feat: propagate --dev-spec to dgoss run, ci publish, ci merge, and CI workflows

.github/workflows/bakery-build-native.yml

@@ -140,25 +140,17 @@ jobs:
         with:
           version: ${{ inputs.version }}
 
-      - name: Images by Version/Platform
-        id: images-by-platform
+      - name: Resolve dev-spec
+        id: resolve-dev-spec
         env:
-          DEV_VERSIONS: ${{ inputs.dev-versions }}
-          MATRIX_VERSIONS: ${{ inputs.matrix-versions }}
-          IMAGE_NAME_FILTER: ${{ inputs.image-name }}
-          IMAGE_VERSION: ${{ inputs.image-version }}
-          DEV_CHANNEL: ${{ inputs.dev-channel || inputs.dev-stream }}
-          DEV_VERSION: ${{ inputs.dev-version }}
           DEV_SPEC: ${{ inputs.dev-spec }}
+          DEV_VERSION: ${{ inputs.dev-version }}
+          DEV_CHANNEL: ${{ inputs.dev-channel || inputs.dev-stream }}
           RELEASE_BRANCH: ${{ inputs.release-branch }}
-          CONTEXT: ${{ inputs.context }}
         run: |
-          IMAGE_VERSION="${IMAGE_VERSION#v}"
-          ARGS=(--quiet --dev-versions "$DEV_VERSIONS" --matrix-versions "$MATRIX_VERSIONS" --context "$CONTEXT")
-          [[ -n "$IMAGE_VERSION" ]] && ARGS+=(--image-version "$IMAGE_VERSION")
-          [[ -n "$IMAGE_NAME_FILTER" ]] && ARGS+=(-- "$IMAGE_NAME_FILTER")
           if [[ -n "$DEV_SPEC" ]]; then
-            ARGS+=(--dev-spec "$DEV_SPEC")
+            DEV_SPEC_COMPACT=$(echo "$DEV_SPEC" | jq -c .)
+            echo "dev-spec=$DEV_SPEC_COMPACT" >> "$GITHUB_OUTPUT"
           elif [[ -n "$DEV_VERSION" || -n "$RELEASE_BRANCH" ]]; then
             DEV_SPEC_JSON=$(jq -cn \
               --arg v "$DEV_VERSION" \
@@ -167,10 +159,31 @@ jobs:
               'if $v != "" then {version: $v} else {} end
                + if $c != "" then {channel: $c} else {} end
                + if $b != "" then {release_branch: $b} else {} end')
-            ARGS+=(--dev-spec "$DEV_SPEC_JSON")
+            echo "dev-spec=$DEV_SPEC_JSON" >> "$GITHUB_OUTPUT"
+          else
+            echo "dev-spec=" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Images by Version/Platform
+        id: images-by-platform
+        env:
+          DEV_VERSIONS: ${{ inputs.dev-versions }}
+          MATRIX_VERSIONS: ${{ inputs.matrix-versions }}
+          IMAGE_NAME_FILTER: ${{ inputs.image-name }}
+          IMAGE_VERSION: ${{ inputs.image-version }}
+          DEV_CHANNEL: ${{ inputs.dev-channel || inputs.dev-stream }}
+          DEV_SPEC_RESOLVED: ${{ steps.resolve-dev-spec.outputs.dev-spec }}
+          CONTEXT: ${{ inputs.context }}
+        run: |
+          IMAGE_VERSION="${IMAGE_VERSION#v}"
+          ARGS=(--quiet --dev-versions "$DEV_VERSIONS" --matrix-versions "$MATRIX_VERSIONS" --context "$CONTEXT")
+          [[ -n "$IMAGE_VERSION" ]] && ARGS+=(--image-version "$IMAGE_VERSION")
+          if [[ -n "$DEV_SPEC_RESOLVED" ]]; then
+            ARGS+=(--dev-spec "$DEV_SPEC_RESOLVED")
           elif [[ -n "$DEV_CHANNEL" ]]; then
             ARGS+=(--dev-channel "$DEV_CHANNEL")
           fi
+          [[ -n "$IMAGE_NAME_FILTER" ]] && ARGS+=(-- "$IMAGE_NAME_FILTER")
           result=$(bakery ci matrix "${ARGS[@]}")
           echo "platform_matrix=$(echo "$result" | jq --compact-output .)" >> "$GITHUB_OUTPUT"
           echo "image_matrix=$(echo "$result" | jq --compact-output '[.[].image] | unique')" >> "$GITHUB_OUTPUT"
@@ -258,6 +271,29 @@ jobs:
         run: |
           PLATFORM=${BUILD_PLATFORM#linux/}
           echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
+      - name: Resolve dev-spec
+        id: resolve-dev-spec
+        env:
+          DEV_SPEC: ${{ inputs.dev-spec }}
+          DEV_VERSION: ${{ inputs.dev-version }}
