oleks/ci-scripts
1
0
Fork 0
Code Issues 8 Pull Requests Actions Packages Projects Releases Wiki Activity

Drift-detection pipeline #13

New Issue
Closed
opened 2026-07-05 16:35:38 +03:00 by oleks · 1 comment
oleks commented 2026-07-05 16:35:38 +03:00
Owner
Copy Link
Copy Source

A pipeline in ci-scripts (cron or push-triggered) that re-renders every manifest entry and diffs against each target repo's HEAD; on drift it opens/updates an issue in ci-scripts. Only needs to guard the thin pipelines once migration lands.

See Spec/Modern-CI-Target for requirements.

A pipeline in ci-scripts (cron or push-triggered) that re-renders every manifest entry and diffs against each target repo's HEAD; on drift it opens/updates an issue in ci-scripts. Only needs to guard the thin pipelines once migration lands. See [Spec/Modern-CI-Target](wiki/Spec/Modern-CI-Target) for requirements.
oleks added this to the Modern CI Phase 2+3 milestone 2026-07-05 16:35:38 +03:00
repo-worker commented 2026-07-05 20:23:27 +03:00
Collaborator
Copy Link
Copy Source

Drift-detection pipeline: implemented and verified

  • drift_check.py (commit 1fb1cfa): imports generate.render/render_thin directly, fetches each manifest-listed repo's live HEAD .woodpecker.yaml over the Gitea API (works from a bare ci-scripts clone — no need for local ../building/* checkouts like generate.py --check), diffs, and opens/updates a single "CI drift detected" issue on drift (auto-closes it when clean).
  • .woodpecker/drift.yaml (commit 1fb1cfa): cron + manual triggered pipeline.
  • Minted a dedicated ci_drift_token org secret (read:repository + write:issue), separate from #11's gitea_clone_token so scopes stay minimal per-purpose.
  • Registered a Woodpecker cron (ci-drift-check, daily 06:00 UTC, enabled).

Bug found and fixed during verification

First manual dispatch (pipeline #5) failed: nix shell nixpkgs#python3 nixpkgs#python3Packages.pyyaml -c python3 drift_check.py puts both derivations' binaries on PATH but doesn't link pyyaml into that python3's site-packages (classic nix shell composition gotcha) — ModuleNotFoundError: No module named 'yaml'. Fixed (commit 984a239) by switching to nix-shell -p 'python3.withPackages (ps: [ ps.pyyaml ])' --run 'python3 drift_check.py', verified locally first.

Verification

Re-dispatched the cron fresh against 984a239 → pipeline #7, success. Final log line: no drift (expected — manifest.yaml already matches every rendered .woodpecker.yaml).

Closing.

## Drift-detection pipeline: implemented and verified - `drift_check.py` (commit 1fb1cfa): imports `generate.render`/`render_thin` directly, fetches each manifest-listed repo's live HEAD `.woodpecker.yaml` over the Gitea API (works from a bare `ci-scripts` clone — no need for local `../building/*` checkouts like `generate.py --check`), diffs, and opens/updates a single "CI drift detected" issue on drift (auto-closes it when clean). - `.woodpecker/drift.yaml` (commit 1fb1cfa): cron + manual triggered pipeline. - Minted a dedicated `ci_drift_token` org secret (read:repository + write:issue), separate from #11's `gitea_clone_token` so scopes stay minimal per-purpose. - Registered a Woodpecker cron (`ci-drift-check`, daily 06:00 UTC, enabled). ### Bug found and fixed during verification First manual dispatch (pipeline #5) failed: `nix shell nixpkgs#python3 nixpkgs#python3Packages.pyyaml -c python3 drift_check.py` puts both derivations' binaries on PATH but doesn't link `pyyaml` into that `python3`'s site-packages (classic `nix shell` composition gotcha) — `ModuleNotFoundError: No module named 'yaml'`. Fixed (commit 984a239) by switching to `nix-shell -p 'python3.withPackages (ps: [ ps.pyyaml ])' --run 'python3 drift_check.py'`, verified locally first. ### Verification Re-dispatched the cron fresh against 984a239 → pipeline #7, **success**. Final log line: `no drift` (expected — manifest.yaml already matches every rendered `.woodpecker.yaml`). Closing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Bug or defect (requires fix)
 epic:modern-ci
p1
No labels
Milestone
No items
No Milestone Modern CI Phase 2+3
Projects
Clear projects
No projects
Assignees
Clear assignees
repo-worker oleks
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: oleks/ci-scripts#13
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?