fix: build qualification images from exact release artifacts

.github/workflows/docker-runner-check.yml

@@ -4,13 +4,21 @@ on:
   workflow_dispatch:
     inputs:
       target_branch:
-        description: "Branch in this repository to build; resolved to one immutable commit before checkout"
+        description: "Branch or full commit SHA in this repository to build"
         type: string
         required: false
       publish_eval_image:
         description: "Publish an immutable Daytona qualification image on hosted Linux (no provider credentials)"
         type: boolean
         default: false
+      release_run_id:
+        description: "Consume a successful exact-source Release Smoke pack, daemon and public-package artifact set"
+        type: string
+        required: false
+      release_base_image:
+        description: "Immutable Paperclip Daytona base image for the release-artifact consumer"
+        type: string
+        required: false
       verify_source:
         description: "Run broad source checks on hosted Linux"
         type: boolean
@@ -93,7 +101,11 @@ jobs:
           for id in "$ACTOR_ID" "$triggering_id"; do
             jq -e --argjson id "$id" 'index($id) != null' <<< "$ALLOWED_IDS" >/dev/null
           done
-          target_sha="$(gh api "repos/$REPOSITORY/git/ref/heads/$TARGET_BRANCH" --jq '.object.sha')"
+          if [[ "$TARGET_BRANCH" =~ ^[a-f0-9]{40}$ ]]; then
+            target_sha="$(gh api "repos/$REPOSITORY/commits/$TARGET_BRANCH" --jq .sha)"
+          else
+            target_sha="$(gh api "repos/$REPOSITORY/git/ref/heads/$TARGET_BRANCH" --jq '.object.sha')"
+          fi
           [[ "$target_sha" =~ ^[0-9a-f]{40}$ ]]
           echo "target_sha=$target_sha" >> "$GITHUB_OUTPUT"
 
@@ -105,6 +117,7 @@ jobs:
     timeout-minutes: 90
     permissions:
       contents: read
+      actions: read
       packages: write
     steps:
       - name: Authorize an explicit maintainer image build
@@ -126,7 +139,7 @@ jobs:
           done
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
-          ref: ${{ needs.authorize_manual.outputs.target_sha }}
+          ref: ${{ inputs.release_run_id != '' && github.sha || needs.authorize_manual.outputs.target_sha }}
           persist-credentials: false
       - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
         with:
@@ -136,6 +149,7 @@ jobs:
           node-version: 24
           package-manager-cache: false
       - name: Resolve source dependencies without lifecycle scripts
+        if: inputs.release_run_id == ''
         run: |
           pnpm install --resolution-only --ignore-scripts --no-frozen-lockfile
           mkdir -p remote-verification
@@ -149,7 +163,7 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build checksum-verified Grok provider image
-        if: inputs.publish_eval_image
+        if: inputs.publish_eval_image && inputs.release_run_id == ''
         env:
           SOURCE_SHA: ${{ needs.authorize_manual.outputs.target_sha }}
         run: |
@@ -170,6 +184,41 @@ jobs:
           docker buildx imagetools inspect "$immutable" >/dev/null
           echo "$immutable" > remote-verification/image.txt
           echo "Image: $immutable" >> "$GITHUB_STEP_SUMMARY"
+      - name: Consume exact release artifacts into the qualification image
+        if: inputs.publish_eval_image && inputs.release_run_id != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SOURCE_SHA: ${{ needs.authorize_manual.outputs.target_sha }}
+          RELEASE_RUN_ID: ${{ inputs.release_run_id }}
+          RELEASE_BASE_IMAGE: ${{ inputs.release_base_image }}
+        run: |
+          set -euo pipefail
+          test '${{ inputs.verify_source }}' != true
+          test '${{ inputs.verify_public_install }}' != true
+          test '${{ inputs.build_eval_viewer }}' != true
+          mkdir -p remote-verification
+          git rev-parse HEAD > remote-verification/tooling-source.txt
+          printf '%s\n' "$SOURCE_SHA" > remote-verification/source.txt
+          node scripts/prepare-runner-release-image.mjs remote-verification/release-context
+          image="ghcr.io/paperclipai/paperclip-daytona-runner:qualification-${SOURCE_SHA}-${GITHUB_RUN_ID}"
+          docker buildx build --platform linux/amd64 \
+            --build-arg "BASE_IMAGE=$RELEASE_BASE_IMAGE" \
+            --tag "$image" --metadata-file remote-verification/image.json --push \
+            remote-verification/release-context
+          digest="$(jq -r '."containerimage.digest"' remote-verification/image.json)"
+          [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]
+          immutable="${image%:*}@$digest"
+          docker run --rm --entrypoint cat "$immutable" /opt/paperclip-runner/provider-pack/provider-pack.json \
+            > remote-verification/image-provider-pack.json
+          cmp remote-verification/release-context/provider-pack.json remote-verification/image-provider-pack.json
+          docker run --rm --entrypoint sha256sum "$immutable" /usr/local/bin/paperclip-runnerd \
+            > remote-verification/image-daemon.sha256
+          expected="$(jq -r .daemonSha256 remote-verification/release-image-inputs.json)"
+          test "$(cut -d ' ' -f 1 remote-verification/image-daemon.sha256)" = "$expected"
+          printf '%s\n' "$immutable" > remote-verification/image.txt
+          rm -rf remote-verification/release-context
+          docker logout ghcr.io
+          echo "Image: $immutable" >> "$GITHUB_STEP_SUMMARY"
       - name: Verify repository on hosted Linux
         if: inputs.verify_source
         # Leave time for artifact retention within the job deadline.
@@ -215,5 +264,7 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: grok-remote-verification-${{ github.run_id }}
-          path: remote-verification/
+          path: |
+            remote-verification/
+            !remote-verification/release-context/**
           retention-days: 7

.github/workflows/pr-trusted.yml

@@ -94,7 +94,7 @@ jobs:
         run: node --test ./scripts/__tests__/e2e-shard.test.mjs
 
       - name: Test release verify workflow wiring
-        run: node --test ./scripts/__tests__/release-verify-workflow.test.mjs ./scripts/cloud-source-verification.test.mjs ./scripts/standard-image-contract.test.mjs
+        run: node --test ./scripts/__tests__/release-verify-workflow.test.mjs ./scripts/__tests__/prepare-runner-release-image.test.mjs ./scripts/cloud-source-verification.test.mjs ./scripts/standard-image-contract.test.mjs
 
       - name: Test standalone package build concurrency
         run: node --test ./scripts/__tests__/build-standalone-concurrency.test.mjs