+          DEV_CHANNEL: ${{ inputs.dev-channel || inputs.dev-stream }}
+          RELEASE_BRANCH: ${{ inputs.release-branch }}
+        run: |
+          if [[ -n "$DEV_SPEC" ]]; then
+            DEV_SPEC_COMPACT=$(echo "$DEV_SPEC" | jq -c .)
+            echo "dev-spec=$DEV_SPEC_COMPACT" >> "$GITHUB_OUTPUT"
+          elif [[ -n "$DEV_VERSION" || -n "$RELEASE_BRANCH" ]]; then
+            DEV_SPEC_JSON=$(jq -cn \
+              --arg v "$DEV_VERSION" \
+              --arg c "$DEV_CHANNEL" \
+              --arg b "$RELEASE_BRANCH" \
+              'if $v != "" then {version: $v} else {} end
+               + if $c != "" then {channel: $c} else {} end
+               + if $b != "" then {release_branch: $b} else {} end')
+            echo "dev-spec=$DEV_SPEC_JSON" >> "$GITHUB_OUTPUT"
+          else
+            echo "dev-spec=" >> "$GITHUB_OUTPUT"
+          fi
       - name: Build
         env:
           GIT_SHA: ${{ github.sha }}
@@ -267,10 +303,7 @@ jobs:
           IMAGE_PLATFORM: ${{ matrix.img.platform }}
           DEV_VERSIONS: ${{ inputs.dev-versions }}
           MATRIX_VERSIONS: ${{ inputs.matrix-versions }}
-          DEV_CHANNEL: ${{ inputs.dev-channel || inputs.dev-stream }}
-          DEV_VERSION: ${{ inputs.dev-version }}
-          DEV_SPEC: ${{ inputs.dev-spec }}
-          RELEASE_BRANCH: ${{ inputs.release-branch }}
+          DEV_SPEC_RESOLVED: ${{ steps.resolve-dev-spec.outputs.dev-spec }}
           REGISTRY: ghcr.io/${{ github.repository_owner }}
           NORMALIZED_PLATFORM: ${{ steps.normalize-platform.outputs.platform }}
           CONTEXT: ${{ inputs.context }}
@@ -283,18 +316,7 @@ jobs:
             CACHE_FLAGS=(--cache-registry "$REGISTRY")
           fi
           DEV_SPEC_FLAGS=()
-          if [[ -n "$DEV_SPEC" ]]; then
-            DEV_SPEC_FLAGS+=(--dev-spec "$DEV_SPEC")
-          elif [[ -n "$DEV_VERSION" || -n "$RELEASE_BRANCH" ]]; then
-            DEV_SPEC_JSON=$(jq -cn \
-              --arg v "$DEV_VERSION" \
-              --arg c "$DEV_CHANNEL" \
-              --arg b "$RELEASE_BRANCH" \
-              'if $v != "" then {version: $v} else {} end
-               + if $c != "" then {channel: $c} else {} end
-               + if $b != "" then {release_branch: $b} else {} end')
-            DEV_SPEC_FLAGS+=(--dev-spec "$DEV_SPEC_JSON")
-          fi
+          [[ -n "$DEV_SPEC_RESOLVED" ]] && DEV_SPEC_FLAGS=(--dev-spec "$DEV_SPEC_RESOLVED")
           bakery build \
             --strategy build --pull \
             --retry "$RETRY" \
@@ -316,10 +338,13 @@ jobs:
           IMAGE_PLATFORM: ${{ matrix.img.platform }}
           DEV_VERSIONS: ${{ inputs.dev-versions }}
           MATRIX_VERSIONS: ${{ inputs.matrix-versions }}
+          DEV_SPEC_RESOLVED: ${{ steps.resolve-dev-spec.outputs.dev-spec }}
           NORMALIZED_PLATFORM: ${{ steps.normalize-platform.outputs.platform }}
           CONTEXT: ${{ inputs.context }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          DEV_SPEC_FLAGS=()
+          [[ -n "$DEV_SPEC_RESOLVED" ]] && DEV_SPEC_FLAGS=(--dev-spec "$DEV_SPEC_RESOLVED")
           GOSS_PATH=${GITHUB_WORKSPACE}/tools/goss \
           DGOSS_PATH=${GITHUB_WORKSPACE}/tools/dgoss \
           bakery dgoss run \
@@ -328,6 +353,7 @@ jobs:
             --image-platform "$IMAGE_PLATFORM" \
             --dev-versions "$DEV_VERSIONS" \
             --matrix-versions "$MATRIX_VERSIONS" \
+            "${DEV_SPEC_FLAGS[@]}" \
             --metadata-file "./${IMAGE_NAME}-${IMAGE_VERSION}-${NORMALIZED_PLATFORM}-metadata.json" \
             --context "$CONTEXT"
       - name: Upload Metadata
@@ -424,19 +450,47 @@ jobs:
         run: |
           ls -ltra .
 
