refuted it. - The bullet lands in `## Gotchas`, alongside the other werf-specific traps; no other section changes and no existing bullet is reworded. - Nothing is added to `pull-request/SKILL.md`: that skill governs *writing* a description and already states the squash-permanence fact. This is the reviewing side, and duplicating the fact would let the two drift. - `.claude/skills` is a symlink to `.agents/skills`, so the change is visible under both paths with no second edit. ## Why A four-round review of a submodule-reuse change produced 17 inline comments. Its description asserted three safety properties the findings contradict — a probe that "cannot itself trigger a fetch" (true only on git >= 2.45, while `pkg/true_git/init.go` admits 2.18), a reuse failure that "costs a slower build rather than a broken one" (untrue for probe failures, which return with no fallback), and that every URL used is "a path werf computed itself" (ambient `url.*.insteadOf` can rewrite it). None of that was noticed until the user asked whether the description was still accurate. Two properties make the omission expensive. werf squashes on merge, so the description becomes the commit body: a wrong safety claim outlives the review in `git log` indefinitely. And inline comments anchor to code lines, so a reader of the description never encounters them — the reviewer can be simultaneously thorough about the code and silent about false claims made on top of it. Rejected alternative: a CI check comparing description claims against the diff. Claims are prose, and deciding whether one contradicts a finding is the review judgment itself, not something a check can make. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
## Summary The three tests covering `include.path` forwarding in `pkg/true_git` were written with testify, while AGENTS.md mandates Ginkgo and Gomega and every other spec in the package already uses them. This converts them and drops the testify-only git helpers they needed. Follow-up to werf#7736, which converted the specs it added and left these behind. ## What - No production code changes: the invariant is that the same three behaviors stay pinned — `getIncludePathOptions` resolving absolute, repository-relative and `~` include paths; `updateSubmodules` forwarding those includes to its git invocations; and `switchWorkTree` on a repository without submodules being unaffected by an ambient include. VERIFIED: mutation-checked, both falsifiable behaviors caught. - `pkg/true_git` no longer uses testify: `helpers_ai_test.go` is deleted and the converted specs use the helpers already in `helpers_test.go`. - The suite reports 102 specs where it reported 99 plus three `go test` functions; nothing is skipped and no assertion is dropped. ## Why Two test styles in one package mean two sets of git helpers doing the same thing and two failure formats to read. The testify tests also ran invisibly under `task test:unit`, which reports Ginkgo specs only, so their result was only ever observable through a failure. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
## Summary Cached content anchors from Git-backed images are now reused even when the source commit recorded by an existing stage is unavailable. Ordinary Git stages retain commit validation because they need history to generate patches. ## What - A cached content anchor with a matching digest is selected without requiring its recorded Git commit to exist. - Non-anchor Git stages continue to reject cached stages whose recorded commits are unavailable. ## Why The terminal Git stage serving as a content anchor inherited ordinary stage selection, which validates the cached stage's recorded commit. A content anchor is content-addressed, so that validation wrongly prevents reuse when the commit is unavailable despite an intact remote stage. Selecting it through the base-stage policy removes the unnecessary Git dependency without weakening patch-stage safety. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
…7739) ## Summary werf records a per-project marker in `--repo` naming the `--meta-repo` that holds the project's metadata, and refuses to run when a later invocation disagrees with it. Previously, dropping `--meta-repo` from one pipeline step silently sent werf to read metadata from `--repo`, where the managed-images set is incomplete — and the next `werf cleanup` deleted images that were still in use. Two new commands, `werf meta-repo migrate` and `werf meta-repo detach`, move existing metadata into a meta-repo and remove the marker. ## What ### Safeguard - A project whose marker names a meta-repo fails every storage-touching command run without `--meta-repo`, with an error naming the recorded address and `werf meta-repo detach` as the way out. This ends the previous silent fallback, so a pipeline that relied on it now fails instead — the behavior being fixed. Only setups already passing `--meta-repo` are affected, and that flag exists solely in unreleased v3, so no released setup changes. - Passing `--meta-repo` to a project whose metadata still sits in `--repo` no longer fails: the new metadata goes to the meta-repo immediately. `migrate` is still what brings the existing records over, and nothing enforces that it ran — a `cleanup` before