oleks/ci-scripts
1
0
Fork 0
Code Issues 8 Pull Requests Actions Packages Projects Releases Wiki Activity

Migrate quartet repos (6) to thin multi-arch pipelines #17

New Issue
Open
opened 2026-07-05 16:35:43 +03:00 by oleks · 1 comment
oleks commented 2026-07-05 16:35:43 +03:00
Owner
Copy Link
Copy Source

xonsh-image, woodpecker-peek, csi-s3, the-eye, emdash, flake-hub onto the multi-arch plugin flow (#E). Verify by watching a real pipeline run per repo.

See Spec/Modern-CI-Target for requirements.

xonsh-image, woodpecker-peek, csi-s3, the-eye, emdash, flake-hub onto the multi-arch plugin flow (#E). Verify by watching a real pipeline run per repo. See [Spec/Modern-CI-Target](wiki/Spec/Modern-CI-Target) for requirements.
oleks added this to the Modern CI Phase 2+3 milestone 2026-07-05 16:35:43 +03:00
oleks commented 2026-07-09 19:21:24 +03:00
Author
Owner
Copy Link
Copy Source

Scope revised after the oleks/ci-scripts#20 audit. The audit gate did its job — migrating the matrix repos as-is would have broken live CI.

csi-s3 → EXCLUDE from this issue. Too bespoke; ci/local.sh does several things the plugin has no mechanism for (not mere settings gaps):

  • build-arg passthrough (GEESEFS_VERSION, REGISTRY_TOKEN for the s390x geesefs fetch — dormant now that s390x is no-build, but real)
  • two per-arch tags in one buildx invocation (:TAG-arch and :latest-arch together)
  • a skip-if-already-published idempotency check against the Gitea package API
  • plus generator gaps: render_thin_quartet.py doesn't emit the explicit_clone override (PLUGIN_TAGS:false / PLUGIN_DEPTH:1 / dedicated clone secret) or the timeout: 240 that manifests/csi-s3.yaml already carries and the thick generate.py already wires up
  • fixed pipeline-level arch: amd64 label vs the thin generator's per-arch label — changes Woodpecker agent-selection semantics
  • no CI run history exists for csi-s3 (empty pipeline list, no published container package), so its --publish path is unproven in prod

xonsh-image → BLOCKED on two bugs (filed by the issuer agent, linked to this issue):

  1. Plugin gap: ci/local.sh strips the leading v (and trailing -N) from CI_COMMIT_TAG; live git tags are v0.22.7 but published image tags are 0.22.7-amd64 etc. The plugin's buildx flows always use the raw CI_COMMIT_TAG (it unconditionally outranks PLUGIN_VERSION) — no setting reproduces the strip. Migrating today would silently rename the tag scheme on a live, consumed image. Needs an entrypoint.sh change + ci-fleet-publish bump.
  2. Generator bug: render_thin_quartet.py derives image_name from the manifest's repo: field → oleks/xonsh-image, but the real published image is oleks/xonsh. As-is it would push to a different, empty path and orphan the live image. Fix: emit an explicit image_name; audit the other manifests for the same mismatch.

Revised plan for #17:

  • Fix the two bugs above (plugin tag normalization + generator image_name).
  • Migrate xonsh-image only after both land, canary-first with a real green pipeline verifying the tag scheme is unchanged (0.22.7-<arch>).
  • Exclude csi-s3 (documented above); revisit only if someone wants to add build-args + dual-tag + idempotency mechanisms to the plugin.
  • The 4 single/split repos (the-eye, emdash, flake-hub, woodpecker-peek) are tracked in oleks/ci-scripts#19 — they don't use buildx, so none of this applies to them.

Full audit evidence: oleks/ci-scripts#20.

**Scope revised after the oleks/ci-scripts#20 audit.** The audit gate did its job — migrating the `matrix` repos as-is would have broken live CI. **csi-s3 → EXCLUDE from this issue.** Too bespoke; `ci/local.sh` does several things the plugin has *no mechanism* for (not mere settings gaps): - build-arg passthrough (`GEESEFS_VERSION`, `REGISTRY_TOKEN` for the s390x geesefs fetch — dormant now that s390x is no-build, but real) - two per-arch tags in one buildx invocation (`:TAG-arch` **and** `:latest-arch` together) - a skip-if-already-published idempotency check against the Gitea package API - plus generator gaps: `render_thin_quartet.py` doesn't emit the `explicit_clone` override (PLUGIN_TAGS:false / PLUGIN_DEPTH:1 / dedicated clone secret) or the `timeout: 240` that `manifests/csi-s3.yaml` already carries and the *thick* `generate.py` already wires up - fixed pipeline-level `arch: amd64` label vs the thin generator's per-arch label — changes Woodpecker agent-selection semantics - no CI run history exists for csi-s3 (empty pipeline list, no published container package), so its `--publish` path is unproven in prod **xonsh-image → BLOCKED on two bugs** (filed by the issuer agent, linked to this issue): 1. **Plugin gap:** `ci/local.sh` strips the leading `v` (and trailing `-N`) from `CI_COMMIT_TAG`; live git tags are `v0.22.7` but published image tags are `0.22.7-amd64` etc. The plugin's buildx flows always use the raw `CI_COMMIT_TAG` (it unconditionally outranks `PLUGIN_VERSION`) — **no setting reproduces the strip**. Migrating today would silently rename the tag scheme on a live, consumed image. Needs an `entrypoint.sh` change + `ci-fleet-publish` bump. 2. **Generator bug:** `render_thin_quartet.py` derives `image_name` from the manifest's `repo:` field → `oleks/xonsh-image`, but the real published image is **`oleks/xonsh`**. As-is it would push to a different, empty path and orphan the live image. Fix: emit an explicit `image_name`; audit the other manifests for the same mismatch. **Revised plan for #17:** - [ ] Fix the two bugs above (plugin tag normalization + generator `image_name`). - [ ] Migrate **xonsh-image** only after both land, canary-first with a real green pipeline verifying the tag scheme is unchanged (`0.22.7-<arch>`). - [ ] **Exclude csi-s3** (documented above); revisit only if someone wants to add build-args + dual-tag + idempotency mechanisms to the plugin. - [ ] The 4 `single`/`split` repos (the-eye, emdash, flake-hub, woodpecker-peek) are tracked in oleks/ci-scripts#19 — they don't use buildx, so none of this applies to them. Full audit evidence: oleks/ci-scripts#20.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Bug or defect (requires fix)
 epic:modern-ci
p1
No labels
Milestone
No items
No Milestone Modern CI Phase 2+3
Projects
Clear projects
No projects
Assignees
Clear assignees
repo-worker oleks
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: oleks/ci-scripts#17
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?