dev broker: official 4.x + baked GHCR image; retire jessmillar build infra

- rabbit/Dockerfile bakes enabled_plugins + dev_rabbitmq.conf +
    dev_definitions.json onto official multi-arch rabbitmq:4.1-management
    (one image for arm64 + amd64).
  - for_docker/{arm,x86}.yml pull ghcr.io/thegridelectric/dev-rabbit:latest
    (no mounts; definitions baked in). dev_rabbitmq.conf uses the 4.x
    definitions.import_backend/definitions.local.path keys and drops the
    default_* identity lines (identities come from the baked definitions).
  - .github/workflows/broker-image.yml + rabbit/build-and-push.sh build and
    push the image (CI gated by gen_definitions.py --check; both tag :latest
    and chaos__<short-sha>__<date>).
  - Delete the superseded dev build infra: DevRabbit{Arm,X86}Dockerfile,
    build-dev-broker-{arm,x86}.sh, stale rabbit_definitions_dev.json. Prod
    track (broker_arm.yml, prod rabbitmq.conf, hybrid/analytics defs) left
    untouched — prod upgrade is deferred.

Author: jessicamillar

.github/workflows/broker-image.yml

@@ -0,0 +1,58 @@
+name: Broker image
+
+# Build + push the baked dev-broker image to GHCR so every repo's dev-broker
+# compose can pull one multi-arch image with definitions baked in. Triggered
+# only when the baked inputs change (definitions are rare-change), so the
+# round-trip is infrequent.
+
+on:
+  push:
+    branches: [main, dev]
+    paths:
+      - "rabbit/rabbitconfig/dev_definitions.json"
+      - "for_docker/dev_rabbitmq.conf"
+      - "for_docker/enabled_plugins"
+      - "rabbit/Dockerfile"
+      - ".github/workflows/broker-image.yml"
+  workflow_dispatch:
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+
+      # Guard: the baked definitions must match gwbase.topology before we
+      # ship them in an image.
+      - uses: astral-sh/setup-uv@v6
+        with:
+          python-version: "3.12"
+          enable-cache: true
+      - run: uv sync --all-groups --locked
+      - run: uv run python for_docker/gen_definitions.py --check --dir rabbit/rabbitconfig
+
+      # Keep the git-hash + date in the image tag (chaos__<short-sha>__<date>)
+      # — traceable back to the exact commit that baked the definitions.
+      - name: Compute image tag
+        id: tag
+        run: echo "tag=chaos__$(git rev-parse --short HEAD)__$(date +%Y%m%d)" >> "$GITHUB_OUTPUT"
+
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: rabbit/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            ghcr.io/thegridelectric/dev-rabbit:latest
+            ghcr.io/thegridelectric/dev-rabbit:${{ steps.tag.outputs.tag }}

for_docker/arm.yml

@@ -7,20 +7,15 @@ services:
       - "dev"
     hostname: rabbit
     container_name: gw-dev-rabbit
-    image: "jessmillar/dev-rabbit-arm:chaos__fee74a3__20250120"
+    # The baked dev-broker image (definitions + conf + plugins inside it),
+    # built from rabbit/Dockerfile and pushed to GHCR by CI. Multi-arch
+    # (arm64 + amd64), so arm.sh and x86.sh pull the SAME image — and so does
+    # every other repo's dev-broker compose. Refresh with `docker compose pull`.
+    image: "ghcr.io/thegridelectric/dev-rabbit:latest"
     ports:
       - 1885:1885
       - 4369:4369
       - 5672:5672
       - 15672:15672
       - 15674:15674
       - 25672:25672
-    env_file: ./for_docker/dev_vhost.env
-    environment:
-      - RABBITMQ_USERNAME=smqPublic
-      - RABBITMQ_PASSWORD=smqPublic
-      - RABBITMQ_SERVER_ADDITIONAL_ERL_ARGS=-rabbitmq_management load_definitions "/tmp/rabbit_definitions.json"
-    volumes:
-
-      - ./for_docker/dev_rabbitmq.conf:/etc/rabbitmq/rabbitmq.conf:ro
-      - ./for_docker/enabled_plugins:/etc/rabbitmq/enabled_plugins

for_docker/dev_rabbitmq.conf

@@ -2,14 +2,13 @@
 listeners.tcp.default = 5672
 
 loopback_users = none
-## On first start RabbitMQ will create a vhost and a user. These
-## config items control what gets created
-default_vhost = d1__1
-default_user = smqPublic
-default_pass = smqPublic
-default_permissions.configure = .*
-default_permissions.read = .*
-default_permissions.write = .*
+
+## Identity + topology come from the generated definitions file (vhost,
+## smqPublic user, permissions, exchanges, bindings) — NOT from default_*
+## lines, which would race the definitions import. The file is generated
+## from gwbase.topology (see wiki executor spec §3.6).
+definitions.import_backend = local_filesystem
+definitions.local.path = /etc/rabbitmq/definitions.json
 
