platform-ci/runtime/catalog.yaml

# Operator-owned runtime catalog: which runtime runs each toolchain version on each platform.
# Repositories only name a toolchain version, a platform and optional runtime profiles in .ci.yaml; they never choose an
# image or a runner. The catalog is read from the pinned platform revision, so changing it is a reviewed change to that revision.
#
# toolchains.<name>.<quoted version> has these fields:
#   image_image    optional. The same, for a component that declares `images` (profile `image`): ONE image holding the native tool, BuildKit and Trivy.
#                  Absent or null means unqualified. It also serves `image` with `docker` (docker adds only the job's daemon mount).
#   image_browser_image  optional. The same, for a component needing `image` AND `browser`: one image with a browser, BuildKit and Trivy.
#                  Absent or null means unqualified; a combination is never reduced to one of its parts.
#   image          required. Linux container image for the standard runtime, on the shared workflow's linux-small pool.
#                    null                                   listed, not yet qualified: prepare fails and says so
#                    <repository>[:<tag>]@sha256:<digest>   the published image, built on the platform control image
#   browser_image  optional. The same, for a component that requires the browser profile. Absent or null means unqualified.
#   emulator_image optional. The same, for a `script` component on the android toolchain that requires the `emulator` profile (SDK command-line tools, emulator, adb).
#                  Absent or null means unqualified.
#   hosts          optional list of host platforms (windows-amd64, macos-arm64) whose runner, recorded under runners below,
#                  has this toolchain version installed. Listing a platform is an operator attestation: the pipeline does not
#                  probe the host. A host platform that is not listed is unqualified.
# A reference without @sha256:<64 hex digits> is rejected. Do not record a digest that was not published and tested.
# A version that is not listed is unsupported. Add a version by adding an entry, never by changing code.
#
# runners.<platform>.<profile> records runner labels.
#   Host platforms use profile `standard`; null means no label is qualified, so no job can be placed.
#   linux-amd64 may list the browser, docker and browser+docker profile pools. A label runs those components in the workflow's
#   separate pool job (container options, workspace bind, test-daemon socket) on that pool; unlisted or null keeps the profile
#   blocked. The existing generic pool is container-build, the same label for every owner (both organizations have online runners
#   with it). Root authorized recording it for the next DRAFT qualification only: the pool jobs' mounts, options and isolation are
#   NOT yet proven live, so this is not a production activation. A catalog without these labels (or with null) keeps the profiles blocked.
#
# Recorded from root's publication receipts (runtime-qualification/expanded/*-publication.json), each scanned with zero
# HIGH/CRITICAL findings and secrets and read back from the registry: java 17, the java 21 browser image, android 2026.10.1 and the
# container (BuildKit) tools. A recorded digest is publication, not qualification: the profile pools below are recorded for draft
# qualification only and are not proven live, and the BuildKit image has not been shown to run `buildctl` on the standard pool.
# source-tools "1": the source-checks image (actionlint, ShellCheck, make/Bats, kubectl, PyYAML) for the `source-tools` build tool only; the
# basic `source` tool keeps the Node image. Recorded from root's publication receipt (runtime-qualification/expanded/source-tools-publication.json:
# published, activated false, 0 HIGH/CRITICAL, 0 secrets, object readback). It runs on the standard pool; no new runner profile.
# Remaining runtime qualification (everything below that is null or unlisted), in the order a first migration needs it:
#   go "1", rust "1", python "3.11".."3.14": built images have scan findings or are not published, so no digest is recorded and
#       prepare blocks them. Record a digest only after a clean scan and a published, read-back image.
#   control "1": the already published control image (the one the workflow's prepare and report jobs use), recorded now that the
#       operators authorized the script tool.
#   node "20.20.2", "24.22.2" and nix "2.35.4": built and scanned clean from exact layouts, as the captured CI requires (the original
#       Node matrix, qqq-print-protocol, the nix profile), and recorded from root's publication receipts.
#   node "18.20.8": built, three findings remain (pacote and sigstore bundled in npm 10.9.10, fixed only in majors that need Node
#       20.17+); left unlisted until the operators accept or replace it.
#   node browser_image: the project pins its own Playwright and pnpm, which no captured file records, so browser binaries cannot be
#       baked; a catalog field for a browser layer is a design decision.
#   dotnet "10.0.403", xcode "27": attest the host runner (hosts) after confirming the SDK or Xcode version it has installed.
#   runners.windows-amd64.standard: the legacy setup used one label per organization (kof-windows-vm6218 and
#       qqq-windows-amd64), which one shared catalog cannot name. Provision one shared label, or decide the mapping, then record it.
