fh build

Compile a workspace and emit a deployment manifest, which is the artifact every deploy target consumes.

fabric-harness build [--target <target>] [options]

Compiles .fabricharness/jobs/ and .fabricharness/agents/, then emits a deployment artifact under .fabricharness/build/<target>/ with a schema-v2 manifest.json.

Build manifests use the current time during normal local development. Set the standard SOURCE_DATE_EPOCH variable to whole Unix seconds for reproducible artifacts. In GitHub Actions, TechFabric Harness automatically uses the GITHUB_SHA commit timestamp when that commit is available, so rebuilding the same source commit produces the same manifest and directory digest.

Targets

Target	Output
`node` (default)	Shared v2 Node HTTP server with finite `/jobs/:name` and persistent `/agents/:name/:id` routes.
`temporal-worker`	A worker entrypoint that registers Fabric workflows + activities against a Temporal task queue.
`docker`	`Dockerfile` + Node bundle ready for `docker build`.
`cloudflare`	Worker entrypoint, Durable Object session store, Sandbox container binding, `wrangler.jsonc`.
`foundry-hosted-agent`	`Dockerfile`, `azure.yaml`, `infra/main.bicep`, `foundry-agent.yaml`, server bundle.
`databricks-app`	Databricks App bundle, `app.yaml`, Lakebase-aware server, and Declarative Automation Bundle config.
`databricks-serving`	MLflow pyfunc proxy and Model Serving deployment assets.

The remaining targets (aks, aca, render) are listed with their capability status in Deploy targets.

Validation

Every build statically validates the workspace before emitting anything. Skill and role references, imports the chosen target's runtime cannot provide, and files in agent directories that export no definition. See fh doctor --workspace for the full check list.

An error-severity finding fails the build.

Workspace validation failed for target cloudflare:
error  .fabricharness/jobs/report.ts:1  [target-incompatible-import]
  "node:fs/promises" is not available on the cloudflare target.
  Move this work behind a tool that runs in the sandbox, or build for a target whose runtime provides it.

That artifact would previously have built cleanly and failed at runtime, after a deploy. Validation runs before any output is written, so a rejected build leaves no half-built artifact for a deploy step to pick up.

The same workspace still builds for a target whose runtime provides the import, findings are target-specific, not global. Use --validate warn to record findings as build warnings instead, or --validate off to skip the check.

Options

Flag	Description
`--out <dir>`	Override the output directory (default `.fabricharness/build/<target>`).
`--env <file>`	Load `.env`-style variables before building (e.g. `--env .env.production`). Auto-loads `.env`/`.env.local`; shell env wins.
`--no-clean`	Skip cleaning the output directory before emit.
`--validate <error\|warn\|off>`	Static workspace validation before emit. Defaults to `error`.
`--sbom`	Emit a CycloneDX SBOM via Syft when available.
`--sbom-required`	Fail if Syft is missing.
`--provenance`	Emit `provenance.json` for the build artifact.
`--attestation`	Emit `attestation.intoto.jsonl` with a manifest digest subject.
`--sign-provenance`	Sign `provenance.json` via `cosign sign-blob`. Implies `--provenance`.
`--signing-key <path\|env://VAR>`	cosign key path or env reference (default `env://COSIGN_PRIVATE_KEY`).
`--docker-build`	Run `docker build` after emitting `--target docker`.
`--docker-push`	Run `docker push` after `--docker-build`.
`--docker-tag <tag>`	Tag for the built/pushed image.
`--image-sbom`	Emit an image SBOM via Syft.
`--image-sbom-required`	Fail if image SBOM cannot be produced.

Examples

Node server artifact

fh build --target node
node .fabricharness/build/node/dist/server.mjs

Docker image with SBOM

fh build --target docker --docker-build --docker-tag myorg/agents:latest --sbom --image-sbom

Cloudflare scaffold

fh build --target cloudflare
cd .fabricharness/build/cloudflare
npm install @cloudflare/sandbox @fabric-harness/cloudflare @fabric-harness/sdk
npx wrangler dev

Foundry Hosted Agent scaffold

fh build --target foundry-hosted-agent
cd .fabricharness/build/foundry-hosted-agent
azd up

Signed provenance + attestation

export COSIGN_PRIVATE_KEY=$(cat cosign.key)
fh build --target node --provenance --sign-provenance --attestation

What's in `manifest.json`

The TechFabric Harness version and target,
separate jobs and persistent agents collections with schemas, models, and triggers,
declared sandbox backend(s),
session-store backend, if configured,
digest of the artifact,
optional provenance/attestation metadata.

createdAt is the wall-clock build time by default, the SOURCE_DATE_EPOCH time when explicitly configured, or the source commit time in GitHub Actions. It is therefore stable for protected exact-commit release rebuilds without hiding differences in any artifact file.

The CLI exposes manifests through fh builds. A Node server can read workspace-local artifacts at GET /builds/:target/manifest; Cloudflare exposes its embedded manifest at GET /manifest.

fh build

On this page