ChristianPavilonis · Oct 3, 2026 · Oct 3, 2026 · Oct 7, 2026 · Oct 8, 2026 · Oct 8, 2026
diff --git a/.github/workflows/axum-container.yml b/.github/workflows/axum-container.yml
@@ -0,0 +1,178 @@
+name: Axum container preparation
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - .github/workflows/axum-container.yml
+      - Cargo.toml
+      - Cargo.lock
+      - .tool-versions
+      - crates/**
+      - examples/app-demo/**
+      - examples/container-publishing/**
+      - examples/axum-deployment/**
+      - scripts/*axum_container*.sh
+      - scripts/tests/test_axum_container*.py
+      - docs/guide/*axum-containers.md
+      - docs/guide/adapters/axum.md
+  push:
+    branches: [main]
+    paths:
+      - .github/workflows/axum-container.yml
+      - Cargo.toml
+      - Cargo.lock
+      - .tool-versions
+      - crates/**
+      - examples/app-demo/**
+      - examples/container-publishing/**
+      - examples/axum-deployment/**
+      - scripts/*axum_container*.sh
+      - scripts/tests/test_axum_container*.py
+      - docs/guide/*axum-containers.md
+      - docs/guide/adapters/axum.md
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  prepare:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Use the declared Rust toolchain
+        run: |
+          version=$(awk '$1 == "rust" { print $2 }' .tool-versions)
+          rustup toolchain install "$version" --profile minimal
+          echo "RUSTUP_TOOLCHAIN=$version" >> "$GITHUB_ENV"
+      - name: Prepare one application and lockfile
+        run: |
+          ./scripts/prepare_generated_axum_container.sh "$RUNNER_TEMP/fixture"
+          AXUM_PREPARED_CONTEXT="$RUNNER_TEMP/fixture/container-probe" \
+            python3 -m unittest discover -s scripts/tests -p 'test_axum_container*.py' -v
+          tar -C "$RUNNER_TEMP/fixture" -cf "$RUNNER_TEMP/context.tar" container-probe
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: axum-context-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/context.tar
+          if-no-files-found: error
+          retention-days: 7
+
+  native:
+    needs: prepare
+    timeout-minutes: 30
+    # Framework packaging evidence is not application release approval.
+    env:
+      SCAN_POLICY: report-only
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: axum-context-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/context
+          digest-mismatch: error
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+        with:
+          version: v0.37.0
+          use: false
+          driver-opts: image=moby/buildkit:v0.25.1@sha256:79cc6476ab1a3371c9afd8b44e7c55610057c43e18d9b39b68e2b0c2475cc1b6
+      - name: Native image, packaging, scan and OCI identity checks
+        env:
+          ARCH: ${{ matrix.arch }}
+        run: |
+          tar -C "$RUNNER_TEMP/context" -xf "$RUNNER_TEMP/context/context.tar" --no-same-owner
+          ./scripts/test_axum_container_handoff.sh build \
+            "$RUNNER_TEMP/context/container-probe" "$RUNNER_TEMP/accepted" \
+            "linux/$ARCH" "$GITHUB_SHA" "$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: accepted-${{ matrix.arch }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            ${{ runner.temp }}/accepted/image.tar
+            ${{ runner.temp }}/accepted/receipt.json
+            ${{ runner.temp }}/accepted/inputs.json
+            ${{ runner.temp }}/accepted/scan.json
+            ${{ runner.temp }}/accepted/scanner.json
+            ${{ runner.temp }}/accepted/sbom.json
+            ${{ runner.temp }}/accepted/provenance.json
+          if-no-files-found: error
+          retention-days: 7
+      - name: Retain sanitized failure evidence separately
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: failed-${{ matrix.arch }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            ${{ runner.temp }}/accepted/*.log
+            ${{ runner.temp }}/accepted/scan.json
+            ${{ runner.temp }}/accepted/scanner.json
+            ${{ runner.temp }}/accepted/image.json
+            ${{ runner.temp }}/accepted/inputs.json
+            ${{ runner.temp }}/accepted/smoke
+          if-no-files-found: warn
+          retention-days: 7
+
+  handoff:
+    needs: native
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    env:
+      SCAN_POLICY: report-only
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Select exact immutable artifacts from this run and attempt
+        id: artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh api "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/artifacts?per_page=100" > "$RUNNER_TEMP/artifacts.json"
+          ids=$(python3 examples/container-publishing/verify_artifacts.py artifact-ids \
+            "$RUNNER_TEMP/artifacts.json" --run-id "$GITHUB_RUN_ID" --attempt "$GITHUB_RUN_ATTEMPT")
+          echo "ids=$ids" >> "$GITHUB_OUTPUT"
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          artifact-ids: ${{ steps.artifacts.outputs.ids }}
+          path: ${{ runner.temp }}/bundles
+          digest-mismatch: error
+      - name: Import accepted variants in a separate job without rebuilding
+        run: |
+          for arch in amd64 arm64; do
+            ./scripts/test_axum_container_handoff.sh import \
+              "$RUNNER_TEMP/bundles/accepted-$arch-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" \
+              "$RUNNER_TEMP/import-$arch" "linux/$arch" "$GITHUB_SHA" "$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          done
+      - name: Assemble and verify a localhost runtime index without external publication
+        run: |
+          source examples/container-publishing/tools.env
+          registry="axum-index-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          trap 'docker rm -f "$registry" >/dev/null 2>&1 || true' EXIT
+          docker run -d --name "$registry" -p 127.0.0.1::5000 "$REGISTRY_IMAGE"
+          port=$(docker port "$registry" 5000/tcp | awk -F: '{print $NF}')
+          for _ in $(seq 1 30); do curl --fail --silent "http://127.0.0.1:$port/v2/" && break; sleep 1; done
+          ./examples/container-publishing/publish.sh "127.0.0.1:$port/fixture" fixture \
+            "$RUNNER_TEMP/bundles/accepted-amd64-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" \
+            "$RUNNER_TEMP/bundles/accepted-arm64-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" \
+            "$RUNNER_TEMP/index" "$GITHUB_SHA" "$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
diff --git a/.github/workflows/deploy-action.yml b/.github/workflows/deploy-action.yml
@@ -3,6 +3,11 @@ name: Deploy actions
 on:
   pull_request:
     paths:
+      - scripts/*axum_container*.sh
+      - scripts/tests/test_axum_container*.py
+      - examples/container-publishing/**
+      - examples/axum-deployment/**
+      - docs/guide/*axum-containers.md
       # ANY workflow or action change must start the repository-wide pin gate (and
       # the smokes) — including a brand-new action directory or an unrelated
       # workflow like test.yml that could introduce a floating ref.
@@ -27,6 +32,11 @@ on:
   push:
     branches: [main]
     paths:
+      - scripts/*axum_container*.sh
+      - scripts/tests/test_axum_container*.py
+      - examples/container-publishing/**
+      - examples/axum-deployment/**
+      - docs/guide/*axum-containers.md
       # ANY workflow or action change must start the repository-wide pin gate (and
       # the smokes) — including a brand-new action directory or an unrelated
       # workflow like test.yml that could introduce a floating ref.
@@ -97,15 +107,20 @@ jobs:
         # warning floor (info-level notes in unrelated workflows are not failures).
         run: |
           "$RUNNER_TEMP/tools/bin/actionlint" -shellcheck='shellcheck -S warning'
+          "$RUNNER_TEMP/tools/bin/actionlint" -shellcheck='shellcheck -S warning' examples/container-publishing/release.yml
 