+      - name: Resolve dev-spec
+        id: resolve-dev-spec
+        env:
+          DEV_SPEC: ${{ inputs.dev-spec }}
+          DEV_VERSION: ${{ inputs.dev-version }}
+          DEV_CHANNEL: ${{ inputs.dev-channel || inputs.dev-stream }}
+          RELEASE_BRANCH: ${{ inputs.release-branch }}
+        run: |
+          if [[ -n "$DEV_SPEC" ]]; then
+            DEV_SPEC_COMPACT=$(echo "$DEV_SPEC" | jq -c .)
+            echo "dev-spec=$DEV_SPEC_COMPACT" >> "$GITHUB_OUTPUT"
+          elif [[ -n "$DEV_VERSION" || -n "$RELEASE_BRANCH" ]]; then
+            DEV_SPEC_JSON=$(jq -cn \
+              --arg v "$DEV_VERSION" \
+              --arg c "$DEV_CHANNEL" \
+              --arg b "$RELEASE_BRANCH" \
+              'if $v != "" then {version: $v} else {} end
+               + if $c != "" then {channel: $c} else {} end
+               + if $b != "" then {release_branch: $b} else {} end')
+            echo "dev-spec=$DEV_SPEC_JSON" >> "$GITHUB_OUTPUT"
+          else
+            echo "dev-spec=" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Publish
         env:
           GIT_SHA: ${{ github.sha }}
           CONTEXT: ${{ inputs.context }}
           REGISTRY: ghcr.io/${{ github.repository_owner }}
           PUSH: ${{ inputs.push }}
           IMAGE_NAME: ${{ matrix.image }}
+          DEV_SPEC_RESOLVED: ${{ steps.resolve-dev-spec.outputs.dev-spec }}
         run: |
           if [ "$PUSH" = "true" ]; then PUSH_FLAG=""; else PUSH_FLAG="--dry-run"; fi
+          DEV_SPEC_FLAGS=()
+          [[ -n "$DEV_SPEC_RESOLVED" ]] && DEV_SPEC_FLAGS=(--dev-spec "$DEV_SPEC_RESOLVED")
           bakery ci publish \
             --context "$CONTEXT" \
             --image-name "^${IMAGE_NAME}$" \
             --temp-registry "$REGISTRY" \
+            "${DEV_SPEC_FLAGS[@]}" \
             $PUSH_FLAG \
             ./*-metadata.json
 

