[simple-agent-manager]

Summary

Adds Scaleway BYOC support and an explicit operational contract with the paired Pulumi provider PR. Provisioning stays in Pulumi. The CLI reads published physical IDs, endpoints, and log selectors from state to report services, monitor deployments, and query logs.

The shared pkg/deployment and pkg/clouds/scaleway/contract packages live in this MIT repository and use only the standard library. The CLI has no compiled dependency on pulumi-defang. Both programs compile in the integration; no runtime plugins are required.

Behavior

• Scaleway Serverless Jobs run CD, Object Storage holds state, and Secret Manager references supply sensitive job environment values. Job definitions and Cockpit tokens are scoped to the stack.
• Version 1 defangDeployment outputs map Compose names to physical resource IDs, endpoints, health-check paths, and runtime log selectors. The CLI queries native container status using those IDs. Managed-service health remains unknown.
• Fresh CLI processes read a completed project summary. A selected or locally active deployment can use partial component outputs. Reads exclude pending deletion/replacement and do not mix deployment attempts.
• Runtime logs use provisioned resource selectors and display Compose names. Follow mode replays startup records when metadata appears after newer CD logs. CD logs work before application state exists.
• Foreground deployment monitoring observes requested service states after CD succeeds. A failed container produces a failed command even when provisioning completed. The final table refreshes observed endpoints only for matching service names and deployment IDs.
• Missing metadata permits legacy project.pb readback; permission, corrupt-state, and unsupported-version errors are preserved. Build-only log requests direct users to Scaleway Cockpit.
• Config naming remains a shared convention because it is needed before provisioning. Existing prefixes and stack paths are preserved.
• Managed inference uses Scaleway's OpenAI-compatible endpoint. Public services require ingress ports; Redis requires REDIS_PASSWORD config.
• Random config generation takes an exported symbol-policy enum; provider selection lives at its command and agent callers.
• Scaleway model and managed-Redis adjustments use the existing provider fixup hook. Shared Compose fixups contain no Scaleway checks; both model syntaxes, overrides, and valid deploy payloads have pipeline tests.

Current paired validation

CLI a58b5665b48d827d168288466aeb6d98fe62cb78 and provider/CD c5d9985fe616d0d008f6bbb5d82ef0103d686de6 passed fresh-stack live validation after both branches merged current main. Both PRs are mergeable. The exact published CD image was defangio/cd-sandbox@sha256:6eb5a16e2dbf149816a3e190a97e9e9f40d78ed9148b0002e28fee21c2e36ee1 (scw-contract-c5d9985).

The rebuilt CLI completed foreground deployment of scwclimain in fr-par, deployment 4pjcifaq22i1. The old checkpoint was confirmed absent before deployment. The app delayed listening for 15 seconds, then returned HTTP 200 on /health/ready. Native API verified startup/liveness thresholds 9/3, interval 5s, timeout 2s, metadata/native endpoint and ID agreement, and the exact CD image. Bare and composite config references resolved correctly; their keys were absent from the native public environment map. Separate CLI processes reported healthy status and retrieved the early startup record.

The first main-merge test at c015a2ac exited 2 on Pulumi's temporary version-zero checkpoint while CD continued. Pulumi CLI 3.268.0 reproduced the exact empty checkpoint against a local backend. Fix a58b5665 treats only an explicit version-zero checkpoint with a nonempty stack and no snapshot/export as metadata unavailable. Missing/null versions, malformed snapshots, and unsupported versions remain errors. Regression tests cover the literal envelope, rejected boundary cases, and monitoring through bootstrap to native readiness. Metadata version 1, its fields, and encoding are unchanged.

The four latest shared files match prerequisite CLI #2302, commit a841bfeb. Provider/CD retain the published module v0.0.0-20261023210045-db3ba0c100d9: its wire definitions and encoder match the latest CLI; the new bootstrap reader behavior is only needed by the consumer. No local workspace replacement is required.

Full CLI and prerequisite race/short suites and lint pass. CLI protobuf regeneration and workflow checks pass. Provider/integration and CD race suites, provider lint, SDK/schema regeneration, and all provider CI checks, including the combined Docker image build, pass. Latest CLI and prerequisite Go, Nix, and CodeQL checks all pass (runs 40027978577 and 40027981304).

Cleanup verified at 2026-10-23T21:45:30.416019+00:00: zero containers, namespaces, private networks, jobs, secrets, Cockpit tokens, and registry namespaces; the state bucket returned 404. The first teardown hit delayed network detach. Exact test-owned native deletion and a second compose down reconciled state and exited 0. CD then logged a nonfatal export error because the stack had been removed.

