chore: refresh SDK catalog and cut a release with a pushed docker image

[DenKoren]

Why

Published block milaboratories/gpu-test 0.7.3 references docker image tag

platforma-open.milaboratories.gpu-test.gpu-info.main.c79fc91ff0c4

which is not in the registry:

$ curl -s "https://quay.io/api/v1/repository/milaboratories/pl-containers/tag/?specificTag=platforma-open.milaboratories.gpu-test.gpu-info.main.c79fc91ff0c4"
{"tags": [], "page": 1, "has_additional": false}

On an AWS EKS install the job pod schedules onto an autoscaled GPU node and then
sits in ImagePullBackOff / NotFound. 0.7.2 is fine — it points at
…gpu-info.main.1c637624b078, which is published.

Root cause is already fixed on main by #6 (MILAB-6714): the software package
carried private: true, and pl-pkg gates docker auto-push on !isPrivate, so
CI built the image, wrote the entrypoint descriptor pointing at its tag, and
skipped the push.

That fix never reached a release. The main run for #6
(31495551567)
failed at Commit changed files to main:

remote: error: GH013: Repository rule violations found for refs/heads/main.
remote: - Changes must be made through a pull request.
 ! [remote rejected] main -> main (push declined due to repository rule violations)

The release flow needs two main runs: the first applies changeset version and
pushes an "Auto-generated changes" commit; that push triggers a second run which,
seeing a clean tree (has-changes == 0), publishes. The main ruleset added on
2026-08-04 has no bypass actor for the release app, so the first push is rejected
and the publish step never runs. main therefore carries the fix and an unreleased
changeset, and 0.7.3 stays latest.

What this PR does

Brings every SDK catalog entry to its current published version:

package	from	to
@platforma-sdk/package-builder	3.14.2	3.15.0
@platforma-sdk/block-tools	2.12.9	2.14.3
@platforma-sdk/tengo-builder	4.0.20	4.0.23
@platforma-sdk/model	1.80.10	1.82.0
@platforma-sdk/ui-vue	1.80.10	1.82.1
@platforma-sdk/test	1.80.11	1.82.4
@milaboratories/ts-builder	1.6.1	1.7.0
@milaboratories/ts-configs	1.3.1	1.4.0
@milaboratories/helpers	1.14.2	1.14.5

Produced by block-tools structure refresh --update-deps-only. pnpm build
passes unchanged — no source changes were needed.

This is required, not cosmetic: the require-latest preflight enforces the latest
@platforma-sdk/block-tools and @platforma-sdk/tengo-builder on the default
branch and in the merge queue, and the current pins are stale, so publish would be
blocked on that too.

The changeset bumps all five packages so a new block version is cut (a
software-only changeset bumps gpu-info and workflow but leaves block
unchanged, which publishes no new block version).

Not applied: the full structure refresh

A plain block-tools structure refresh with 2.14.3 aborts on this block:

error: block '@platforma-open/milaboratories.gpu-test' declares no kind
       — every block must have a sibling kind/ package

@platforma-sdk/block-tools 2.14.0 introduced block kinds: the canonical
structure now requires a kind/ package and a model built through
DataModelBuilder / BlockModelV3.create({ dataModel, kind }). There is no
migration flag on the CLI. The refresh also aborts part way, having already
rewritten root scope — migrating the block onto the softwareBuild scenario
scripts (build:dev-local / build:release, dropping the plain build script),
switching CI to hz-ubuntu-dind runners and Node 22, and adding
require-package-path-bump: true — while leaving software/gpu-info still on
pl-pkg and .structure at version 1. That half-state was reverted here.

The structure-v2 / block-kind migration is separate work and should not ride
along with a release fix.

Still blocked

Merging this will not publish until the release app can push to main. The
main ruleset (id 20364870) needs the release GitHub App as a bypass actor, the
way it evidently is on other block repos — zen-weaver-of-integration[bot] pushes
"Auto-generated changes" directly to main in e.g. clonotype-clustering
(commit 8dff3d5a, 2026-08-05) under an equivalent pull_request rule. That is a
repo-admin change and is not in this repo's files.