.github/workflows/bakery-build.yml

@@ -131,6 +131,24 @@ jobs:
         with:
           version: ${{ inputs.version }}
 
+      - name: Resolve dev-spec
+        id: resolve-dev-spec
+        env:
+          DEV_SPEC: ${{ inputs.dev-spec }}
+          DEV_VERSION: ${{ inputs.dev-version }}
+          DEV_CHANNEL: ${{ inputs.dev-channel || inputs.dev-stream }}
+        run: |
+          if [[ -n "$DEV_SPEC" ]]; then
+            DEV_SPEC_COMPACT=$(echo "$DEV_SPEC" | jq -c .)
+            echo "dev-spec=$DEV_SPEC_COMPACT" >> "$GITHUB_OUTPUT"
+          elif [[ -n "$DEV_VERSION" ]]; then
+            DEV_SPEC_JSON=$(jq -cn --arg v "$DEV_VERSION" --arg c "$DEV_CHANNEL" \
+              '{version: $v} + if $c != "" then {channel: $c} else {} end')
+            echo "dev-spec=$DEV_SPEC_JSON" >> "$GITHUB_OUTPUT"
+          else
+            echo "dev-spec=" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Images
         id: images
         env:
@@ -139,23 +157,18 @@ jobs:
           IMAGE_NAME_FILTER: ${{ inputs.image-name }}
           IMAGE_VERSION: ${{ inputs.image-version }}
           DEV_CHANNEL: ${{ inputs.dev-channel || inputs.dev-stream }}
-          DEV_VERSION: ${{ inputs.dev-version }}
-          DEV_SPEC: ${{ inputs.dev-spec }}
+          DEV_SPEC_RESOLVED: ${{ steps.resolve-dev-spec.outputs.dev-spec }}
           CONTEXT: ${{ inputs.context }}
         run: |
           IMAGE_VERSION="${IMAGE_VERSION#v}"
           ARGS=(--quiet --dev-versions "$DEV_VERSIONS" --matrix-versions "$MATRIX_VERSIONS" --context "$CONTEXT")
           [[ -n "$IMAGE_VERSION" ]] && ARGS+=(--image-version "$IMAGE_VERSION")
-          [[ -n "$IMAGE_NAME_FILTER" ]] && ARGS+=(-- "$IMAGE_NAME_FILTER")
-          if [[ -n "$DEV_SPEC" ]]; then
-            ARGS+=(--dev-spec "$DEV_SPEC")
-          elif [[ -n "$DEV_VERSION" ]]; then
-            DEV_SPEC_JSON=$(jq -cn --arg v "$DEV_VERSION" --arg c "$DEV_CHANNEL" \
-              '{version: $v} + if $c != "" then {channel: $c} else {} end')
-            ARGS+=(--dev-spec "$DEV_SPEC_JSON")
+          if [[ -n "$DEV_SPEC_RESOLVED" ]]; then
+            ARGS+=(--dev-spec "$DEV_SPEC_RESOLVED")
           elif [[ -n "$DEV_CHANNEL" ]]; then
             ARGS+=(--dev-channel "$DEV_CHANNEL")
           fi
+          [[ -n "$IMAGE_NAME_FILTER" ]] && ARGS+=(-- "$IMAGE_NAME_FILTER")
           result=$(bakery ci matrix "${ARGS[@]}")
           echo "matrix=$(echo "$result" | jq --compact-output .)" >> "$GITHUB_OUTPUT"
 
@@ -226,6 +239,24 @@ jobs:
       - name: Setup docker buildx
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0
 