it decides from an incomplete metadata view, which the docs state. - Passing a `--meta-repo` that disagrees with the marker fails the same way; a `--meta-repo` that canonically resolves to `--repo` is validated too, and gets its own error rather than being told to pass the flag it already passed. - Address comparison is tag-insensitive: `--meta-repo repo:tag` and `--repo repo` compare equal. - The marker is written lazily, on the first real metadata write, so read-only commands never push and pull-only credentials keep working. - `cleanup.disable: true` together with `--meta-repo` now writes neither a cleanup record nor a marker; previously the meta-repo gained a record while `--repo` kept no marker, so a later run without the flag passed validation and silently read `--repo`. - The marker tag is `werf-meta-repo-marker-<project>`, which matches no tag parser in werf v2 or v3, so a v2 running against the same `--repo` ignores it. ### `werf meta-repo migrate` - Takes the source in `--from` and destination in `--to`, moves the `managed-image-*`, `meta-*`, `custom-tag-meta-*` and `cleanup` records, then plants the marker; it copies, verifies the copy, and only then deletes. `--from` also exposes the source registry credential flags (`--from-docker-hub-token`, `--from-quay-token`, …) that the default delete needs on Docker Hub, Harbor and Quay. Every flag is scoped to this command through `WERF_META_REPO_MIGRATE_FROM[_*]` and `WERF_META_REPO_MIGRATE_TO` env vars, so the generic `WERF_FROM`/`WERF_TO` used by another copy command cannot leak in. `--repo` and `--meta-repo` are not accepted by this command. - `--remove-source` defaults to `true` (`$WERF_REMOVE_SOURCE`), so the command moves rather than copies; `--remove-source=false` copies and leaves `--from` intact. - Matches metadata by record shape, not by the `werf` label: a repository holds one project, and records written before werf started labeling them (2021) carry no label. Previously migrate refused outright to delete any unlabeled record, so the default `--remove-source` failed on exactly the long-lived repositories the meta-repo is meant to drain. - Never treats a stage image as a metadata record, so a custom tag alias named like a metadata record (`--add-custom-tag managed-image-release`) is left untouched instead of being copied and deleted — deleting it would have destroyed the stage, because the registry drops the manifest by digest. Multi-platform aliases are covered: an index carries no top-level labels, so it is recognized as a stage by being an index. - The `--meta-repo` record wins for the two families whose content is mutable under a stable tag (`cleanup`, `custom-tag-meta-*`), since that is the copy werf reads; the `--repo` one is skipped with a warning naming the tag and both addresses. Under `--remove-source=false` the records left in `--repo` are frozen after the first migration, so the reverse rule pushed a stale stage ID back over the current one and `cleanup`, which groups aliases by that stage ID, could delete a custom tag pointing at a live stage. - Refuses to run when `--to` is the same repository as `--from`. ### `werf meta-repo detach` - Removes the marker only, and says so: metadata is NOT moved back, and the command is not a reverse migration. - Refuses to delete anything if the marker tag holds a stage image or custom tag alias rather than a marker. - `werf purge` removes the marker as its last step, once every other deletion has succeeded, so a re-created project builds without `--meta-repo` again and never needs `detach` for that. A purge that fails partway leaves the marker in place, keeping metadata still sitting in the meta-repo protected. It is a no-op for the non-registry stages storage `werf host purge` operates on. ### Docs - `docs/_includes/reference/cli/werf_meta_repo*` and `docs/pages_en/reference/cli/werf_meta_repo*` are the generated reference for the new command group, added by `task doc:gen` along with their sidebar and overview entries. - `docs/pages_{en,ru}/usage/build/process.md` is the authority for the safeguard, and states the motivation as tag-count: image-metadata records are written per image, per commit and per stage, and every stage lookup lists the whole tag set of `--repo`. ## Why `--meta-repo` (werf#7637) split metadata into a second repository but left the two repositories with no link between them, so the correct `--meta-repo` value existed only in each pipeline's flags. Nothing detected its absence: `GetOptionalMetaStorage` falls back to the stages storage, so werf read an empty managed-images set from `--repo` and `cleanup` treated every image whose metadata it could not see as unmanaged. The cost is deleted in-use images, discovered only when a deploy pulls a missing tag. The marker is per-project rather than per-repository because werf never enforces one project per repository: a repository-wide marker would let one project's `werf purge` drop the safeguard for every other project in that `--repo`. `detach` is not called `reset`, because `reset` reads as the inverse of `migrate` — metadata moved back — which is exactly the expectation that ends in deleted images. --------- Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
