Repository navigation
packaging(ns8): address code review - multi-arch module image and workflow hardening - #136
Closed
shockalotti wants to merge 19 commits into
Closed
shockalotti wants to merge 19 commits into
shockalotti wants to merge 19 commits into
Conversation
Contributor
|
New pull request. Leaping into action... |
Contributor
Author
|
Closing this and reopening correctly. This PR was created with the wrong head content: the branch |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #102 and #135, from a code review of the NS8 packaging.
1. Module image was single-arch (high). The app image builds amd64+arm64 with qemu; the module image did not. NS8 runs modules as rootless containers on the node, so an arm64 node could not install Calnode.
build-images.shnow honoursTARGETARCHand pushes only per-arch:build-<arch>tags; newpush-manifest.shassembles the public tags. Publishing an assembled tag only, after every arch landed, means an interrupted release cannot ship a single-arch image under a version tag.2. The exec-bit guard failed open (medium). The awk added in #135 exits 0 on empty input, so a pathspec that stopped matching would pass vacuously and silently reintroduce the non-executable-script bug that made configure a no-op. Now asserts non-empty first. Verified three ways: passes on the real tree, fails loudly on an empty pathspec, fails on a 100644 entry.
3-6.
timeout-minuteson both jobs;permissions: contents: readon validate;GITHUB_TOKEN/actor/event_namemoved intoenv:instead of being interpolated intorun:;ui/node_modulescached like upstream NS8 (every PR was re-downloading the whole Vue/Carbon tree).7. Stale step-4 comment in
20configure.Also aligned
actions/checkout(v7) andsetup-qemu-action(v4) with the rest of the repo instead of diverging.Not verified: no buildah on the dev machine, so the multi-arch manifest path could not be smoke-tested locally. Needs one CI run to confirm before release. The exec-bit guard, schemas, shell and YAML all validated locally.