Earlier validation

The earlier dual-project matrix used CLI 1d69cc8c, provider 5a3784e, and image digest sha256:04afad4e0843de6cf69c5026a012b1cde697daff998ac2387a96cafa59dbf088:

• Same-named services in two projects returned distinct HTTP 200 markers, endpoints, and isolated runtime logs.
• The literal CLI reader selected current-attempt component metadata while the previous completed summary persisted.
• Startup logs replayed after metadata appeared. An invalid image exposed false foreground success after CD completed; the fixed CLI exits nonzero and reports the native failure.
• CLI ee077b1b deployed a top-level model declaration with custom environment names; HTTP checked URL/model and API-key presence without making an inference call.
• Provider bb3be35 and digest sha256:04b24676839b78450a0afe0ce62af1b07a7f5a09d2f7b590a7642023e8dc7f5e passed native startup-probe, endpoint, status, and log checks.

All earlier resources were removed. Network detach also required exact test-owned deletion and state reconciliation in those runs. An earlier Scaleway 1.48.0 reconciliation logged a premature plugin exit despite command exit 0; its cause remains unverified.

Limits and earlier evidence

CLI merge c015a2ac retains main's agent confirmation/setup, Compose model behavior, and workflows alongside Scaleway. The latest bootstrap-reader fix is included in the validated CLI above. This live run covers containers and operational discovery; managed PostgreSQL/Redis metadata and secret propagation have Pulumi mock coverage without provisioning databases.

The original PR recorded HTTP/inference and mastra-extended live tests on 2026-05-11 using rg.fr-par.scw.cloud/defang-cd/cd:sam-20260511d. Those tests predate this contract. The original notes also recorded delegated-DNS permission errors and a private-network cleanup issue; native Scaleway domains are used in this validation.

Error-classification test follow-up

Test-only commits CLI 0f8c754039335392a1fba088cbfc7d22f481fefc and shared contract 095b395689aa39da8ef5184b619fb8065dd9925f tighten expected failures to reject ErrNotFound for ambiguous deployments, future metadata versions, and malformed metadata. A malformed-metadata case and a non-string output skip case were added; existing bootstrap cases cover invalid JSON and unsupported state versions. Controlled mutations returning ErrNotFound for each of the three error paths fail the strengthened assertions. Both full race/short suites and lint pass. All checks pass on both test-only commits. CodeRabbit reviewed shared-contract 095b3956 with no actionable findings. Production files, dependencies, schema, and CD image are unchanged; the live-validated CLI artifact remains a58b5665 above.

Cost-estimation review fix

Commit 42bed432 removes Scaleway from the estimate tool's advertised providers, leaving AWS and GCP. The JSON-schema tag separator also keeps the GCP enum value and description separate. The actual generated tool schema was checked for exactly those providers, a required provider field, and the description. The full race/short suite, lint, and Go/Nix/CodeQL CI pass at this commit. Deployment metadata and Scaleway cloud-operation code are unchanged from the live-validated pair.

Binary size impact

Measured PR head 42bed432 against merged main 1d0e734d, using Go 1.26.10, linux/amd64, CGO disabled, -trimpath, and -ldflags='-s -w -X main.version=size-comparison'. VCS stamping is disabled and version strings are identical.

Measurement	Main	Scaleway PR	Increase
Stripped binary	109,658,274 bytes	109,863,074 bytes	204,800 bytes (200 KiB, 0.19%)
gzip level 9	27,484,314 bytes	27,562,779 bytes	78,465 bytes (76.6 KiB, 0.29%)

Standalone contract #2302 (095b3956) produces a byte-identical CLI binary to main: zero added bytes in this comparison. The full #2105 increase includes all Scaleway CLI support. Compression measures gzip of the binary alone, without archive packaging. Other targets were not measured. Exact inputs and hashes.

Copy check

• I ran every user-facing string this PR adds or changes through the humanizer skill

[simple-agent-manager]

Scaleway log validation update (2026-05-11)

Pushed fixes through c96d540:

• Parse Scaleway Cockpit JSON log payloads and suppress metadata-only entries.
• Query runtime logs by Serverless Container resource labels instead of falling through to CD logs for type ALL.
• Preserve runtime resource_instance as host in log output.
• Tolerate concurrent Cockpit token recreation/delete races.
• Added focused tests for CD query scoping, runtime query labels, JSON payload parsing, metadata suppression, and token delete races.

