From 22d8ffdf6b492efe34b1e7928f6d2f2cf7bd0492 Mon Sep 17 00:00:00 2001
From: Georgi Chulkov <georgi.chulkov@sap.com>
Date: Tue, 4 Aug 2026 13:57:03 +0200
Subject: [PATCH] Add support for publishing_group per ADR0037

---
 src/gardenlinux/s3/s3_artifacts.py |  9 ++++++
 tests/s3/test_s3_artifacts.py      | 46 ++++++++++++++++++++++++++++++
 2 files changed, 55 insertions(+)

diff --git a/src/gardenlinux/s3/s3_artifacts.py b/src/gardenlinux/s3/s3_artifacts.py
index d1bc0d57..b887ab39 100644
--- a/src/gardenlinux/s3/s3_artifacts.py
+++ b/src/gardenlinux/s3/s3_artifacts.py
@@ -153,6 +153,7 @@ def upload_from_directory(
         require_uefi = None
         secureboot = None
         tpm2 = None
+        publishing_group = None
 
         if requirements_file.exists():
             requirements_config = ConfigParser(allow_unnamed_section=True)
@@ -172,6 +173,11 @@ def upload_from_directory(
             if requirements_config.has_option(UNNAMED_SECTION, "tpm2"):
                 tpm2 = requirements_config.getboolean(UNNAMED_SECTION, "tpm2")
 
+            if requirements_config.has_option(UNNAMED_SECTION, "publishing_group"):
+                publishing_group = requirements_config.get(
+                    UNNAMED_SECTION, "publishing_group"
+                )
+
         if arch is None:
             raise RuntimeError(
                 "Architecture could not be determined from release or requirements file"
@@ -220,6 +226,9 @@ def upload_from_directory(
         if platform_variant is not None:
             metadata["platform_variant"] = platform_variant
 
+        if publishing_group:
+            metadata["publishing_group"] = publishing_group
+
         base_name_length = len(base_name)
 
         for artifact in artifacts_dir.iterdir():
diff --git a/tests/s3/test_s3_artifacts.py b/tests/s3/test_s3_artifacts.py
index 2d5eda59..9983c46f 100644
--- a/tests/s3/test_s3_artifacts.py
+++ b/tests/s3/test_s3_artifacts.py
@@ -302,3 +302,49 @@ def test_upload_directory_with_requirements_override(s3_setup: S3Env) -> None:
     metadata = yaml.safe_load(meta_obj.get()["Body"].read())
     assert metadata["require_uefi"] is False
     assert metadata["secureboot"] is True
+
+
+def test_upload_directory_with_publishing_group(s3_setup: S3Env) -> None:
+    """A publishing_group value in the .requirements file is copied into the metadata."""
+    # Arrange
+    env = s3_setup
+    (env.tmp_path / f"{env.cname}.release").write_text(RELEASE_DATA)
+    (env.tmp_path / f"{env.cname}.requirements").write_text(
+        "arch = amd64\npublishing_group = container\n"
+    )
+    (env.tmp_path / f"{env.cname}-artifact").write_bytes(b"abc")
+
+    # Act
+    artifacts = S3Artifacts(env.bucket_name)
+    artifacts.upload_from_directory(env.cname, env.tmp_path)
+
+    # Assert
+    bucket = env.s3.Bucket(env.bucket_name)
+    meta_obj = next(
+        o for o in bucket.objects.all() if o.key == f"meta/singles/{env.cname}"
+    )
+    metadata = yaml.safe_load(meta_obj.get()["Body"].read())
+    assert metadata["publishing_group"] == "container"
+
+
+def test_upload_directory_without_publishing_group(s3_setup: S3Env) -> None:
+    """An empty or absent publishing_group is not emitted, marking a standalone build."""
+    # Arrange
+    env = s3_setup
+    (env.tmp_path / f"{env.cname}.release").write_text(RELEASE_DATA)
+    (env.tmp_path / f"{env.cname}.requirements").write_text(
+        "arch = amd64\npublishing_group = \n"
+    )
+    (env.tmp_path / f"{env.cname}-artifact").write_bytes(b"abc")
+
+    # Act
+    artifacts = S3Artifacts(env.bucket_name)
+    artifacts.upload_from_directory(env.cname, env.tmp_path)
+
+    # Assert
+    bucket = env.s3.Bucket(env.bucket_name)
+    meta_obj = next(
+        o for o in bucket.objects.all() if o.key == f"meta/singles/{env.cname}"
+    )
+    metadata = yaml.safe_load(meta_obj.get()["Body"].read())
+    assert "publishing_group" not in metadata