#   runners.linux-amd64 browser, docker and browser+docker pools: recorded below for draft qualification; production activation waits for root's live proof.
schema: 1
runners:
  linux-amd64:
    browser: container-build
    docker: container-build
    browser+docker: container-build
    # The `image` profile pool: verification and image packaging in ONE job on the existing generic container-build pool, whose hosts provide
    # rootless BuildKit through an administrator-injected mount (no Docker daemon or socket). The operators authorized this label for DRAFT
    # qualification of the image profile only; the captured image-boundary.sh runs before any repository code and a live fixture must prove it.
    image: container-build
    # Combinations with `image`, written in sorted order as `requires` is normalized. `docker+image` is the same image on the same generic pool: the docker
    # profile only adds the docker job's test-daemon mount and variables, so it needs no image of its own; this label is derived from the two authorized
    # ones above and is as unproven live as they are. The combinations with `browser` need an image holding a browser, BuildKit and Trivy, which no
    # published image does (see `image_browser_image` below), so their pools are explicitly unqualified (null) rather than guessed.
    docker+image: container-build
    browser+image: null
    browser+docker+image: null
    # `emulator` (Android emulator on the profile pool job with the KVM device) has NO entry here: absent means unqualified, exactly as null does. It stays unrecorded
    # until the operators provide a pool whose runners can pass /dev/kvm to the job container and have granted the access on the host; this repository grants neither.
  windows-amd64:
    standard: null
  macos-arm64:
    standard: kof-macos-arm64
toolchains:
  java:
    "17":
      image: git.kof22.com/koftwentytwo/platform-ci-java17@sha256:5c4216201a5aa3307210cfaafa70c31d6886918b434d96cc1359206d60d4fc5d
    "21":
      image: git.kof22.com/koftwentytwo/platform-ci-maven@sha256:ba53ea466734baf0ae1caec688a8f0c351cf5522d42834f83049aa0598325d8d
      browser_image: git.kof22.com/koftwentytwo/platform-ci-browser@sha256:4db3676ef7ecf307913d4869510ae5aff79e6a5f372c3fd01bcd53d170d92688
      # The published container image carries Maven, JDK 21, BuildKit and Trivy (runtime-expansion/toolchains.Dockerfile), so it can verify
      # and package in one job. Listing it is an operator attestation, not a probe.
      image_image: git.kof22.com/koftwentytwo/platform-ci-container@sha256:3e34f9c4247853c823dc842c907cdc24126d3423a1c9c79ef06855fcdb0a37ba
      # The browser image (Chrome) and the container image (BuildKit, Trivy) are separate published images; none has both. A component that needs
      # `image` and `browser` together is therefore unqualified, and blocked by name, until one image with all three is published and listed here.
      image_browser_image: null
  node:
    "20.20.2":
      image: git.kof22.com/koftwentytwo/platform-ci-node20@sha256:b4fd7631aa928131e148676cc430601759a04128bd0bb32ab9b0fb168c75dba8
      image_image: git.kof22.com/koftwentytwo/platform-ci-node20-image@sha256:be902122c0672e0a4de07e2b4cc7ad799111a01f05f3fb4aa177d12d1820f95a
    "22.20.0":
      image: git.kof22.com/koftwentytwo/platform-ci-node@sha256:25e02a9c21414d7790c179e84d0be7a1e29ac600fc263d2aefb3b47e048ab51b
      browser_image: null
      # Exact published Node/npm layout plus the qualified BuildKit and Trivy clients; live packaging qualification is still required.
      image_image: git.kof22.com/koftwentytwo/platform-ci-node22-image@sha256:6ab09351c2b0ca8a32c0dd7428aa5e924c51a6fc73edaa277547bc753833439b
      image_browser_image: null
    "24.22.2":
      image: git.kof22.com/koftwentytwo/platform-ci-node24@sha256:e65137b0943a5658d3d0aab5e07ab58d32f895fae0cea2696ea97b0334fe6bc0
      image_image: git.kof22.com/koftwentytwo/platform-ci-node24-image@sha256:b444145270ccac53967095749d067456c41297ebc3b71e0dcecdc6660d254678
  go:
    "1":
      image: null
      hosts: []
  rust:
    "1":
      image: null
      hosts: []
  python:
    "3.11":
      image: null
    "3.12":
      image: null
    "3.13":
      image: null
    "3.14":
      image: null
  android:
    "2026.10.1":
      image: git.kof22.com/koftwentytwo/platform-ci-android@sha256:76ffae3719a103a9ee76d7a17339baaa3476f031e8e9e5c6953997ddc66fb7a4
      # UNQUALIFIED on purpose: the image above has `adb` but no SDK command-line tools (sdkmanager, avdmanager) and no emulator, and no pool here provides /dev/kvm.
      # A component that declares `requires: [emulator]` is blocked by name until an image that holds them is published and recorded here AND the operators record a
      # pool label for the profile under runners.linux-amd64 (key `emulator`, deliberately absent below, which also means unqualified). Neither is a code change.
      emulator_image: null
  container:
    "0.34.0":
      image: git.kof22.com/koftwentytwo/platform-ci-container@sha256:3e34f9c4247853c823dc842c907cdc24126d3423a1c9c79ef06855fcdb0a37ba
  nix:
    "2.35.4":
      image: git.kof22.com/koftwentytwo/platform-ci-nix@sha256:b8c01315dc2c540b158f811584c33b415ed3a40d6ab6e6ff7aaeec664f753027
  control:
    "1":
      image: git.kof22.com/koftwentytwo/platform-ci-control@sha256:11f8cb328e7fc7aca8e0c39ed979b33cb1db411a59460baae3e0d48281a15e3c
  source-tools:
    "1":
      image: git.kof22.com/koftwentytwo/platform-ci-source-tools@sha256:f50fdd17ff1b4d06a3fe22f089917898c3367fc2be0c10628c32989960542b63
  dotnet:
    "10.0.403":
      image: null
      hosts: []
  xcode:
    "27":
      image: null
      hosts: []