refactor(sandbox-kit): publish per kit, and only on a version change (PFM-7373)

Review follow-ups.

Publish every kit under devel/sandbox-kit rather than the hardcoded claude
one: a discover job derives the matrix from the directories that hold a
spec.yaml, so a new kit needs no workflow edit.

Narrow the trigger to devel/sandbox-kit/*/spec.yaml. The previous
devel/sandbox-kit/** also matched the README, so a docs edit republished the
released tag with fresh content under the same immutable version. Guard the
same hazard from the other side by skipping a version already present in the
registry, since the trigger still fires on spec edits that leave the version
alone.

Make a zero-match glob fatal in the bump script. It previously ran from the
invocation directory and swallowed a miss, so a release run from the wrong
place would leave every spec at the old version and publish nothing, with no
error.

Move checkout and the version read ahead of the tooling installs so a missing
version fails in seconds rather than after a 95MB download. Drop the wrapper's
run_plain indirection and the detected flag left over from two-mode dispatch,
along with the last stale references to the removed trace mode.

Assisted-by: Claude Code
Signed-off-by: Miguel Martinez <miguel@chainloop.dev>

Chainloop-Trace-Sessions: 7da50f6b-428c-4749-82b5-562ae1ba890e

Author: migmartri

.github/workflows/package_sandbox_kit.yaml

@@ -1,21 +1,50 @@
 name: Package Sandbox Kit
 
 on:
-  # Only push the kit if the kit sources have changed. The release bump PR
-  # rewrites each spec.yaml `version:`, so merging it is what triggers a publish
-  # — the same shape as package_chart.yaml reacting to deployment/chainloop/**
+  # Only the specs, not the README beside them: the release bump PR rewrites each
+  # spec.yaml `version:`, and that is what should trigger a publish.
   push:
     branches:
       - main
     paths:
-      - devel/sandbox-kit/**
+      - devel/sandbox-kit/*/spec.yaml
 
 permissions: read-all
 
 jobs:
+  # Every directory under devel/sandbox-kit/ holding a spec.yaml is a kit, so
+  # adding one needs no change here.
+  discover:
+    name: Discover kits
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      kits: ${{ steps.find.outputs.kits }}
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          persist-credentials: false
+      - id: find
+        run: |
+          kits=$(find devel/sandbox-kit -mindepth 2 -maxdepth 2 -name spec.yaml -printf '%h\n' \
+                 | sed 's|.*/||' | sort | jq -Rsc 'split("\n")[:-1]')
+          if [[ "${kits}" == "[]" ]]; then
+            echo "::error::no kits found under devel/sandbox-kit"
+            exit 1
+          fi
+          echo "kits=${kits}" >> $GITHUB_OUTPUT
+          echo "Publishing: ${kits}"
+
   package:
-    name: Package and push Sandbox Kit
+    name: Package and push ${{ matrix.kit }}
+    needs: discover
     runs-on: ubuntu-latest
+    strategy:
+      # One kit's failure must not cancel the others mid-publish.
+      fail-fast: false
+      matrix:
+        kit: ${{ fromJSON(needs.discover.outputs.kits) }}
     permissions:
       contents: read
       id-token: write # Docker Hub OIDC login, SLSA provenance and keyless kit signing
@@ -25,9 +54,25 @@ jobs:
       # Docker Sandboxes ships Linux packages only on tagged releases, not on
       # nightly, so this is pinned to a stable tag and bumped by hand.
       SBX_VERSION: "v0.43.0"
-      KIT_DIR: "devel/sandbox-kit/claude"
-      KIT_REPO: "docker.io/chainloop/sbx-kit-claude"
+      KIT_DIR: "devel/sandbox-kit/${{ matrix.kit }}"
+      KIT_REPO: "docker.io/chainloop/sbx-kit-${{ matrix.kit }}"
     steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          persist-credentials: false
+
+      - name: Read kit version
+        id: kit_version
+        run: |
+          # The kit's own spec.yaml is the source of truth; bump-chart-and-dagger-version.sh
+          # keeps it in step with the chart's appVersion on every release.
+          kit_version=$(yq -r '.version' "${KIT_DIR}/spec.yaml")
+          if [[ -z "${kit_version}" || "${kit_version}" == "null" ]]; then
+            echo "::error::${KIT_DIR}/spec.yaml declares no version:"
+            exit 1
+          fi
+          echo "kit_version=${kit_version}" >> $GITHUB_OUTPUT
+
       - name: Install Chainloop
         # Deliberately NOT `curl ... | bash`: this job holds an OIDC token that can
         # mint Docker Hub credentials and sign artifacts, so the installer is
@@ -64,28 +109,29 @@ jobs:
         with:
           username: chainloop
 
