admin/cozystack
1
0 Fork 0
mirror of https://github.com/cozystack/cozystack.git synced 2026-10-30 16:47:20 +09:00
Code Issues Packages Projects Releases Wiki Activity

ci(release): pin nightly source artifact to a digest

Browse Source 
Address review feedback from coderabbitai on .github/workflows/nightly.yaml:
the resolve step read cozystack-packages:main and the pull step re-fetched
the mutable :main tag, so a concurrent build-main push could check out commit
A while mirroring tree B. Resolve the :main digest once, derive the revision
sha from it, and pull the baked tree by that same digest.

Assisted-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
This commit is contained in:
Myasnikov DaniilandClaude Opus 4.8 committed 2026-07-06 10:03:52 +05:00
1 parent 9314540a8c
commit d233288d37
1 file changed
+13 -5
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/nightly.yaml
+13 -5
View File
@@ -48,6 +48,7 @@ jobs:
outputs:
version: ${{ steps.resolve.outputs.version }}
sha: ${{ steps.resolve.outputs.sha }}
packages_ref: ${{ steps.resolve.outputs.packages_ref }}
packages_digest: ${{ steps.publish.outputs.packages_digest }}
steps:
- name: Set up toolchain (skopeo, flux, yq, helm)
@@ -80,7 +81,12 @@ jobs:
id: resolve
run: |
set -eu
rev="$(skopeo inspect --raw "docker://${SRC_REGISTRY}/cozystack-packages:main" \
# Pin :main to its current digest first, then read the revision
# annotation and pull the baked tree from that SAME digest below, so a
# concurrent build-main push of :main cannot make us check out commit A
# while mirroring tree B.
packages_ref="$(skopeo inspect --format '{{.Digest}}' "docker://${SRC_REGISTRY}/cozystack-packages:main")"
rev="$(skopeo inspect --raw "docker://${SRC_REGISTRY}/cozystack-packages@${packages_ref}" \
| yq -r '.annotations["org.opencontainers.image.revision"] // ""' -p json 2>/dev/null || true)"
# revision is "<git-describe>:<sha>"; take the sha.
sha="${rev##*:}"
@@ -90,9 +96,10 @@ jobs:
echo "$sha" | grep -qE '^[0-9a-f]{40}$' \
|| { echo "::error::source revision '$sha' is not a 40-hex commit sha"; exit 1; }
version="0.0.0-nightly.$(date -u +%Y%m%d)"
echo "sha=$sha" >> "$GITHUB_OUTPUT"
echo "version=$version" >> "$GITHUB_OUTPUT"
echo "Resolved main build: sha=$sha version=$version"
echo "sha=$sha" >> "$GITHUB_OUTPUT"
echo "version=$version" >> "$GITHUB_OUTPUT"
echo "packages_ref=$packages_ref" >> "$GITHUB_OUTPUT"
echo "Resolved main build: sha=$sha version=$version packages_ref=$packages_ref"
- name: Checkout source commit
uses: actions/checkout@v4
@@ -101,8 +108,9 @@ jobs:
fetch-depth: 1
# Pull the digest-vendored tree build-main baked (but never committed).
# Pinned to the digest resolved above, not the mutable :main tag.
- name: Pull baked package tree
run: flux pull artifact "oci://${SRC_REGISTRY}/cozystack-packages:main" --output _baked
run: flux pull artifact "oci://${SRC_REGISTRY}/cozystack-packages@${{ steps.resolve.outputs.packages_ref }}" --output _baked
# Copy every cozystack-owned component image OCIR -> GHCR by digest and
# rewrite the baked tree's image hosts to GHCR (digests untouched).