 ## Clustering
 cluster_partition_handling = ignore

for_docker/x86.yml

@@ -1,5 +1,3 @@
-version: "3.5"
-
 networks:
   dev:
 
@@ -9,19 +7,13 @@ services:
       - "dev"
     hostname: rabbit
     container_name: gw-dev-rabbit
-    image: "jessmillar/dev-rabbit-x86:chaos__e58daf6__20230115"
+    # Same baked multi-arch image as arm.yml — no separate x86 image. Built
+    # from rabbit/Dockerfile, pushed to GHCR by CI. Refresh: docker compose pull.
+    image: "ghcr.io/thegridelectric/dev-rabbit:latest"
     ports:
       - 1885:1885
       - 4369:4369
       - 5672:5672
       - 15672:15672
       - 15674:15674
       - 25672:25672
-    env_file: ./for_docker/dev_vhost.env
-    environment:
-      - RABBITMQ_USERNAME=smqPublic
-      - RABBITMQ_PASSWORD=smqPublic
-      - RABBITMQ_SERVER_ADDITIONAL_ERL_ARGS=-rabbitmq_management load_definitions "/tmp/rabbit_definitions.json"
-    volumes:
-      - ./for_docker/dev_rabbitmq.conf:/opt/bitnami/rabbitmq/etc/rabbitmq/rabbitmq.conf:ro
-      - ./for_docker/enabled_plugins:/etc/rabbitmq/enabled_plugins

rabbit/DevRabbitArmDockerfile

@@ -0,0 +1,15 @@
+# Self-contained dev broker image for distribution via GHCR, so other repos
+# (gridworks-marketmaker, gridworks-scada, ...) can run a dev broker with NO
+# gridworks-base checkout. Built + pushed by .github/workflows/broker-image.yml
+# from the guard-checked definitions, so the image can't lag the repo.
+#
+# Build context is the REPO ROOT:
+#   docker build -f rabbit/Dockerfile -t ghcr.io/thegridelectric/dev-rabbit .
+#
+# Official multi-arch RabbitMQ (arm64 + amd64). Dev runs 4.x; the generated
+# definitions are version-agnostic.
+FROM rabbitmq:4.1-management
+
+COPY for_docker/enabled_plugins /etc/rabbitmq/enabled_plugins
+COPY for_docker/dev_rabbitmq.conf /etc/rabbitmq/rabbitmq.conf
+COPY rabbit/rabbitconfig/dev_definitions.json /etc/rabbitmq/definitions.json

rabbit/DevRabbitX86Dockerfile

@@ -0,0 +1,39 @@
+#!/bin/bash
+set -euo pipefail
+#
+# Build + push the multi-arch dev-broker image to GHCR, tagged with the git
+# commit for traceability — same convention CI uses
+# (.github/workflows/broker-image.yml). Replaces the old per-arch
+# build-dev-broker-{arm,x86}.sh: official rabbitmq is multi-arch, so one
+# buildx run produces one image for arm64 + amd64.
+#
+# Prereq: docker login ghcr.io (PAT with write:packages). Run from anywhere
+# in the repo. For a quick local-only test (no push), use instead:
+#   docker build -f rabbit/Dockerfile -t dev-rabbit-local .
+
+REPO_ROOT=$(git rev-parse --show-toplevel)
+cd "$REPO_ROOT"
+
+IMAGE="ghcr.io/thegridelectric/dev-rabbit"
+GIT_COMMIT=$(git rev-parse --short HEAD)
+DATE=$(date +'%Y%m%d')
+
+if [[ -n "$(git status --untracked-files=no --porcelain)" ]]; then
+  # uncommitted changes in tracked files — don't pin a misleading commit tag
+  TAG="chaos__dev"
+  DOCKER_ID="${IMAGE}__${GIT_COMMIT}-DIRTY__${DATE}"
+else
+  TAG="chaos__${GIT_COMMIT}__${DATE}"
+  DOCKER_ID="${IMAGE}__${GIT_COMMIT}__${DATE}"
+fi
+
+echo "Building ${IMAGE}:${TAG} (+ :latest), gridworks_docker_id=${DOCKER_ID}"
+
+docker buildx build \
+  --platform linux/amd64,linux/arm64 \
+  -f rabbit/Dockerfile \
+  -t "${IMAGE}:${TAG}" \
+  -t "${IMAGE}:latest" \
+  --label "gridworks_docker_id=${DOCKER_ID}" \
+  --push \
+  .