       - name: Third-party actions pinned to a ref
-        run: .github/actions/deploy-core/tests/check-action-pins.sh
+        run: |
+          .github/actions/deploy-core/tests/check-action-pins.sh
+          .github/actions/deploy-core/tests/check-action-pins.sh examples/container-publishing/release.yml
 
       - name: Zizmor security scan
         run: |
           "$RUNNER_TEMP/tools/bin/zizmor" --offline \
             .github/workflows/deploy-action.yml \
             .github/workflows/fastly-installer-check.yml \
+            .github/workflows/axum-container.yml \
+            examples/container-publishing/release.yml \
             .github/actions/build-app-cli/action.yml \
             .github/actions/deploy-fastly/action.yml \
             .github/actions/healthcheck-fastly/action.yml \
@@ -121,7 +136,12 @@ jobs:
             .github/actions/*/scripts/*.sh \
             .github/actions/deploy-core/tests/*.sh \
             scripts/install-actionlint.sh \
-            scripts/install-yq.sh
+            scripts/install-yq.sh \
+            scripts/*axum_container*.sh \
+            examples/container-publishing/publish.sh
+
+      - name: Container helper unit tests
+        run: python3 -m unittest discover -s scripts/tests -p 'test_axum_container*.py' -v
 
       - name: Bash contract tests
         run: .github/actions/deploy-core/tests/run.sh

diff --git a/.gitignore b/.gitignore
@@ -21,6 +21,9 @@ target/
 .*.edgezero-lock
 .*.edgezero-*.tmp
 
+# Standard-library container-helper test bytecode.
+__pycache__/
+
 # env
 .env