+      - name: Resolve dev-spec
+        id: resolve-dev-spec
+        env:
+          DEV_SPEC: ${{ inputs.dev-spec }}
+          DEV_VERSION: ${{ inputs.dev-version }}
+          DEV_CHANNEL: ${{ inputs.dev-channel || inputs.dev-stream }}
+        run: |
+          if [[ -n "$DEV_SPEC" ]]; then
+            DEV_SPEC_COMPACT=$(echo "$DEV_SPEC" | jq -c .)
+            echo "dev-spec=$DEV_SPEC_COMPACT" >> "$GITHUB_OUTPUT"
+          elif [[ -n "$DEV_VERSION" ]]; then
+            DEV_SPEC_JSON=$(jq -cn --arg v "$DEV_VERSION" --arg c "$DEV_CHANNEL" \
+              '{version: $v} + if $c != "" then {channel: $c} else {} end')
+            echo "dev-spec=$DEV_SPEC_JSON" >> "$GITHUB_OUTPUT"
+          else
+            echo "dev-spec=" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Build
         env:
           GIT_SHA: ${{ github.sha }}
@@ -234,9 +265,7 @@ jobs:
           IMAGE_VERSION: ${{ matrix.img.version }}
           DEV_VERSIONS: ${{ inputs.dev-versions }}
           MATRIX_VERSIONS: ${{ inputs.matrix-versions }}
-          DEV_CHANNEL: ${{ inputs.dev-channel || inputs.dev-stream }}
-          DEV_VERSION: ${{ inputs.dev-version }}
-          DEV_SPEC: ${{ inputs.dev-spec }}
+          DEV_SPEC_RESOLVED: ${{ steps.resolve-dev-spec.outputs.dev-spec }}
           REGISTRY: ghcr.io/${{ github.repository_owner }}
           CONTEXT: ${{ inputs.context }}
           CACHE: ${{ inputs.cache }}
@@ -247,13 +276,7 @@ jobs:
             CACHE_FLAGS=(--cache-registry "$REGISTRY")
           fi
           DEV_SPEC_FLAGS=()
-          if [[ -n "$DEV_SPEC" ]]; then
-            DEV_SPEC_FLAGS+=(--dev-spec "$DEV_SPEC")
-          elif [[ -n "$DEV_VERSION" ]]; then
-            DEV_SPEC_JSON=$(jq -cn --arg v "$DEV_VERSION" --arg c "$DEV_CHANNEL" \
-              '{version: $v} + if $c != "" then {channel: $c} else {} end')
-            DEV_SPEC_FLAGS+=(--dev-spec "$DEV_SPEC_JSON")
-          fi
+          [[ -n "$DEV_SPEC_RESOLVED" ]] && DEV_SPEC_FLAGS=(--dev-spec "$DEV_SPEC_RESOLVED")
           bakery build --load --pull \
             --retry "$RETRY" \
             --image-name "^${IMAGE_NAME}$" \
@@ -270,16 +293,20 @@ jobs:
           IMAGE_VERSION: ${{ matrix.img.version }}
           DEV_VERSIONS: ${{ inputs.dev-versions }}
           MATRIX_VERSIONS: ${{ inputs.matrix-versions }}
+          DEV_SPEC_RESOLVED: ${{ steps.resolve-dev-spec.outputs.dev-spec }}
           CONTEXT: ${{ inputs.context }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          DEV_SPEC_FLAGS=()
+          [[ -n "$DEV_SPEC_RESOLVED" ]] && DEV_SPEC_FLAGS=(--dev-spec "$DEV_SPEC_RESOLVED")
           GOSS_PATH=${GITHUB_WORKSPACE}/tools/goss \
           DGOSS_PATH=${GITHUB_WORKSPACE}/tools/dgoss \
           bakery dgoss run \
             --image-name "^${IMAGE_NAME}$" \
             --image-version "$IMAGE_VERSION" \
             --dev-versions "$DEV_VERSIONS" \
             --matrix-versions "$MATRIX_VERSIONS" \
+            "${DEV_SPEC_FLAGS[@]}" \
             --context "$CONTEXT"
 