Validation performed against validation/scaleway/log-smoke with /tmp/defang-scaleway-pr:

• compose up --force --wait-timeout 600 completed successfully for deployment cffdp6qfzqo4 and streamed CD logs during deployment, including Pulumi update lines and the Scaleway endpoint output.
• logs --type CD --limit 80 --since 3m returned the final CD update logs after deployment, including Container app updated, endpoint https://scalewaylogsmokef9df5e7b-app.functions.fnc.fr-par.scw.cloud, and Resources: ~ 2 updated, 6 unchanged.
• logs app --type RUN --limit 12 --since 3m returned runtime stdout/stderr, including defang-log-smoke starting server port=8080, heartbeat lines, and request/access lines.
• logs app --type RUN --follow --since 5s captured a live request generated by curl /follow-check: request path=/follow-check and GET /follow-check HTTP/1.1 200.
• Focused test gate: go test ./pkg/cli/client/byoc/scaleway passes.

Cleanup:

• Ran compose down; Pulumi reported - 8 deleted.
• Deleted Defang-created Cockpit debug/log tokens.
• Verified no leftover matching Scaleway containers, container namespaces, serverless jobs, registry namespaces, private networks, or secrets for this validation stack.

[simple-agent-manager]

Adding concrete log command/output excerpts from the Scaleway validation run.

Deployment-time logs from compose up:

$ defang --provider scaleway --stack logsval --project-name scaleway-log-smoke compose up --force --wait-timeout 600
* Tailing logs for deployment ID cffdp6qfzqo4 ; press Ctrl+C to detach:
* Waiting for services to finish deploying: ["app"]
2026-05-11T18:53:44.622Z defang-cd-logsval Updating (logsval):
2026-05-11T18:53:45.562Z defang-cd-logsval  ~  scaleway:containers:Container app updating (0s) [diff: ~environmentVariables]
2026-05-11T18:54:06.400Z defang-cd-logsval  ~  scaleway:containers:Container app updated (20s) [diff: ~environmentVariables]
2026-05-11T18:54:10.123Z defang-cd-logsval Outputs:
2026-05-11T18:54:10.123Z defang-cd-logsval     endpoints      : {
2026-05-11T18:54:10.123Z defang-cd-logsval         app: "https://scalewaylogsmokef9df5e7b-app.functions.fnc.fr-par.scw.cloud"
2026-05-11T18:54:10.123Z defang-cd-logsval     }
2026-05-11T18:54:10.123Z defang-cd-logsval Resources:
2026-05-11T18:54:10.123Z defang-cd-logsval     ~ 2 updated
2026-05-11T18:54:10.123Z defang-cd-logsval     6 unchanged
* Deployment complete. Waiting for services to be healthy...
SERVICE  DEPLOYMENT    STATE  FQDN                                                 ENDPOINT
app      cffdp6qfzqo4         app.scaleway-log-smoke-logsval.raphaeltm.defang.app  https://app.scaleway-log-smoke-logsval.raphaeltm.defang.app
* Done.

Post-deploy CD logs command:

$ defang --provider scaleway --stack logsval --project-name scaleway-log-smoke logs --type CD --limit 80 --since 3m
2026-05-11T18:53:44.622Z  defang-cd-logsval f9ef08f9-506f-4765-9e85-459ebf61e14e Updating (logsval):
2026-05-11T18:53:45.562Z  defang-cd-logsval f9ef08f9-506f-4765-9e85-459ebf61e14e  ~  scaleway:containers:Container app updating (0s) [diff: ~environmentVariables]
2026-05-11T18:54:06.400Z  defang-cd-logsval f9ef08f9-506f-4765-9e85-459ebf61e14e  ~  scaleway:containers:Container app updated (20s) [diff: ~environmentVariables]
2026-05-11T18:54:10.123Z  defang-cd-logsval f9ef08f9-506f-4765-9e85-459ebf61e14e Resources:
2026-05-11T18:54:10.123Z  defang-cd-logsval f9ef08f9-506f-4765-9e85-459ebf61e14e     ~ 2 updated
2026-05-11T18:54:10.123Z  defang-cd-logsval f9ef08f9-506f-4765-9e85-459ebf61e14e     6 unchanged

Runtime logs command after hitting the endpoint:

$ curl -fsS https://scalewaylogsmokef9df5e7b-app.functions.fnc.fr-par.scw.cloud/post-deploy-final
defang log smoke ok