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-        with:
-          persist-credentials: false
-
-      - name: Read kit version
-        id: kit_version
+      - name: Skip if this version is already published
+        id: published
+        env:
+          KIT_VERSION: ${{ steps.kit_version.outputs.kit_version }}
         run: |
-          # The kit's own spec.yaml is the source of truth; bump-chart-and-dagger-version.sh
-          # keeps it in step with the chart's appVersion on every release.
-          kit_version=$(yq -r '.version' "${KIT_DIR}/spec.yaml")
-          if [[ -z "${kit_version}" || "${kit_version}" == "null" ]]; then
-            echo "::error::${KIT_DIR}/spec.yaml declares no version:"
-            exit 1
+          # The trigger fires on any spec.yaml change, not only a version bump, so
+          # a mid-cycle edit must not overwrite an already-signed, already-attested
+          # immutable tag with fresh content.
+          if sbx kit inspect "${KIT_REPO}:${KIT_VERSION}" >/dev/null 2>&1; then
+            echo "::notice::${KIT_REPO}:${KIT_VERSION} is already published, nothing to do"
+            echo "skip=true" >> $GITHUB_OUTPUT
+          else
+            echo "skip=false" >> $GITHUB_OUTPUT
           fi
-          echo "kit_version=${kit_version}" >> $GITHUB_OUTPUT
 
       - name: Validate kit
+        if: steps.published.outputs.skip == 'false'
         # Fails loudly here rather than halfway through a push if the pinned sbx
         # release does not understand something the spec declares.
         run: sbx kit validate "./${KIT_DIR}"
 
       - name: Add Attestation (Sandbox Kit) and Push Kit
+        if: steps.published.outputs.skip == 'false'
         run: |
           # KIT_VERSION arrives through env, not ${{ }} interpolation, so the value
           # is never expanded into this script's source.
@@ -114,12 +160,12 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Finish and Record Attestation
-        if: ${{ success() }}
+        if: ${{ success() && steps.published.outputs.skip == 'false' }}
         run: |
           chainloop attestation push
 
       - name: Mark attestation as failed
-        if: ${{ failure() }}
+        if: ${{ failure() && steps.published.outputs.skip == 'false' }}
         run: |
           chainloop attestation reset
 

.github/workflows/utils/bump-chart-and-dagger-version.sh

@@ -60,11 +60,14 @@ if [[ -n "${platform_version}" && "${platform_version}" != "null" ]]; then
 fi
 
 ## Update the Docker Sandboxes kit versions
-# Each kit declares the Chainloop release whose CLI it ships, so they track semVer
-# like appVersion does. The path is fixed rather than an argument because this is a
-# directory of kits that grows, and `schemaVersion:` is left alone by the ^version anchor.
-for kit_spec in devel/sandbox-kit/*/spec.yaml; do
-    [ -e "${kit_spec}" ] || continue
-    sed -i "s#^version:.*#version: ${semVer}#g" "${kit_spec}"
+# Each kit declares the Chainloop release it belongs to, tracking semVer like
+# appVersion does. `schemaVersion:` is left alone by the ^version anchor.
+# Matching nothing is an error, not a no-op: a silent skip here would leave the
+# specs at the old version and the publish workflow would never fire.
+shopt -s nullglob
+kit_specs=(devel/sandbox-kit/*/spec.yaml)
+[ "${#kit_specs[@]}" -gt 0 ] || die "no kit specs found under devel/sandbox-kit (run from the repo root)"
+for kit_spec in "${kit_specs[@]}"; do
+    sed -i "s#^version:.*#version: ${semVer}#" "${kit_spec}"
 done
 

devel/sandbox-kit/README.md

@@ -45,7 +45,7 @@ inside the sandbox before it is reclaimed.
 
