From ffc5f7cad3c0744433858ff59eebb93581718d6a Mon Sep 17 00:00:00 2001 From: universe-ops Date: Sun, 8 Nov 2026 19:51:58 +0300 Subject: [PATCH] ci: stop re-downloading cosign/syft on guests that already have them MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `docker-build` called `sign-and-attest` without `install-tools`, so the input defaulted to `true` and the action ran `sigstore/cosign-installer` + `anchore/sbom-action/download-syft` unconditionally — on `pcbuild` guests whose rootfs already ships cosign v2.4.1 and syft v1.16.0 at exactly the pinned versions. `install-attest-tools` is the action that consults that preinstall (exact version match on PATH, falling through to a download on mismatch). `sign-and-attest` has no such guard. Measured in release run 41086127339, both jobs on guests that had both tools: build-platforms install-attest-tools "preinstalled: true" 0.45 s docker-build sign-and-attest downloads anyway 83.7 s 74 of those 83.7 s were a stall with no output, on the fake-IP egress the fleet design doc §5.1 records as intermittently hanging. The same path cost 7m11s in run 39402578614 and hard-failed run 40007865716 attempt 2 (`failed to install syft`), discarding a release. Nothing surfaces it: the consuming steps are continue-on-error. So add an `install-attest-tools` step to `docker-build` — the same step `build-platforms` and `docker-finalize` already have — and pass `install-tools: 'false'` to `sign-and-attest`. Same fix in `branch-preview.yaml`, whose two legs are both `heavy_go` and were paying it twice per preview build. On the hosted legs (caddy, kubectl) neither binary is present, both guards miss, and this downloads as before at ~4 s — a strict improvement on all four legs, not a fleet-only trade. This is item 2 of forge's `provisioning/firecracker-buildvm/OWED-rootfs-attest-tools.md`: the guest bake landed 2026-10-24 and was verified live, but `api` never consulted it. Signed-off-by: Ilya Sadykov --- .github/workflows/branch-preview.yaml | 21 ++++++++++++ .github/workflows/push.yaml | 47 +++++++++++++++++++++++++++ 2 files changed, 68 insertions(+) diff --git a/.github/workflows/branch-preview.yaml b/.github/workflows/branch-preview.yaml index 6b05a1c7..f870dec9 100644 --- a/.github/workflows/branch-preview.yaml +++ b/.github/workflows/branch-preview.yaml @@ -570,6 +570,23 @@ jobs: # cache. Measured cost of re-running `runtime` alone: ~34 s. no-cache-filters: runtime provenance: false + # Install cosign + syft through `install-attest-tools`, not through + # `sign-and-attest`'s own installers — only this action skips the download + # when the pinned version is already on PATH, and the fleet's buildvm + # rootfs ships cosign v2.4.1 + syft v1.16.0. Both legs here are + # `heavy_go: true`, so both land on a `pcbuild` guest that already has + # them, and every preview build was paying the download twice: measured + # 83.7 s per leg on an identical step in push.yaml (release run + # 41086127339), 74 s of it a silent stall on the fake-IP egress. Full + # reasoning, measurements and the version-lockstep rule are in the + # equivalent step in push.yaml. + - name: Install attestation tools + id: install_attest_tools + if: steps.build_and_push.outcome == 'success' + continue-on-error: true # A flaky installer must not fail the leg; the + # sub-steps below report their own outcomes to + # the warn-only aggregator. + uses: simple-container-com/actions/install-attest-tools@bfa04ded2bf29f6e84754838f4684ab9df292b42 # main # Attestation for preview images. Preview builds run the same sign + SBOM # + SLSA steps as production releases, so consumers pin-testing a # preview version (per project_sc_preview memory: PAY-SPACE pins workflows @@ -586,6 +603,10 @@ jobs: image-name: ${{ matrix.image }} subject-name: index.docker.io/${{ matrix.image_repo }} subject-digest: ${{ steps.build_and_push.outputs.digest }} + # Already installed above, through the path that honours the guest's + # preinstalled copies. Letting this action install them again is + # idempotent but re-downloads. + install-tools: 'false' # Soft-fail. push.yaml sets this too, but follows it with a gate # that fails the release; a preview has no such gate. soft-fail: 'true' diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml index 735ae965..22176714 100644 --- a/.github/workflows/push.yaml +++ b/.github/workflows/push.yaml @@ -1067,6 +1067,45 @@ jobs: # cache. Measured cost of re-running `runtime` alone: ~34 s. no-cache-filters: runtime provenance: false + # Install cosign + syft through `install-attest-tools` rather than letting + # `sign-and-attest` do it, because only this action consults the guest's + # preinstalled copies. + # + # The fleet's buildvm rootfs already ships cosign v2.4.1 and syft v1.16.0 + # at exactly the versions pinned below, and `install-attest-tools` skips + # each download when the binary on PATH reports the wanted version (an + # exact match; a mismatch falls through and installs, so a wrong + # preinstall costs one download, never a wrong tool). `sign-and-attest` + # has no such guard — it calls `sigstore/cosign-installer` and + # `anchore/sbom-action/download-syft` unconditionally. Measured in release + # run 41086127339, both on `pcbuild` guests that already had both tools: + # + # build-platforms (install-attest-tools) → "preinstalled: true" 0.45 s + # docker-build (sign-and-attest) → downloads anyway 83.7 s + # + # 83.7 s of which 74 s was a stall with no output, on the fake-IP egress + # that the fleet design doc §5.1 records as intermittently hanging. Same + # path cost 7 min 11 s in run 39402578614 and hard-failed run 40007865716 + # attempt 2 (`failed to install syft`), discarding a whole release — + # nothing surfaces it, because the consuming steps are continue-on-error. + # + # On the hosted legs (caddy, kubectl) neither binary is present, both + # guards miss, and this downloads exactly as before at ~4 s. So this is a + # strict improvement on all four legs, not a fleet-only trade. + # + # Keep the version defaults in lockstep with the action's (currently + # cosign v2.4.1 / syft v1.16.0) and with the guest bake in + # forge/provisioning/firecracker-buildvm/bake-attest-tools-into-rootfs.sh. + # A drift is safe but silently gives the saving back. + - name: Install attestation tools + id: install_attest_tools + if: steps.build_and_push.outcome == 'success' + continue-on-error: true # Same posture as build-platforms: a flaky + # installer must not fail the leg on its own. + # The sign/SBOM/SLSA steps soft-skip via their + # own outcome guards and the gate below + # reports every one of them at once. + uses: simple-container-com/actions/install-attest-tools@bfa04ded2bf29f6e84754838f4684ab9df292b42 # main # Attestation: keyless cosign sign + CycloneDX SBOM + SLSA L3 provenance. # The sub-steps stay soft so that one failure does not hide the others; # the trailing gate turns an incomplete chain into a failed release. @@ -1089,6 +1128,14 @@ jobs: image-name: ${{ matrix.image }} subject-name: index.docker.io/${{ matrix.image_repo }} subject-digest: ${{ steps.build_and_push.outputs.digest }} + # The `Install attestation tools` step above already did this, via the + # path that honours the guest's preinstalled copies. Calling the + # installers again here is idempotent but re-downloads — see the + # measurements in that step's comment. If that step flaked + # (continue-on-error), the sub-steps below fail their own version + # checks and the gate reports it; falling back to an unguarded + # download would hide the flake behind another minute of egress. + install-tools: 'false' # Kept soft so every sub-step reports its own outcome. The gate # step below is what fails the release on an incomplete chain. soft-fail: 'true'