## Summary Merges `origin/main` into `3`, bringing 6 commits that had diverged. One is user-visible: concurrent builds pulling the same base image no longer race under the Buildah backend. The rest are agent-tooling docs (`AGENTS.md`, `.agents/skills`) with no runtime effect. ## What - Under the Buildah backend, concurrent stage builds that pull the same base image are serialized, so parallel builds no longer race on the shared pull (werf#7664). - No other user-visible werf behavior changes; remaining commits edit `AGENTS.md`, `.agents/skills/pull-request`, and CLI-docs generation env handling (werf#7754, werf#7749, werf#7748, werf#7747). - Conflict resolutions are docs-only: `AGENTS.md` keeps branch-3's macOS Docker-backend e2e guidance and adds main's `git diff --check`/`task test:unit` caveats and registry-deletion note; `pull-request/SKILL.md` takes main's rewording but keeps branch-3's dependency-bump lists without `werf/3p-helm` (not a dependency on `3`). ## Why `3` was 6 commits behind `main`; merging keeps the release branches from diverging further. All conflicts were in agent-facing docs edited independently on both branches — resolved by unioning the two sets of guidance, no code conflict. --------- Signed-off-by: Radmir Khurum <radmir.khurum@flant.com> Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com> Co-authored-by: Radmir Khurum <radmir.khurum@flant.com>
🤖 I have created a release *beep* *boop* --- ## [3.1.0](werf/werf@v3.0.2...v3.1.0) (2026-08-05) ### Features * `--no-values-schema-validation`; don't break values.schema.json with service values ([werf#7756](werf#7756)) ([01eeb94](werf@01eeb94)) * add support for additional patches files and disable default patches ([werf#7735](werf#7735)) ([01aa2e5](werf@01aa2e5)) * **build:** add per-project meta-repo safeguard and migration ([werf#7739](werf#7739)) ([4f7de94](werf@4f7de94)) * bump nelm version ([werf#7731](werf#7731)) ([ca44562](werf@ca44562)) * embed kubeconform schemas ([werf#7729](werf#7729)) ([23bcaf1](werf@23bcaf1)) ### Bug Fixes * **build, buildah:** serialize concurrent base image pulls ([werf#7664](werf#7664)) ([6eb9144](werf@6eb9144)) * **build, dockerfile:** allow dockerfile outside the build context ([werf#7722](werf#7722)) ([a5c2011](werf@a5c2011)) * **build, stapel, git:** remove git commit ancestry check on reuse ([werf#7746](werf#7746)) ([544a07d](werf@544a07d)) * **build, stapel:** make service script executable regardless of umask ([werf#7720](werf#7720)) ([8b67264](werf@8b67264)), closes [werf#2339](werf#2339) * **build:** drop empty image digest warnings from the build report ([werf#7717](werf#7717)) ([24babbb](werf@24babbb)), closes [werf#7667](werf#7667) * **build:** reuse content anchors without git commits ([werf#7764](werf#7764)) ([5df466c](werf@5df466c)) * **build:** stop re-fetching submodules the checkout already has ([werf#7736](werf#7736)) ([8ff0bf3](werf@8ff0bf3)) * **build:** validate image names in werf.yaml ([werf#7711](werf#7711)) ([cd993db](werf@cd993db)) * **deploy:** optimize local validation args ([werf#7760](werf#7760)) ([6a4c6c4](werf@6a4c6c4)) * **dev:** self-heal a stale worktree index.lock left by a killed run ([werf#7733](werf#7733)) ([ca0e803](werf@ca0e803)) * **dev:** warm a persistent dev-index so --dev stops re-reading unchanged files ([werf#7732](werf#7732)) ([f0b13cc](werf@f0b13cc)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).
Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com> # Conflicts: # CHANGELOG.md # pkg/cleaning/purge.go # scripts/docs/regen.sh
Release-As: v3.1.0-dk.1 Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
The merge added GetOrphanedArtifactNames and DeleteArtifact to StagesStorage but the upstream meta-repo marker test pins the PrimaryStagesStorage method set. Both read or act on artifact images rather than project metadata, so they belong in markerUnguardedMethods. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>
chore(3): release 3.1.0-dk.1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Align delivery-kit with the current werf v3 release line while retaining the fork-specific SBOM, OCI attestation, image signing, and CI behavior. The branch includes
delivery-kit/mainand the latestwerf/werf:3tip available during the merge.What
Version transition
werf/werf@ea66ed8b9.Delivery-kit capabilities
build.sbomand image-level SBOM configuration continue to generate and validate SBOMs, including Go, Python, Rust, Lua, JavaScript, and OS package inputs.werf sbom getpreserves the complete calculated build options when it needs to build an image.--without-imagesskip SBOM convergence instead of dereferencing an empty image graph.headbinary instead of thecatbinary the v3 stapel toolchain dropped.docker, import-metadata, and import-by-file-checksum paths is preserved in runtime and English/Russian template documentation; delivery-kit features use the v3 graph and import-by-source-image-tag model.Why
Delivery-kit had continued on the v2 architecture while werf v3 removed legacy build and storage paths and changed the stage graph, digest, deployment, and validation APIs. A direct merge left fork features connected to removed APIs; porting the integration points preserves delivery-kit behavior without restoring the v2 architecture or dropping current v3 fixes.