 ### 1. Through the environment file
 
-The repo's `sbxenv.yaml` declares the agent, the kit, the clone-mode workspace and the trace mode, so the
+The repo's `sbxenv.yaml` declares the agent, the kit and the clone-mode workspace, so the
 only thing left to pass is the token:
 
 ```bash

devel/sandbox-kit/claude/spec.yaml

@@ -22,9 +22,10 @@
 schemaVersion: "2"
 kind: sandbox                                # REQUIRED: only kind:sandbox may set an entrypoint
 name: chainloop-trace-claude
-# Tracks the Chainloop release this kit ships the CLI of. Bumped automatically on
-# release by .github/workflows/utils/bump-chart-and-dagger-version.sh, alongside the
-# chart's appVersion - do not edit by hand.
+# The Chainloop release this kit belongs to. Bumped automatically on release by
+# .github/workflows/utils/bump-chart-and-dagger-version.sh, alongside the chart's
+# appVersion - do not edit by hand. NOTE the install step below is not pinned to
+# it, so it is a release marker, not a statement about the CLI inside.
 version: v1.109.0
 displayName: Claude Code (Chainloop-traced)
 description: >-
@@ -87,10 +88,6 @@ setup:
         #!/usr/bin/env bash
         set -euo pipefail
 
-        run_plain() {
-          exec claude --dangerously-skip-permissions "$@"
-        }
-
         # Anything that would hand back an untraced agent is fatal: a sandbox
         # that quietly records nothing is worse than one that refuses to start.
         die() {
@@ -129,16 +126,8 @@ setup:
         # Persistent tracing only: the repo must already be initialized, and the
         # identity comes from its committed .chainloop.yml.
         repo_root=$(git rev-parse --show-toplevel 2>/dev/null || echo "$PWD")
-        detected=0
-        for f in "$repo_root/.chainloop.yml" "$repo_root/.chainloop.yaml"; do
-          if [ -f "$f" ] && grep -qE '^[[:space:]]*projectName:[[:space:]]*["'"'"']?[A-Za-z0-9]' "$f" \
-             && grep -q "chainloop trace hook" "$repo_root/.claude/settings.json" 2>/dev/null; then
-            detected=1
-            break
-          fi
-        done
-
-        if [ "$detected" != 1 ]; then
+        if ! grep -qsE '^[[:space:]]*projectName:[[:space:]]*["'"'"']?[A-Za-z0-9]' "$repo_root"/.chainloop.y*ml \
+           || ! grep -qs "chainloop trace hook" "$repo_root/.claude/settings.json"; then
           die "this repository is not initialized for chainloop trace.
 
           Run this in the repository first, then start the sandbox again:
@@ -155,7 +144,7 @@ setup:
 
         echo "[chainloop-trace] Repo initialized for chainloop trace - persistent mode" >&2
         echo "[chainloop-trace]   identity from .chainloop.yml; attestation is pushed on 'git push'" >&2
-        run_plain "$@"
+        exec claude --dangerously-skip-permissions "$@"
 
 environment:
   variables:

sbxenv.yaml

@@ -112,7 +112,7 @@ workspace:
 # devel/sandbox-kit/README.md.
 
 # NOTE — deliberately NOT declared here:
-#   env:      nothing left to set. The Chainloop token and the mode reach the
+#   env:      nothing left to set. The Chainloop token reaches the
 #             sandbox as KIT arguments (above), not as environment variables, so
 #             the kit owns its own configuration surface. Path B still applies:
 #             the kit turns chainloopToken into CHAINLOOP_TOKEN inside the VM,