chore(build): host GDAL and hastegeo wheels on GitHub Releases

[jQuinRivero]

Summary

Moves the GDAL and hastegeo wheels from legacy Azure Blob hosting to the public haste-binaries GitHub Release, and adds an automated release-candidate pipeline for hastegeo changes.

For each hastelib release candidate, the pipeline produces one matching deployable set:

hastegeo-X.Y.ZrcN-py3-none-any.whl
hastetraining:X.Y.ZrcN
hasteimageryprep:X.Y.ZrcN

Changes

• Hosts GDAL and stable hastegeo wheels on GitHub Releases using anonymous public download URLs.
• Keeps local Function Docker builds on editable checked-out hastelib source.
• Makes the Hatch hook build-only; version resolution and publication are handled by tested CI scripts.
• Adds sequential PEP 440 RC versioning with patch/minor/major and exact-version overrides.
• Builds the RC wheel once in a read-only PR job.
• Publishes same-repository PR RC artifacts through a trusted default-branch workflow.
• Builds training and imageryprep images once in ACR, in parallel, using the exact wheel RC as both image tags.
• Prevents duplicate hastelib image builds in the existing Docker workflow.
• Defaults deployment image tags to the selected hastegeo version and rejects mismatched RC artifact sets.
• Prevents wheel and versioned image tags from being overwritten.
• Makes stable releases idempotent using source tags.
• Adds report-only scheduled RC cleanup with explicit retention support.
• Updates release, deployment, Docker, and contributor documentation.

Why

Previously, wheel building, publication, and dependency pin updates were coupled together. The initial CI design also built the same large Docker images locally and then rebuilt them in ACR, adding unnecessary wait time.

The new design separates untrusted PR builds from privileged publication while ensuring each expensive Docker image is built only once. The wheel and both images share one version, making the exact artifact set straightforward to deploy and reproduce.

Security properties

• PR build jobs use read-only repository permissions and no cloud credentials.
• Fork PRs cannot publish artifacts.
• Privileged publication uses workflow definitions from the default branch.
• Wheel filename and package metadata are validated before publication.
• Existing wheel names and mutable versioned image tags are rejected.
• Stable release publication remains separately gated.

Testing

• Release/version/publisher/workflow unit tests pass.
• Workflow YAML and action pin validation pass.
• Real RC wheel build and metadata validation pass.
• Function, training, and imageryprep Docker builds were smoke-tested.
• Public wheel URLs were tested from a clean Linux container.
• Standard repository security and code scanning checks run on the PR.

Rollout

The RC build and trusted publication workflows become active after these workflow definitions are available on the default branch. Stable publication remains disabled until the repository's release controls are configured.

Legacy Blob-hosted files are not removed, preserving compatibility for existing external pins during migration.

[Copilot]

Pull request overview

This PR migrates GDAL and hastegeo wheel distribution from legacy Azure Blob hosting to GitHub Releases (haste-binaries) and introduces a split, least-privilege CI pipeline that builds RC/stable wheels in an untrusted job and publishes them via a trusted default-branch workflow, with version-coherent ACR image tags and deploy-time validation.

Changes:

• Adds a version-resolution + immutable wheel publishing toolchain (hastelib/haste_release.py + .github/scripts/*) and corresponding unit/workflow policy tests.
• Updates function/Docker build and deployment flows to default to editable local hastelib installs, while CI rewrites requirements to validated wheel URLs for remote builds.
• Adds new GitHub Actions workflows for wheel build, trusted publication + ACR builds, and report-first RC cleanup; updates docs/specs accordingly.

