fh build

fabric-harness build [--target <target>] [options]

Compiles .fabricharness/jobs/ and .fabricharness/agents/, then emits a deployment artifact under .fabricharness/build/<target>/ with a schema-v2 manifest.json.

Build manifests use the current time during normal local development. Set the standard SOURCE_DATE_EPOCH variable to whole Unix seconds for reproducible artifacts. In GitHub Actions, Fabric Harness automatically uses the GITHUB_SHA commit timestamp when that commit is available, so rebuilding the same source commit produces the same manifest and directory digest.

Targets

Target	Output
`node` (default)	Shared v2 Node HTTP server with finite `/jobs/:name` and persistent `/agents/:name/:id` routes.
`temporal-worker`	A worker entrypoint that registers Fabric workflows + activities against a Temporal task queue.
`docker`	`Dockerfile` + Node bundle ready for `docker build`.
`cloudflare`	Worker entrypoint, Durable Object session store, Sandbox container binding, `wrangler.jsonc`.
`foundry-hosted-agent`	`Dockerfile`, `azure.yaml`, `infra/main.bicep`, `foundry-agent.yaml`, server bundle.
`databricks-app`	Databricks App bundle, `app.yaml`, Lakebase-aware server, and Declarative Automation Bundle config.
`databricks-serving`	MLflow pyfunc proxy and Model Serving deployment assets.

Options

Flag	Description
`--out <dir>`	Override the output directory (default `.fabricharness/build/<target>`).
`--env <file>`	Load `.env`-style variables before building (e.g. `--env .env.production`). Auto-loads `.env`/`.env.local`; shell env wins.
`--no-clean`	Skip cleaning the output directory before emit.
`--sbom`	Emit a CycloneDX SBOM via Syft when available.
`--sbom-required`	Fail if Syft is missing.
`--provenance`	Emit `provenance.json` for the build artifact.
`--attestation`	Emit `attestation.intoto.jsonl` with a manifest digest subject.
`--sign-provenance`	Sign `provenance.json` via `cosign sign-blob`. Implies `--provenance`.
`--signing-key <path\|env://VAR>`	cosign key path or env reference (default `env://COSIGN_PRIVATE_KEY`).
`--docker-build`	Run `docker build` after emitting `--target docker`.
`--docker-push`	Run `docker push` after `--docker-build`.
`--docker-tag <tag>`	Tag for the built/pushed image.
`--image-sbom`	Emit an image SBOM via Syft.
`--image-sbom-required`	Fail if image SBOM cannot be produced.

Examples

Node server artifact

fh build --target node
node .fabricharness/build/node/dist/server.mjs

Docker image with SBOM

fh build --target docker --docker-build --docker-tag myorg/agents:latest --sbom --image-sbom

Cloudflare scaffold

fh build --target cloudflare
cd .fabricharness/build/cloudflare
npm install @cloudflare/sandbox @fabric-harness/cloudflare @fabric-harness/sdk
npx wrangler dev

Foundry Hosted Agent scaffold

fh build --target foundry-hosted-agent
cd .fabricharness/build/foundry-hosted-agent
azd up

Signed provenance + attestation

export COSIGN_PRIVATE_KEY=$(cat cosign.key)
fh build --target node --provenance --sign-provenance --attestation

What's in `manifest.json`

The Fabric Harness version and target,
separate jobs and persistent agents collections with schemas, models, and triggers,
declared sandbox backend(s),
session-store backend, if configured,
digest of the artifact,
optional provenance/attestation metadata.

createdAt is the wall-clock build time by default, the SOURCE_DATE_EPOCH time when explicitly configured, or the source commit time in GitHub Actions. It is therefore stable for protected exact-commit release rebuilds without hiding differences in any artifact file.

The CLI exposes manifests through fh builds. A Node server can read workspace-local artifacts at GET /builds/:target/manifest; Cloudflare exposes its embedded manifest at GET /manifest.

fh build

On this page