$ defang --provider scaleway --stack logsval --project-name scaleway-log-smoke logs app --type RUN --limit 12 --since 3m
2026-05-11T18:53:53.856Z  scalewaylogsmokef9df5e7b-app-00002-deployment-68b7b9754f-gxdlp defang-log-smoke 2026-05-11T18:53:53.856587+00:00 starting server port=8080
2026-05-11T18:53:53.857Z  scalewaylogsmokef9df5e7b-app-00002-deployment-68b7b9754f-gxdlp defang-log-smoke 2026-05-11T18:53:53.857572+00:00 heartbeat
2026-05-11T18:53:54.019Z  scalewaylogsmokef9df5e7b-app-00002-deployment-68b7b9754f-gxdlp defang-log-smoke 2026-05-11T18:53:54.018939+00:00 request path=/
2026-05-11T18:53:54.019Z  scalewaylogsmokef9df5e7b-app-00002-deployment-68b7b9754f-gxdlp defang-log-smoke-access 2026-05-11T18:53:54.019267+00:00 "GET / HTTP/1.1" 200 -

Follow mode live request:

$ defang --provider scaleway --stack logsval --project-name scaleway-log-smoke logs app --type RUN --follow --since 5s
$ curl -fsS https://scalewaylogsmokef9df5e7b-app.functions.fnc.fr-par.scw.cloud/follow-check
2026-05-11T18:52:39.917Z  scalewaylogsmokef9df5e7b-app-00001-deployment-558d7b9b67-27fph defang-log-smoke 2026-05-11T18:52:39.917386+00:00 request path=/follow-check
2026-05-11T18:52:39.917Z  scalewaylogsmokef9df5e7b-app-00001-deployment-558d7b9b67-27fph defang-log-smoke-access 2026-05-11T18:52:39.917651+00:00 "GET /follow-check HTTP/1.1" 200 -

Cleanup log excerpt:

$ defang --provider scaleway --stack logsval --project-name scaleway-log-smoke compose down
2026-05-11T18:56:57.507Z defang-cd-logsval Destroying (logsval):
2026-05-11T18:56:58.622Z defang-cd-logsval  -  scaleway:containers:Container app deleting (0s)
2026-05-11T18:56:59.488Z defang-cd-logsval  -  scaleway:containers:Container app deleted (0.87s)
2026-05-11T18:57:10.258Z defang-cd-logsval Resources:
2026-05-11T18:57:10.258Z defang-cd-logsval     - 8 deleted
* Done.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8c1a243b-4456-4543-b86a-b70703bfd710

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[lionello]

@defangdevs resolve conflicts or rebase

[lionello]

What's the binary size impact?

[defangdevs]

Flagging a concrete dependency from the paired Pulumi provider PR (DefangLabs/pulumi-defang#234): the logType == logs.LogTypeBuild stub in buildLogQueries (currently returns "Scaleway build logs are not available through Defang yet; view them in Scaleway Cockpit") will need real wiring, and the shape of that wiring is changing.

Context: the Scaleway build step is moving off Kaniko-in-a-Serverless-Job (live-tested and confirmed broken under the Job's gVisor sandbox — see the #234 comment thread) onto an ephemeral Compute Instance running Docker/BuildKit via cloud-init. I live-tested the logging side of that too:

• The project's auto-provisioned Cockpit logs data source (the one presumably backing today's job_definition_name=... queries) only accepts writes from Scaleway's own managed services — pushing to it directly returned a blind 403 in testing.
• A dedicated "custom"-origin logs data source, created explicitly for this purpose, accepts pushes fine (204) via the standard Loki push API, and what's pushed is queryable back out through the exact same QueryLoki/query_range path this file already uses for CD/runtime logs.

So the practical difference for buildLogQueries: a build-log query won't be a {job_definition_name=...} selector like the CD case, because there's no job definition for an Instance-based build — it'll need a selector against whatever label the new Build resource's cloud-init script tags its pushed lines with (e.g. something keyed by etag/build-id), against a different Cockpit data source URL than cockpitLogsEndpoint (that field currently assumes one logs data source per project; once there are two — the existing managed one plus this new custom one — GetCockpitLogsEndpoint's "return the first type==logs" logic will need to pick the right one explicitly rather than first-match).

I haven't touched code here — wanted to surface the shape of the change before it lands, since logType.Has/buildLogQueries is exactly the place it'll plug in. The provisioned output carrying the build-logs data source ID/selector will come from #234's Build resource once that's implemented; happy to coordinate the exact field name/shape across both PRs once the Instance-based Build resource is further along, rather than guessing it here first.