Once merged and published, the block must be verified on both halves — a new
version in overview.json and its referenced image resolving in the registry:

curl -s "https://blocks.pl-open.science/v2/milaboratories/gpu-test/<version>/main.plj.gz" \
  | gzip -dc | grep -oE 'gpu-test\.gpu-info\.main\.[0-9a-f]+' | sort -u
curl -s "https://quay.io/api/v1/repository/milaboratories/pl-containers/tag/?specificTag=platforma-open.milaboratories.<tag>"

The reusable workflow's verify-docker-images step (default true) now gates
publication on exactly this, so the failure mode cannot silently recur.

Greptile Summary

The PR refreshes the pinned Platforma SDK catalog and adds a five-package patch changeset so the existing docker publication fix can reach a new block release.

• SDK catalog — the workspace’s centralized set of exact SDK dependency versions; nine direct catalog entries are updated to their current published versions.
• Lockfile — pnpm’s resolved dependency graph; it is regenerated to capture the updated SDK packages and their transitive dependencies.
• Changeset — release metadata declaring package version increments and release notes; a new changeset applies patch bumps to the block, model, UI, workflow, and GPU-info packages.
• Block release — the published unit consumed by Platforma; the patch bump is intended to replace version 0.7.3, whose descriptor references an unavailable container image.
• Docker image descriptor — release metadata identifying the GPU-info container tag; the new release should reference an image pushed after the software package’s private flag was removed.
• SDK structure refresh — the tooling operation used to synchronize dependency pins; this PR uses update-deps-only and deliberately leaves the structure-v2/block-kind migration for separate work.

Confidence Score: 5/5

The PR appears safe to merge, with the catalog, lockfile, and coordinated release metadata updated consistently.

The changed files consistently refresh exact SDK versions and declare the package bumps needed for a new block release; the investigated security advisories apply to unchanged transitive versions and do not represent defects introduced or worsened by this PR.

Important Files Changed

Filename	Overview
pnpm-workspace.yaml	Updates nine exact SDK and Milaboratories catalog pins while preserving the existing workspace structure.
pnpm-lock.yaml	Regenerates importer resolutions and transitive dependencies consistently with the catalog refresh; no actionable changed-code defect was identified.
.changeset/sdk-catalog-refresh-republish.md	Declares coordinated patch releases for all five packages and documents the unavailable-image failure motivating the release.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Refresh exact SDK catalog versions] --> B[Regenerate pnpm lockfile]
  B --> C[Merge patch changeset]
  C --> D[Release workflow versions five packages]
  D --> E[Publish new block and GPU-info package]
  E --> F[Verify descriptor version and container image tag]

Loading

_{Reviews (1): Last reviewed commit: "chore: refresh SDK catalog to current pu..." | Re-trigger Greptile}

Context used:

• Context used - Terms is a types in codebase. Provide the list of ... (source)

[DenKoren]

Image half verified from this PR run (32296851872) — the software build now pushes, which is the behaviour that was broken for 0.7.3:

info: Publishing docker image
  'containers.pl-open.science/milaboratories/pl-containers:platforma-open.milaboratories.gpu-test.gpu-info.main.1360096fdd8a'
platforma-open.milaboratories.gpu-test.gpu-info.main.1360096fdd8a: digest: sha256:aa9a6d37... size: 2206

Present in the registry:

$ curl -s "https://quay.io/api/v1/repository/milaboratories/pl-containers/tag/?specificTag=platforma-open.milaboratories.gpu-test.gpu-info.main.1360096fdd8a"
{"tags": [{"name": "platforma-open.milaboratories.gpu-test.gpu-info.main.1360096fdd8a",
           "manifest_digest": "sha256:aa9a6d3721307b2abcc62b8395862bad3c59572cc6a6f7165f68685aa2373e59",
           "size": 3300220627,
           "last_modified": "Wed, 19 Aug 2026 20:16:32 -0000"}], "page": 1, "has_additional": false}

The block half still cannot be verified: merging this cannot publish a new block
version until the main ruleset lets the release app push its
changeset version commit. Not merging for that reason — a merge now would
reproduce the #6 failure and leave a second unreleased changeset on main.