Capture AMI manifest at build time via Packer, drop SSH approach

Runs as a stage2 provisioner (same pattern as ansible.log), deleted
before the instance is imaged. Both legs read the resulting
/tmp/ami-manifest.txt: testinfra-ami-build.yml uploads it as a build
artifact, ami-release-nix.yml (amd64) caches it to S3 as the develop
baseline. Replaces the prior SSH-based capture, which blew the
existing 10-minute test timeout hashing the whole filesystem over a
remote shell.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: brainrake

.github/workflows/ami-release-nix.yml

@@ -105,6 +105,10 @@ jobs:
           postgres_version: ${{ matrix.postgres_version }}
           region: ${{ env.AWS_REGION }}
 
+      - name: Cache AMI manifest
+        if: matrix.target.arch == 'amd64'
+        run: aws s3 cp /tmp/ami-manifest.txt "s3://${{ secrets.ARTIFACTS_BUCKET }}/ami-manifests/${{ matrix.postgres_version }}/latest.txt"
+
       - name: Setup post build env vars
         run: |
           POSTGRES_SUPABASE_VERSION=${{ steps.build-ami.outputs.postgres_release_version }}

.github/workflows/testinfra-ami-build.yml

@@ -121,6 +121,14 @@ jobs:
           overwrite: true
           retention-days: 1
 
+      - name: Upload AMI manifest
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: ami-manifest-${{ matrix.postgres_version }}-${{ matrix.target.arch }}
+          path: /tmp/ami-manifest.txt
+          overwrite: true
+          retention-days: 1
+
       - name: Run tests
         timeout-minutes: 10
         env:

stage2-nix-psql.pkr.hcl

@@ -138,4 +138,23 @@ build {
     destination = "/tmp/ansible-stage2.log"
     direction   = "download"
   }
+
+  provisioner "file" {
+    source      = "testinfra/manifest-snapshot.sh"
+    destination = "/tmp/manifest-snapshot.sh"
+  }
+
+  provisioner "shell" {
+    inline = [
+      "chmod +x /tmp/manifest-snapshot.sh",
+      "sudo /tmp/manifest-snapshot.sh > /tmp/ami-manifest.txt",
+      "rm /tmp/manifest-snapshot.sh"
+    ]
+  }
+
+  provisioner "file" {
+    source      = "/tmp/ami-manifest.txt"
+    destination = "/tmp/ami-manifest.txt"
+    direction   = "download"
+  }
 }

testinfra/manifest-snapshot.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+set -eu
+
+EXCLUDE='^/(proc|run|tmp|var/log|data)(/|$)'
+
+find / -xdev \( -type f -o -type l \) 2>/dev/null | grep -Ev "$EXCLUDE" | sort | while read -r f; do
+  if [ -L "$f" ]; then
+    printf '%s\tlink\t%s\n' "$f" "$(readlink "$f")"
+  else
+    printf '%s\t%s\t%s\n' "$f" "$(stat -c '%a:%U:%G' "$f" 2>/dev/null || echo '?')" "$(sha256sum "$f" 2>/dev/null | cut -d' ' -f1)"
+  fi
+done
+
+echo '--- units ---'
+systemctl list-unit-files --no-pager 2>/dev/null | sort
+echo '--- users ---'
+getent passwd | sort
+echo '--- groups ---'
+getent group | sort
+echo '--- nft ---'
+nft list ruleset 2>/dev/null || true
+echo '--- sysctl ---'
+sysctl -a 2>/dev/null | sort