       - name: Push
@@ -294,20 +321,12 @@ jobs:
           IMAGE_VERSION: ${{ matrix.img.version }}
           DEV_VERSIONS: ${{ inputs.dev-versions }}
           MATRIX_VERSIONS: ${{ inputs.matrix-versions }}
-          DEV_CHANNEL: ${{ inputs.dev-channel || inputs.dev-stream }}
-          DEV_VERSION: ${{ inputs.dev-version }}
-          DEV_SPEC: ${{ inputs.dev-spec }}
+          DEV_SPEC_RESOLVED: ${{ steps.resolve-dev-spec.outputs.dev-spec }}
           CONTEXT: ${{ inputs.context }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           DEV_SPEC_FLAGS=()
-          if [[ -n "$DEV_SPEC" ]]; then
-            DEV_SPEC_FLAGS+=(--dev-spec "$DEV_SPEC")
-          elif [[ -n "$DEV_VERSION" ]]; then
-            DEV_SPEC_JSON=$(jq -cn --arg v "$DEV_VERSION" --arg c "$DEV_CHANNEL" \
-              '{version: $v} + if $c != "" then {channel: $c} else {} end')
-            DEV_SPEC_FLAGS+=(--dev-spec "$DEV_SPEC_JSON")
-          fi
+          [[ -n "$DEV_SPEC_RESOLVED" ]] && DEV_SPEC_FLAGS=(--dev-spec "$DEV_SPEC_RESOLVED")
           bakery build --push --pull \
             --retry "$RETRY" \
             --image-name "^${IMAGE_NAME}$" \

posit-bakery/posit_bakery/cli/ci.py

@@ -217,6 +217,16 @@ def merge(
             rich_help_panel=RichHelpPanelEnum.FILTERS,
         ),
     ] = None,
+    dev_spec: Annotated[
+        str | None,
+        typer.Option(
+            "--dev-spec",
+            envvar="BAKERY_DEV_SPEC",
+            help='JSON spec for a dispatched dev build. Ex: \'{"version": "2026.05.0-dev+185-gSHA", "channel": "daily"}\'',
+            rich_help_panel=RichHelpPanelEnum.FILTERS,
+            callback=parse_dev_spec,
+        ),
+    ] = None,
 ):
     """Alias for `bakery ci publish`.
 
@@ -234,6 +244,7 @@ def merge(
         temp_registry=temp_registry,
         dry_run=dry_run,
         dev_channel=dev_channel,
+        dev_spec=dev_spec,  # type: ignore[arg-type]  # typer requires str annotation; parse_dev_spec callback delivers DevBuildSpec at runtime
     )
 
 
@@ -275,6 +286,16 @@ def publish(
             rich_help_panel=RichHelpPanelEnum.FILTERS,
         ),
     ] = None,
+    dev_spec: Annotated[
+        str | None,
+        typer.Option(
+            "--dev-spec",
+            envvar="BAKERY_DEV_SPEC",
+            help='JSON spec for a dispatched dev build. Ex: \'{"version": "2026.05.0-dev+185-gSHA", "channel": "daily"}\'',
+            rich_help_panel=RichHelpPanelEnum.FILTERS,
+            callback=parse_dev_spec,
+        ),
+    ] = None,
 ) -> None:
     """Publish multi-platform images by composing oras index-create →
     soci-convert → oras index-copy.
@@ -310,6 +331,7 @@ def publish(
         filter=BakeryConfigFilter(image_name=image_name),
         dev_versions=DevVersionInclusionEnum.INCLUDE,
         dev_channel=dev_channel,
+        dev_spec=dev_spec,  # type: ignore[arg-type]  # typer requires str annotation; parse_dev_spec callback delivers DevBuildSpec at runtime
         matrix_versions=MatrixVersionInclusionEnum.INCLUDE,
         clean_temporary=False,
         temp_registry=temp_registry,