feat: migrate todo note to nc01 github storage

scripts/src/ci/entry.ts

@@ -27,7 +27,7 @@ import { makeRunId, resolveDeployDevManifest, runDevE2E } from "./dev-e2e";
 import { ciHelp, requireRunId } from "./help";
 import { install, installAsync, installStatus } from "./install";
 import { logs } from "./logs";
-import { blockedArtifactResult, blockedReason, boolFlag, ciCleanupFailedPodsOptions, ciCleanupRunsOptions, ciLogsOptions, isHelpArg, numberOption, publishTransportOption, requireDesiredRef, requireFullCommit, requireRepoRelativePath, requireRevision, requireServiceId, resolveCatalogArtifact, stringOption, userServicePublishBoundaryBlock } from "./options";
+import { assertUserServicePublishProducer, blockedArtifactResult, blockedReason, boolFlag, ciCleanupFailedPodsOptions, ciCleanupRunsOptions, ciLogsOptions, isHelpArg, numberOption, publishTransportOption, requireDesiredRef, requireFullCommit, requireRepoRelativePath, requireRevision, requireServiceId, resolveCatalogArtifact, stringOption, userServicePublishBoundaryBlock } from "./options";
 import { backendCoreArtifactSourceHostPath, userServiceArtifactSourceHostPath } from "./pipelinerun";
 import { publishBackendCoreArtifact, publishUserServiceArtifact, run } from "./publish";
 import { ciTarget, ciTargetSourceSummary, providerIdOption } from "./types";
@@ -135,6 +135,7 @@ export async function runCiCommand(config: UniDeskConfig, args: string[]): Promi
     if (artifact.status === "blocked") {
       return blockedArtifactResult(artifact, commit, blockedReason(artifact));
     }
+    assertUserServicePublishProducer(artifact);
     const repoUrl = artifact.source.repo;
     const dockerfile = requireRepoRelativePath(artifact.source.dockerfile, `CI.json.artifacts.${serviceId}.source.dockerfile`);
     const boundaryBlock = userServicePublishBoundaryBlock(config, serviceId, commit, artifact);

scripts/src/ci/help.ts

@@ -117,7 +117,7 @@ export function ciHelp(): Record<string, unknown> {
         tekton: "D601 Tekton PipelineRun through backend-core/provider control plane",
         directDocker: "repo-owned Docker artifact publish without backend-core/database dispatch; no deploy apply, rollout, restart, or active-task mutation",
       },
-      supportedServices: supportedSourceBuildArtifactIds().filter((serviceId) => serviceId !== "backend-core"),
+      supportedServices: supportedSourceBuildArtifactIds("ci publish-user-service"),
       blockedServices: blockedCatalogArtifactIds(),
       registry: "127.0.0.1:5000/unidesk/<service-id>:<commit>",
       outputFields: ["serviceId", "sourceCommit", "sourceRepo", "dockerfile", "imageRef", "tag", "digest", "digestRef"],

scripts/src/ci/options.ts

@@ -280,6 +280,14 @@ export function resolveCatalogArtifact(serviceId: string): CiCatalogArtifact {
   return artifact;
 }
 
+export function assertUserServicePublishProducer(artifact: CiSourceBuildCatalogArtifact): void {
+  if (artifact.producer === "ci publish-user-service") return;
+  if (artifact.producer === "platform-infra pipelines-as-code") {
+    throw new Error(`${artifact.serviceId} is produced by platform-infra pipelines-as-code; use bun scripts/cli.ts platform-infra pipelines-as-code plan --target NC01 --consumer unidesk-host`);
+  }
+  throw new Error(`${artifact.serviceId} is produced by ${artifact.producer}; use the owning producer command`);
+}
+
 export function blockedArtifactResult(artifact: CiUpstreamImageCatalogArtifact | CiSourceBuildCatalogArtifact, commit: string, note: string): Record<string, unknown> {
   const base = {
     ok: false,

scripts/src/ci/publish.ts

@@ -25,7 +25,7 @@ import { runSshCommandCapture } from "../ssh";
 import type { ArtifactSummaryContext, CiOptions, CiPublishBackendCoreOptions, CiPublishUserServiceArtifactOptions, PublishPreflightTransport } from "./types";
 import { artifactSummaryDefaults } from "./artifact-summary";
 import { publishUserServiceArtifactDirectDocker } from "./direct-docker";
-import { blockedArtifactResult, blockedReason, numberOption, publishTransportOption, repoConnectivityProbeUrl, repoNeedsGithubSshIdentity, repoSshUrl, requireFullCommit, requireRepoRelativePath, requireServiceId, resolveCatalogArtifact, stringOption, userServicePublishBoundaryBlock } from "./options";
+import { assertUserServicePublishProducer, blockedArtifactResult, blockedReason, numberOption, publishTransportOption, repoConnectivityProbeUrl, repoNeedsGithubSshIdentity, repoSshUrl, requireFullCommit, requireRepoRelativePath, requireServiceId, resolveCatalogArtifact, stringOption, userServicePublishBoundaryBlock } from "./options";
 import { backendCoreArtifactPipelineRunManifest, backendCoreArtifactSourceHostPath, pipelineRunManifest, userServiceArtifactPipelineRunManifest, userServiceArtifactSourceHostPath } from "./pipelinerun";
 import { pipelineRunWaitSucceeded, readPipelineRunCondition, remoteCreatePipelineRun, waitForPipelineRun } from "./pipelinerun-runtime";
 import { publishPreflightControlChannelOrder, publishPreflightFailedScopes } from "./preflight";
@@ -238,6 +238,7 @@ export async function runCiPublishUserServiceDryRunPreflight(
   if (artifact.status === "blocked") {
     return blockedArtifactResult(artifact, commit, blockedReason(artifact));
   }
+  assertUserServicePublishProducer(artifact);
   const dockerfile = requireRepoRelativePath(artifact.source.dockerfile, `CI.json.artifacts.${serviceId}.source.dockerfile`);
   const boundaryBlock = userServicePublishBoundaryBlock(config, serviceId, commit, artifact);
   if (boundaryBlock !== null) return boundaryBlock;