[rbuergi]

Why

The control-owned shared artifact store (Doc/Architecture/SharedArtifactStore; #6999 and #7000, both merged) keeps one bundle subtree per runtime identifier, for example <account>/<share>/linux-x64 and …/linux-arm64. It has to, because a compatibility key (c003e001) names no architecture and the publisher refuses a second architecture under an existing key.

Core CD's publish-bake job runs one lane per architecture. Every lane currently receives the same vars.BAKE_PUBLISH_TARGETS and publishes to every entry. A store subtree in that list would therefore receive both architectures, and the arm64 lane would trip the architecture guard. Review found this on #6999.

What

• In the publish-bake job only, every target list now comes from a per-lane value: matrix.arch == 'linux-arm64' && vars.BAKE_PUBLISH_TARGETS_LINUX_ARM64 || vars.BAKE_PUBLISH_TARGETS.
• That covers the preflight, Publish bundles, the registry push's lease (bake-publication-lock.sh) and the availability assert. Within a lane they all read the same list, so the lease path and the publication path cannot disagree.
• Behaviour today is unchanged. BAKE_PUBLISH_TARGETS_LINUX_ARM64 is not provisioned, so the arm64 lane falls back to the shared list exactly as before. The amd64 lane, published-modules and the module repositories' node-repo-publish-bake.yml (linux-x64 only) are untouched.
• The design doc's increment 2 and maintainer step 3 are updated. The arm64 variable must be provisioned before the store's linux-x64 subtree is added to the amd64 list.

Evidence

• actionlint on main-cd.yml gives the same 5 pre-existing style/info findings before and after; there are no new ones.
• The YAML parses.

Live effect

None until a maintainer provisions BAKE_PUBLISH_TARGETS_LINUX_ARM64, which is a maintainer step.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Registry publications still collide across architectures, and the rollout instructions include incompatible arm64 destinations.

2 open issues

• Make registry tags, reads, skips, and locks architecture-aware · New
• Restrict ARM64 publication to ARM64-compatible targets · New

What changed in this PR

Adds architecture-specific bake targets for the control-owned shared artifact store, preserving existing behavior until the arm64 variable is provisioned.

Changes:

• Uses the per-lane target list for preflight, publication, registry leases, and availability checks.
• Documents the variable provisioning order and rollout steps.

File	Description
src/​MeshWeaver.Documentation/​Data/​Architecture/​SharedArtifactStore.md	Updates architecture-specific publication and rollout guidance.
.github/​workflows/​main-cd.yml	Selects arm64 targets with fallback to the existing list.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

Target selection is consistent, and both previously identified architecture-collision issues are addressed.

No open issues 🎉

2 resolved since last review

• Restrict ARM64 publication to ARM64-compatible targets
• Make registry tags, reads, skips, and locks architecture-aware

_{Review effort: Balanced}

[github-actions]

Test Results

    27 files      27 suites   1h 2m 21s ⏱️
13 917 tests 13 720 ✅ 197 💤 0 ❌
13 947 runs  13 750 ✅ 197 💤 0 ❌

Results for commit d0fe0b4.