Skip to content

Commit 13a77aa

Browse files
lexfreilexfrei
committed
ci(release): pin flux where the release pushes the packages artifact
prepare-release now runs flux push artifact to publish the rc's packages artifact, and it installed whatever flux was latest, while build-amd64 and the candidate checks pin one version. It installs that version now. The arm64 leg and the nightly never run flux, so they no longer install it. The rc-e2e comment gave a stable tag as the reason for its !cancelled(), but the job only runs for an rc; it now says it follows the rule every job below build-arm64 has. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <[email protected]>
1 parent 70a555d commit 13a77aa

3 files changed

Lines changed: 17 additions & 8 deletions

File tree

‎.github/workflows/build-arm64-nightly.yaml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,6 @@ jobs:
5151

5252
- name: Set up build toolchain
5353
run: |
54-
command -v flux >/dev/null \
55-
|| curl -fsSL https://fluxcd.io/install.sh | sudo bash
5654
command -v skopeo >/dev/null \
5755
|| { sudo apt-get update -qq && sudo apt-get install -y -qq skopeo; }
5856
command -V docker jq yq skopeo

‎.github/workflows/tags.yaml‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -67,8 +67,6 @@ jobs:
6767
- name: Set up build toolchain
6868
if: steps.check_release.outputs.release_exists == 'false'
6969
run: |
70-
command -v flux >/dev/null \
71-
|| curl -fsSL https://fluxcd.io/install.sh | sudo bash
7270
command -V docker jq yq
7371
yq --version | grep -q mikefarah
7472
@@ -422,9 +420,15 @@ jobs:
422420
# the tree with mikefarah yq; the republish needs flux and helm.
423421
- name: Set up build toolchain
424422
if: needs.build-amd64.outputs.release_exists == 'false'
423+
env:
424+
FLUX_VERSION: "2.8.6"
425425
run: |
426-
command -v flux >/dev/null \
427-
|| curl -fsSL https://fluxcd.io/install.sh | sudo bash
426+
if ! flux version --client 2>/dev/null | grep -Fqx "flux: v${FLUX_VERSION}"; then
427+
install_script="$(mktemp)"
428+
curl -fsSL https://fluxcd.io/install.sh -o "$install_script"
429+
sudo env "FLUX_VERSION=$FLUX_VERSION" bash "$install_script"
430+
rm -f "$install_script"
431+
fi
428432
command -v skopeo >/dev/null \
429433
|| { sudo apt-get update -qq && sudo apt-get install -y -qq skopeo; }
430434
command -V skopeo jq yq helm
@@ -607,8 +611,9 @@ jobs:
607611
rc-e2e:
608612
name: E2E Release Candidate
609613
needs: prepare-release
610-
# !cancelled(): a stable tag skips build-arm64, and a skipped ancestor
611-
# makes the implicit success() false.
614+
# !cancelled(): every job below build-arm64 carries a status function,
615+
# since a stable tag skips build-arm64. This one only runs for an rc,
616+
# where build-arm64 always runs, so here it just follows that rule.
612617
if: ${{ !cancelled() && needs.prepare-release.result == 'success' && contains(github.ref_name, '-rc.') }}
613618
# A caller's permissions are the ceiling for every job in the called
614619
# workflow, and GitHub validates that ceiling STATICALLY, when it creates the

‎hack/stitch-multiarch_test.bats‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -373,6 +373,12 @@ _make_world() {
373373
tool=$(yq -r '.jobs.prepare-release.steps[] | select(.name == "Set up build toolchain") | .run' "$wf")
374374
echo "$tool" | grep -q skopeo
375375
echo "$tool" | grep -q 'yq --version | grep -q mikefarah'
376+
# prepare-release pushes the packages artifact with flux, so it installs the
377+
# same flux build-amd64 does rather than whatever is latest.
378+
echo "$tool" | grep -qF 'grep -Fqx "flux: v${FLUX_VERSION}"'
379+
want=$(yq -r '.jobs.build-amd64.steps[] | select(.name == "Set up build toolchain") | .env.FLUX_VERSION' "$wf")
380+
[ -n "$want" ] && [ "$want" != null ]
381+
[ "$(yq -r '.jobs.prepare-release.steps[] | select(.name == "Set up build toolchain") | .env.FLUX_VERSION' "$wf")" = "$want" ]
376382
}
377383

378384
@test "the amd64 release job rebuilds matchbox as a two-arch index before it captures the tree" {

0 commit comments

Comments
 (0)