Skip to content

packaging(ns8): fix manifest add arity, drop bad rm flag, and selftest the path #139

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shockalotti merged 2 commits into from
Oct 14, 2026
Merged

packaging(ns8): fix manifest add arity, drop bad rm flag, and selftest the path #139

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
20ec8a3
packaging(ns8): fix manifest add arity, drop bad rm flag, and selftes…
shockalotti Oct 14, 2026
52ae44b
packaging(ns8): restore the validate checks to the right step
shockalotti Oct 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions .github/workflows/ns8-module.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,26 @@ jobs:
fi
echo "$scripts" | awk '$1!="100755" {print "not executable in index:", $4; bad=1} END{exit bad}'

# Run the real push-manifest.sh end to end against a scratch storage and
# an oci: destination, so no registry and no credentials are needed. PR
# builds push nothing, which means the manifest step is skipped on PRs and
# a green run says nothing about it. Both earlier publish failures (a bad
# subcommand, then a bad argument count) lived in that step and only
# surfaced on a release push, so exercise it here instead.
# push-manifest.sh refuses to publish a list that is missing an arch, so a
# clean exit is the assertion.
- name: Selftest the multi-arch manifest assembly
Comment thread
pullfrog[bot] marked this conversation as resolved.
run: |
set -euo pipefail
tmp=$(mktemp -d)
buildah from --name ocr-selftest-amd64 --arch amd64 scratch >/dev/null
buildah commit ocr-selftest-amd64 ocr-selftest/ns8-calnode:build-amd64 >/dev/null
buildah from --name ocr-selftest-arm64 --arch arm64 scratch >/dev/null
buildah commit ocr-selftest-arm64 ocr-selftest/ns8-calnode:build-arm64 >/dev/null
REPOBASE=ocr-selftest TARGETARCHES="amd64 arm64" IMAGETAGS=selftest \
PUSH_DESTINATION="oci:${tmp}/out" bash packaging/ns8/push-manifest.sh
echo "manifest selftest OK"

build:
needs: validate
runs-on: ubuntu-latest
Expand Down
23 changes: 17 additions & 6 deletions packaging/ns8/push-manifest.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,9 @@
# REPOBASE module image namespace, default ghcr.io/calnode
# TARGETARCHES space-separated arches to assemble, required
# IMAGETAGS space-separated tags to publish, default "latest"
# PUSH_DESTINATION push target override, default docker://<tag>. Set to an
# oci: path to exercise the whole script with no registry,
# which is what the CI selftest does.
#
# Example:
# TARGETARCHES="amd64 arm64" IMAGETAGS="1.2.3 1.2 latest" bash push-manifest.sh
Expand Down Expand Up @@ -48,15 +51,23 @@ done
for imagetag in "${imagetags[@]}"; do
manifest="${repobase}/${reponame}:${imagetag}"
# Drop any stale manifest so a retry cannot inherit old entries.
buildah manifest rm --all "${manifest}" 2>/dev/null || true
buildah manifest rm "${manifest}" 2>/dev/null || true
buildah manifest create "${manifest}"
for arch in "${arches[@]}"; do
buildah manifest add \
"${manifest}" \
"${repobase}/${reponame}:build-${arch}" \
"docker.io/calnode/ns8-calnode:${imagetag}-${arch}"
# Exactly two arguments: buildah 5.x takes only the list and the

@pullfrog pullfrog Bot Oct 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: buildah releases are all 1.x (latest 1.45.2), so 5.x here reads as a transposition of the 1.39.x version quoted in the PR description. Worth correcting so the arity note points at a version that exists.

# image, with no instance-name argument.
buildah manifest add "${manifest}" "${repobase}/${reponame}:build-${arch}"
done
buildah manifest push --all "${manifest}" "docker://${manifest}"
# Refuse to publish a partial manifest. If any arch silently failed to
# join the list, an arm64 node would get an image it cannot run.
count=$(buildah manifest inspect "${manifest}" | grep -c '"architecture"')
if [ "$count" -ne "${#arches[@]}" ]; then
echo "Refusing to publish ${manifest}: it holds ${count} arches," \
"expected ${#arches[*]}" >&2
buildah manifest rm "${manifest}" 2>/dev/null || true
exit 1
fi
buildah manifest push --all "${manifest}" "${PUSH_DESTINATION:-docker://${manifest}}"
buildah manifest rm "${manifest}"
echo "Published ${manifest} (${arches[*]})"
done
Loading