Reviewed changes

Copilot reviewed 37 out of 37 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
spec/features/hastegeo-ci-pipeline/user-stories.md	Defines personas, acceptance criteria, and agent assignment map for the CI/publish pipeline.
spec/features/hastegeo-ci-pipeline/test-plan.md	Documents unit/integration scenarios and workflow security assertions for the new pipeline.
spec/features/hastegeo-ci-pipeline/README.md	Feature overview, motivation, success criteria, and affected components.
spec/features/hastegeo-ci-pipeline/plan.md	Execution plan and rollout gating variables/environments.
spec/features/hastegeo-ci-pipeline/design.md	Technical design and trust-boundary model for build vs publish vs ACR build steps.
README.md	Removes a stray formatting line in the repo README.
hastelib/tests/build/test_release_workflows.py	Adds policy tests for workflow pinning, permissions, gating, and deploy behavior.
hastelib/tests/build/test_release_scripts.py	Adds tests for wheel validation/publishing, deploy resolver, requirement toggling, and cleanup planning.
hastelib/tests/build/test_haste_release.py	Adds/updates tests for deterministic version resolution and error propagation.
hastelib/src/hastegeo/about.py	Sets local/editable installs to report 0.0.0+local; CI stamps explicit versions into wheels/images.
hastelib/README.md	Updates install instructions to GitHub Releases wheel URLs and documents the new CI-based release process.
hastelib/pyproject.toml	Removes Azure build-time deps from build-system requirements (hook is now build-only).
hastelib/haste_release.py	Introduces pure version policy and release-asset querying helpers used by CI scripts.
hastelib/haste_build.py	Converts the Hatch hook to only stamp an explicit version and emit outputs; removes blob upload/pin rewriting.
docs/requirements.txt	Updates documentation install commands to use GitHub Releases wheel URLs.
docs/api/hastefuncqueues.md	Updates docs to reflect editable-local default and CI rewrite to wheel for deployment.
docker/README.md	Updates wheel/image build documentation to reflect the new RC/stable workflows and artifact coherence rules.
docker/imageryprep/requirements.txt	Switches GDAL wheel source to GitHub Releases and removes now-unneeded hastegeo @ ... wheel line.
api/hastefuncqueues/requirements.txt	Defaults to editable -e ../../hastelib and keeps a commented wheel line for CI/deploy rewrite.
api/hastefuncqueues/README.md	Aligns component docs with editable-local default + CI rewrite behavior.
api/hastefuncqueues/Dockerfile	Copies full hastelib/ and installs via requirements (editable by default).
api/hastefuncapi/requirements.txt	Defaults to editable -e ../../hastelib and updates GDAL wheel URL host.
api/hastefuncapi/Dockerfile	Copies full hastelib/ and installs via requirements (editable by default).
AGENTS.md	Updates repository agent guidance to reflect build-only hook + trusted publisher model.
.github/workflows/README.md	Documents the new hastegeo wheel + versioned-image workflow behavior and gating variables.
.github/workflows/rc-cleanup.yml	Adds scheduled report-only RC cleanup with an approval-gated delete path.
.github/workflows/hastegeo-publish.yml	Adds trusted workflow_run publisher, RC ACR builds, and PR artifact comment summary.
.github/workflows/hastegeo-build.yml	Adds read-only wheel build workflow (version resolve, tests, build, validate, upload artifact).
.github/workflows/docker-build-and-push.yml	Prevents duplicate hastelib-driven image builds; pins actions to SHAs.
.github/workflows/deploy-apps.yml	Adds deploy-time wheel/version resolution and RC coherence enforcement before Azure mutation.
.github/scripts/set_hastegeo_source.py	Adds idempotent requirements toggling between editable and wheel sources.
.github/scripts/resolve_hastegeo_version.py	Adds CI resolver entrypoint emitting Actions outputs.
.github/scripts/resolve_hastegeo_deploy.py	Adds deploy resolver to verify asset existence and emit canonical wheel URL.
.github/scripts/publish_hastegeo_wheel.py	Adds trusted wheel validator/publisher enforcing immutability and tag policy.
.github/scripts/deploy_apps.sh	Ensures func publish failures fail the workflow and rewrites function requirements to wheel when deploying.
.github/scripts/cleanup_rc_releases.py	Adds fail-closed, report-first cleanup planner and optional deletion logic.
.github/rc-retain.txt	Adds retention file for RC cleanup allowlisting.

Comments suppressed due to low confidence (1)

.github/workflows/hastegeo-build.yml:16

• The push path filter is also limited to hastelib/**. If CI scripts or the workflow wiring change on main (e.g., resolve/publish/deploy scripts), this build+test workflow won’t run on push, which increases the chance of breaking the default-branch trusted publisher/deploy path without immediately noticing.

  push:
    branches:
      - main
    paths:
      - "hastelib/**"