Release Manifest & Distribution

Use your BigHammer reader role to mirror entitled container images, Helm charts, and code packages into your Azure Container Registry (ACR) and private artifact stores. Start with Step 1 — customer profile onboarding; then run the mirror workflow once per release.

Mirror — do not consume from BigHammer catalog long-term

BigHammer catalog artifacts may be archived or removed after a retention period. Always mirror into your ACR (and your private PyPI/npm repos if entitled) and treat those copies as your source of truth.

Step 1 — Customer profile registry (onboarding)

Before you can pull or mirror any artifact, BigHammer registers a customer profile for your organization. That profile defines who you are, what you are entitled to pull, and how your CI authenticates to the shared BigHammer release catalog.

BigHammer uses the profile to provision your dedicated IAM reader role:

arn:aws:iam::<bh-aws-account-id>:role/bh-artifact-reader-<customer_id>

You do not get a separate copy of the catalog at BigHammer. Access is scoped to entitled charts, images, and packages only.

What you submit

Send the following to your BigHammer contact. They map it to a CustomerProfile (apiVersion: bighammer.io/v1).

Organization and contacts

Field	Example	Notes
Customer ID	`<customer-id>`	Stable kebab-case name; becomes part of the reader role
Display name	Example Corp	Legal or team name
Technical contact	`devops@example.com`	Handoff and entitlement changes

Azure deployment

Field	Example
Primary cloud	`azure`
Azure subscription ID	`00000000-0000-0000-0000-000000000000`
Region(s)	`<your-azure-region>`
AKS cluster name	`<your-aks-cluster>` (if known)

CI trust (choose at least one)

Method	What you provide
GitHub Actions OIDC	GitHub org + repo path(s)
GitLab CI OIDC	GitLab project path
Azure DevOps OIDC	Organization, project, service connection details
AWS cross-account	Your AWS account ID for mirror jobs that assume the BH reader role

Artifact entitlements

Field	Typical value (Azure)
Version channel	`stable`, `rc`, or `lts`
Helm charts (OCI)	`bighammer`, `bhrabbitmq`, `bh-gateway` (optional)
Chart paths	`azure/bh-helm-release/<chart>`
Container images	`platform_release` (full chart image set) or named allowlist
Code packages (optional)	Entitled PyPI / npm package names

Target registries (your Azure subscription)

Artifact	Azure format	Example name
Container images	ACR repository	`bh-docker-public` or customer-defined
Helm OCI charts	ACR OCI artifact	`bh-helm-release`
Python packages	Private feed / Artifacts	Customer-defined
npm packages	Private feed / Artifacts	Customer-defined

What BigHammer returns (handoff pack)

Item	Example
Reader role ARN	`arn:aws:iam::<bh-aws-account-id>:role/bh-artifact-reader-<customer-id>`
AWS region	`<bh-catalog-aws-region>`
Release manifest	Pinned chart versions, image tags, package versions
Entitlements summary	Charts, images, and packages in scope
Trust runbook	GitHub OIDC, GitLab OIDC, or AWS `AssumeRole` + `ExternalId`
Source URIs	BigHammer ECR and CodeArtifact endpoints (mirror pull only)

Store ExternalId in Key Vault — never commit it to Git.

Onboarding checklist

Step	Done
Intake submitted (org, Azure subscription, CI trust, entitlements)	☐
ACR created in your subscription (Docker + Helm OCI repos)	☐
Handoff pack received (reader role ARN + release manifest)	☐
Test assume-role from CI (dry pull or `aws sts get-caller-identity`)	☐

Only after Step 1 is complete, proceed to mirror artifacts (Steps 2–4 below).

Mirrored URIs (examples):

<registry>.azurecr.io/bh-ui:<tag>
oci://<registry>.azurecr.io/bh-helm-release/bighammer:<version>

Steps 2–4 — Mirror workflow

Step	Environment	Action
1	You → BigHammer	Complete customer profile intake; receive handoff pack
2	Your CI ↔ BH AWS	Assume `bh-artifact-reader-<customer_id>`
3	Your CI ← BH catalog	Pull entitled images, charts, and code packages
4	Your CI → Your ACR	Mirror to your Docker and Helm OCI repositories

Entitled Helm chart paths (Azure)

After mirror, install from your ACR, not BigHammer ECR:

Chart	BigHammer source (mirror from)	Your ACR OCI path
Platform	`oci://<bh-aws-account-id>.dkr.ecr.<bh-catalog-aws-region>.amazonaws.com/azure/bh-helm-release/bighammer`	`oci://<registry>.azurecr.io/bh-helm-release/bighammer`
RabbitMQ	`.../azure/bh-helm-release/bhrabbitmq`	`oci://<registry>.azurecr.io/bh-helm-release/bhrabbitmq`
Gateway (optional)	`.../azure/bh-helm-release/bh-gateway`	`oci://<registry>.azurecr.io/bh-helm-release/bh-gateway`

Pin versions from the release manifest BigHammer sends per upgrade.