ci: build native release artifacts inside the canonical dev container and verify container-build provenance (ADR-1178)

[lusoris]

Summary

Reworks native release artifact compilation (build-artifacts in .github/workflows/supply-chain.yml) to execute on the Intel Arc A380 containerised self-hosted runner (labels: [self-hosted, linux, x64, sycl-arc], provisioned by ADR-1177 / PR #1304) using the workstation's local canonical dev container environment (vmaf-sycl-arc-runner:local, derived FROM vmaf-dev-mcp:local) without any registry pull per ADR-1178 (Phase 4b.9). This completely bypasses the 29.5 GB uncompressed layer pull blocker on standard GitHub-hosted ubuntu-latest runners (14 GB SSD limit). The runner container itself is the build environment (contains GCC-13/15, Clang-19, Meson, Ninja, Python 3.14, oneAPI, CUDA 13.3, ROCm 7.2.4, and /etc/vmafx-dev-container; no Docker socket needed). Protected by a canonical tag-release guard (github.repository == 'VMAFx/vmafx' && startsWith(github.ref, 'refs/tags/v')), serialized concurrency (concurrency: group: release-artifacts-build), and generous timeout-minutes: 90. Staged release artifacts are stamped with container-build provenance via scripts/ci/check-container-build.sh --stamp, which now accepts both vmaf-dev-mcp and vmaf-sycl-arc-runner while strictly rejecting bare ubuntu-latest (exit 1). Downstream verify-native-artifacts on ubuntu-latest runs --verify, scripts/release/verify-native-release-artifacts.sh fails closed if the stamp is missing/empty/symlinked, and attach-to-release requires the provenance file alongside Cosign signatures. .github/workflows/dev-container-publish.yml is retained as optional provenance on GHCR, decoupled from release artifact compilation. Configures .github/actionlint.yaml with custom self-hosted labels.

Verification: actionlint on both workflows exit 0; scripts/ci/tests/test-check-container-build.sh 31 passed, 0 failed; scripts/release/tests/test-verify-native-release-artifacts.sh 10 passed, 0 failed; scripts/release/tests/test-publication-environment-binding.sh all PASS; pre-commit on every touched file all hooks passed; concat-changelog-fragments.sh --check exit 0; concat-adr-index.sh --check exit 0.

Type

• ci — build native release artifacts on self-hosted Arc A380 canonical runner (ADR-1178)

Checklist

• Commits follow Conventional Commits.
• make format && make lint is green locally (pre-commit on every touched file).
• Unit tests: bash scripts/ci/tests/test-check-container-build.sh (31 passed), bash scripts/release/tests/test-verify-native-release-artifacts.sh (10 passed), bash scripts/release/tests/test-publication-environment-binding.sh (all PASS), actionlint on both workflows (exit 0).
• Docs in the same PR: docs/development/publishing.md, docs/development/release.md, docs/adr/1178-dev-container-image-publish.md, docs/research/1178-dev-container-image-publish.md.
• SIMD/GPU: n/a (CPU-only release artifact, no kernel change); twins: n/a; new C sources: none; breaking change: none; ADR: docs/adr/1178-dev-container-image-publish.md (+ index fragment, _order.txt, regenerated docs/adr/README.md).

Bug-status hygiene (ADR-0165)

• docs/state.md — T-PUBLISH-NATIVE-RELEASE-NOT-CONTAINERISED-2026-09-03 moved from Open to Recently closed (branch ci/release-artifacts-built-in-dev-container).

Netflix golden-data gate (ADR-0024)

• I did not modify any assertAlmostEqual(...) score in the Netflix golden Python tests.

Deep-dive deliverables (ADR-0108)

• Research digest — docs/research/1178-dev-container-image-publish.md
• Decision matrix — docs/adr/1178-dev-container-image-publish.md (Alternatives: (a) self-hosted Arc A380 runner with local image [chosen], (b) GHCR dev container pull [lost to 29.5GB blocker], (c) slim release-only stage, (d) on-the-fly build)
• AGENTS.md invariant note — no rebase-sensitive invariants: fork-only CI workflows and release scripts, nothing upstream Netflix/vmaf touches.
• Reproducer / smoke-test command — below.
• CHANGELOG fragment — changelog.d/changed/release-artifacts-built-in-dev-container.md
• Rebase note — docs/rebase-notes.md entry (ci/release-artifacts-built-in-dev-container, no rebase impact: fork-only CI)

Reproducer

actionlint .github/workflows/dev-container-publish.yml .github/workflows/supply-chain.yml
# exit 0, no output
bash scripts/ci/tests/test-check-container-build.sh | tail -1
# test-check-container-build: 31 passed, 0 failed
bash scripts/release/tests/test-verify-native-release-artifacts.sh | tail -1
# === Results: 10 passed, 0 failed ===
bash scripts/release/tests/test-publication-environment-binding.sh | tail -1
# PASS: container signatures require the exact published tag identity
bash scripts/release/concat-changelog-fragments.sh --check
# exit 0
bash scripts/docs/concat-adr-index.sh --check
# exit 0