[leifj]

Step 2 of the integration-branch plan. Stacked on #90 (base = its branch; retarget to main when that merges). Nothing is deployed and no image is built; the workflow has never run.

integration.py sync

(Re)creates an integration/<name> branch from a PR list: the base, then one --no-ff merge per PR head in the order given. Each PR is fetched from its own repo (pull/<n>/head; @sha pins a head and fails if the PR has moved). The merge message is Merge PR owner/repo#N @<head9>: <title>, so report reads the list back offline (no API), and a synced branch always passes verify. A conflict stops it, aborts the merge and leaves the tree clean: it must be resolved in a glue PR that goes in the list, never by hand. --from <branch> takes the PR list (latest heads) of an existing branch, which is how a branch is updated or a drifted one regenerated; --push <remote> force-pushes with a lease.

.github/workflows/build-integration.yml

workflow_dispatch (repo, branch, component, pr_repos, optional dockerfile/target/build args). It checks the branch out with full history, runs verify before building (a drifted branch is refused), uploads the report as an artifact, builds with the component's own Dockerfile and a registry cache, and pushes ghcr.io/<owner>/integration/<component>:<branch>-<sha7> with labels (revision, branch, org.siros.integration.prs, report sha256) and a provenance attestation. The run summary prints component@sha256:... to pin by digest. No dispatch input is interpolated into a shell script; permissions are contents: read, packages: write; no latest.

Tests (18 in tests/test_integration_tool.py, real git repositories)

Added for sync: builds the branch and verify/report read it back offline; a moved head is refused; a conflict stops it and leaves a clean tree; --from picks up a PR's newer head; a dirty tree is refused; PR reference parsing. For the workflow: it parses with the documented inputs, verify precedes the build (proven: replacing the verify step fails the test), no input reaches a shell, least privilege. actionlint is clean.

Not covered, said plainly

• The workflow has never run (it can only be dispatched from the default branch once merged).
• It does not cover builds that need more than build args: the vc verifier's circuit-artifact overlay (dockerfiles/verifier-nymauth.Dockerfile) needs a file that is not in any repo, and the ZK libraries still build from cold inside the vc Dockerfile (the cached builder image is a later step).
• A private repository needs the INTEGRATION_READ_TOKEN secret.
• The two existing branches (vc integration/gdc-nymauth-v5, the engine branch) still fail verify (see scripts/integration.py: report and verify what an integration branch contains #90); regenerating them with sync --from and the glue-PR conversion of the engine's two local commits is the next step, and needs the owners' OK to push integration/* branches.

🤖 Generated with Claude Code

[leifj]

Superseded by the org-level version: sirosfoundation/.github#36 (plan-generated branches, verify, glue classification, a reusable workflow and PR comments; no sirosid-dev dependency). This PR should be closed once that direction is agreed.