---
title: "2026-08-07 vxData release automation PR"
description: "Implemented and opened the draft PR for independent vxData release propagation and exact-SHA publishing."
image: "https://docs.virdx.dev/img/virdx-social-card.png"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.virdx.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# 2026-08-07 vxData release automation PR

## Work Done

- Audited `virdx/mono` and `virdx/infra_k8s` release/build paths and converted the design into draft [mono PR #323](https://github.com/virdx/mono/pull/323).
- Added state-based independent release planning for `vxdata-schemas`, `vxdata-sdk`, and `vxdata-api`, including schemas-to-SDK propagation, deterministic OpenAPI contract detection, API rebuild decisions, and eight planner tests.
- Split the SDK Conda recipe from the schemas package, added rolling GitHub App-authored release PR automation, and added post-merge package publishing in dependency order.
- Made API requests use the exact release merge SHA and fail closed when the Tekton bridge is unavailable. API tagging and the `infra_k8s` digest PR are deliberately deferred to a trusted callback after verified image publication.
- Removed duplicate manual schemas/SDK release workflows and added documentation, Nx metadata, OpenAPI snapshot checks, and PR gates.
- Validated focused tests, package builds, release dry-run, OpenAPI determinism, actionlint/YAML, and a second-agent blocking review.

## Lessons Learned: Pitfalls

- A local inherited `MPLBACKEND=module://matplotlib_inline.backend_inline` caused unrelated `vxa-sdk` test collection failures; `MPLBACKEND=Agg` proved the suite itself passes.
- A first review caught that component `src` paths alone miss packaging metadata and Docker runtime inputs. Release planners need to track the full artifact input boundary, not just application source.
- GitHub `workflow_dispatch` on a credentialed workflow is unsafe without a trusted-ref guard because dispatch can select another ref. The final workflow removes dispatch and narrows App-token permissions.
- Tekton webhook acceptance is not image build success; creating an API tag immediately after enqueue would produce false releases.

## Lessons Learned: Improvements

- Document the required Tekton webhook/callback contract, GitHub App permissions, and cross-repository `infra_k8s` token setup before enabling the workflows.
- Add a reusable infrastructure pattern for exact-SHA build submission, verified completion callbacks, digest extraction, and rolling staging PR updates.
- Record that release-state baselines should use the commit that last changed the state file; this excludes mechanical version edits while preserving detection of later package metadata changes.

Source: https://docs.virdx.dev/knowledge/inbox/2026-08-07-infrastructure-vxdata-release-automation-pr/index.mdx