diff --git a/.github/workflows/build-package.yml b/.github/workflows/build-package.yml index 4558ee2..02df064 100644 --- a/.github/workflows/build-package.yml +++ b/.github/workflows/build-package.yml @@ -1,32 +1,35 @@ name: Build Package # Builds the commit under test with pkgbuild/PKGBUILD, in Arch's own -# container, validates the package and keeps it as an artifact. Pushes and -# manual runs that ask for it then hand the branch to the BigLinux package -# builders, only once that package has built and passed every check. +# container, validates the package and keeps it as an artifact. +# +# This workflow's success is what the BigLinux package builders act on: when +# a "Build Package" run of biglinux/bigamemode ends in success, they build +# its branch (on GitLab, gitlab.bigib.org/builder/packagebuilder). So it runs +# only for the branches they can build: pushes to main, testing-* and +# stable-*, and manual runs of such a branch. A failed run is not built, and +# a branch with '/' breaks their recipe, so pull requests are checked by +# package-check.yml, which calls this workflow under another name. # See docs/ci-workflows-audit.md. on: - pull_request: push: # '*' does not match '/': main, testing-*, stable-* and other plain - # branch names, which the BigLinux builders' hook has always covered. - # Topic branches (fix/…, feat/…) are built through their pull request. + # branch names. Topic branches (fix/…, feat/…) go through their pull + # request, in package-check.yml. branches: ['*'] workflow_dispatch: - inputs: - send-to-builders: - description: Hand this branch to the BigLinux package builders once the package passes - type: boolean - default: false + workflow_call: permissions: contents: read concurrency: - group: build-package-${{ github.ref }} - # A newer commit on a pull request makes the older build moot. Pushes are - # never cancelled: each one is handed to the package builders. + # github.workflow is the caller's name when package-check.yml calls this + # one, so a pull request's check never queues behind a push of its branch. + group: build-package-${{ github.workflow }}-${{ github.ref }} + # A newer commit on a pull request makes the older check moot. Pushes are + # never cancelled: each successful one is built by the BigLinux builders. cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: @@ -45,6 +48,17 @@ jobs: # tee, fails the step. shell: bash steps: + - name: Refuse a branch the BigLinux builders cannot build + # A manual "Build Package" run that succeeds is built by them too, + # and their recipe breaks on '/' in a branch name. Run + # package-check.yml on such a branch instead. + if: github.workflow == 'Build Package' && contains(github.ref_name, '/') + env: + BRANCH: ${{ github.ref_name }} + run: | + echo "::error::$BRANCH has '/' in its name: a successful Build Package run is handed to the BigLinux builders, which cannot build it. Run Package check on it instead." + exit 1 + - name: Prepare Arch environment run: | set -Eeuo pipefail @@ -331,42 +345,3 @@ jobs: package-build/build-report.md if-no-files-found: ignore retention-days: 14 - - notify-builders: - name: Hand the branch to the BigLinux package builders - needs: package - # Every push to biglinux/bigamemode, as the builders' hook always did; a - # manual run only when asked to. Never a pull request: it has no secret, - # and its code is not the branch's yet. - if: >- - github.repository == 'biglinux/bigamemode' && - (github.event_name == 'push' || - (github.event_name == 'workflow_dispatch' && inputs.send-to-builders)) - runs-on: ubuntu-24.04 - timeout-minutes: 5 - # Uses only the organization's WEBHOOK_TOKEN; no GITHUB_TOKEN permission. - permissions: {} - steps: - - name: Send repository_dispatch to BigLinux-Package-Build - shell: bash - env: - WEBHOOK_TOKEN: ${{ secrets.WEBHOOK_TOKEN }} - BRANCH: ${{ github.ref_name }} - run: | - set -Eeuo pipefail - if [[ -z "$WEBHOOK_TOKEN" ]]; then - echo "::error::the WEBHOOK_TOKEN secret is not available to this run" - exit 1 - fi - # x86_64 only (arch=('x86_64') in pkgbuild/PKGBUILD): no ARM builder. - payload=$(jq -cn --arg repo "$GITHUB_REPOSITORY" --arg branch "$BRANCH" \ - --arg url "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" \ - '{event_type: $repo, client_payload: {branch: $branch, url: $url}}') - echo "Dispatching: $payload" - # --fail-with-body: a refused token fails the run instead of passing. - curl --fail-with-body --silent --show-error --max-time 30 -X POST \ - -H 'Accept: application/vnd.github+json' \ - -H "Authorization: token $WEBHOOK_TOKEN" \ - --data "$payload" \ - https://api.github.com/repos/BigLinux-Package-Build/build-package/dispatches - echo "Branch $BRANCH handed to the BigLinux package builders." >> "$GITHUB_STEP_SUMMARY" diff --git a/.github/workflows/package-check.yml b/.github/workflows/package-check.yml new file mode 100644 index 0000000..abaa5d3 --- /dev/null +++ b/.github/workflows/package-check.yml @@ -0,0 +1,17 @@ +name: Package check + +# The package build and every check of build-package.yml, for pull requests +# and manual runs of any branch. Under this name a successful run is not +# handed to the BigLinux package builders, which act on "Build Package" +# runs only (see build-package.yml). See docs/ci-workflows-audit.md. + +on: + pull_request: + workflow_dispatch: + +permissions: + contents: read + +jobs: + package: + uses: ./.github/workflows/build-package.yml diff --git a/README.md b/README.md index c86e0dc..a5ab0b7 100644 --- a/README.md +++ b/README.md @@ -472,8 +472,9 @@ Two workflows check every pull request (details in `testing-*` and `stable-*`: a `makepkg` build of that very commit with `pkgbuild/PKGBUILD`, checked with namcap, `desktop-file-validate`, `appstreamcli` and a look at every file it installs; the package is kept as - an artifact. On a push, once all of that passes, the branch is handed to the - BigLinux package builders. + an artifact. A successful run of it is what the BigLinux package builders + build. Pull requests run the same build as `package-check.yml`, which is + not handed to them. ## Author diff --git a/docs/ci-workflows-audit.md b/docs/ci-workflows-audit.md index 1ec8dcb..aca7c87 100644 --- a/docs/ci-workflows-audit.md +++ b/docs/ci-workflows-audit.md @@ -26,7 +26,7 @@ meant. | Problem | Root cause | Fix | How it is validated | |---|---|---|---| -| Pushes to `main`, `testing-*` and `stable-*` no longer reached the BigLinux package builders. | `30cee92` replaced the hook with big-video-converter's CI build. | `notify-builders` job: on pushes to biglinux/bigamemode (or a manual run with *send-to-builders*), **after** the package has built and passed every check. Token via `env`, payload built by `jq`, `curl --fail-with-body`. | Not run from a branch on purpose; the first push to `main` after merging is the test. See *Pending*. | +| ~~Pushes to `main`, `testing-*` and `stable-*` no longer reached the BigLinux package builders.~~ **Wrong**: see *How the BigLinux builders are triggered* below. | — | The `notify-builders` job added for it is removed. | | | `if: always()` with `if-no-files-found: error` on the package upload. | Copied pattern. | The package is uploaded only on success; after a failure a separate upload keeps whatever logs exist, with `if-no-files-found: ignore`. | A failure shows one error: the step that failed. | | A change in cargo's output format could fail the backend run. | The totals parser raised an error when it found no `test result:` line. | Totals are shown in the summary only; cargo's exit status decides. | | | The first failing check hid the others (rustfmt failing skipped Clippy and the tests). | Default step semantics. | Every check runs when the setup succeeded (`!cancelled() && steps.setup.outcome == 'success'`); any failure still fails the job. | | @@ -59,13 +59,48 @@ outside CI is the test above, in `bigame-core/src/graphics/optiscaler.rs`. pull_request ─┬─► backend-tests ─── rust: fmt · clippy · test · doc · authorization · translations push main ────┤ │ - └─► build-package ─── package: prepare source of $GITHUB_SHA → makepkg -s -push main, → identify → metadata → contents → desktop -testing-*, stable-* ─────────────► → AppStream → namcap → SHA256SUMS → artifact - │ - └─► notify-builders (push / opted-in manual run only) + └─► package-check ──┐ + │ workflow_call +push main, ▼ +testing-*, stable-* ──► build-package ─── package: prepare source of $GITHUB_SHA → makepkg -s + → identify → metadata → contents → desktop + → AppStream → namcap → SHA256SUMS → artifact + │ + └─ a successful "Build Package" run: the BigLinux + builders build its branch ``` +## How the BigLinux builders are triggered + +The BigLinux builders (GitLab, `gitlab.bigib.org/builder/packagebuilder`) +build a branch of biglinux/bigamemode when a run of the workflow named +**Build Package** ends in **success**, with that run's branch. No step of the +workflow has to send anything. The builder's public job history against this +repository's runs, 2026-10-07 and 08 (UTC): + +| Build Package run | Conclusion | Builder job | +|---|---|---| +| push `main`, `testing-2026-10-07` (`72fed17`, no dispatch step), ends 07:14 / 07:16 | success | `main` 07:14, `testing-2026-10-07` 07:16 | +| push `stable-2026-10-07`, ends 12:34 | success | `stable-2026-10-07` 12:34 | +| pull requests `fix/…` (4 runs), end 14:18, 14:32, 19:34, 19:05 | success | `fix/…` at the same minutes, failing at the recipe's `sed` (the `/` ends its `s/…/…/`) | +| pushes `main`, `testing-2026-10-07-1`, `-4`, `testing-2026-10-08` | failure (`notify-builders`: 401) | none | + +So the `repository_dispatch` added on 2026-10-07 (`notify-builders`) did the +opposite of its purpose: its token is refused (401), the failed job failed the +run, and no push was built after it. Pull requests, built under the same +workflow name, were handed over instead. + +Hence: + +- **build-package.yml** ("Build Package") runs only for branches the builders + can build: pushes to plain branch names (`main`, `testing-*`, `stable-*`; + `'*'` does not match `/`) and manual runs. A manual run of a branch with `/` + fails at once, before anything is built. +- **package-check.yml** ("Package check") runs the same job for pull requests + and manual runs of any branch, through `workflow_call`. Under that name a + success is not handed over. +- There is no dispatch step and no secret. + ### backend-tests.yml: the code Runs in `archlinux:base-devel` with `--init` (the launcher's terminate test @@ -130,11 +165,9 @@ uses Arch's `rust`, always the current stable release. 11. **Artifact** `bigame-mode---`: the package, the debug package, `SHA256SUMS`, `namcap.log`, `package-info.txt`, `package-files.txt`, `build-report.md` and makepkg's logs per stage. -12. **notify-builders.** Only after all of the above, only in - biglinux/bigamemode, only for a push or a manual run that ticks - *send-to-builders*. It sends the branch name to - `BigLinux-Package-Build/build-package`. It never runs for a pull request, - which has no access to the secret. +12. **Handing over.** None in the workflow: the run's success is what the + BigLinux builders act on (see *How the BigLinux builders are + triggered*). ### namcap: what it reports today @@ -161,8 +194,7 @@ or added here. installed). A filter loose enough to be safe would save almost nothing. - **Tags and releases.** Nothing is published from CI. The BigLinux builders publish packages; the artifact is for testing. -- **Permissions.** `contents: read` at workflow level; `notify-builders` has - `permissions: {}` and only the organization's `WEBHOOK_TOKEN`. No +- **Permissions.** `contents: read` at workflow level, no secrets. No `pull_request_target`. - **Third-party actions.** Only `actions/checkout` (v7.0.1) and `actions/upload-artifact` (v7.0.1), pinned by commit. The pins were @@ -282,11 +314,10 @@ check the workflows themselves. Tested while preparing this change: in a local replay of the job in `archlinux:base-devel`, it passed with `rust-version = "1.88"`; `cargo +1.85 check` fails as described above. -- **The builders' hook runs only from `main`.** `notify-builders` cannot run - from a pull request (no secret, and on purpose). The first push to `main` - after merging is its first real run; its summary line, *Branch main handed - to the BigLinux package builders*, and the build on the BigLinux side - confirm it. +- **The builders' trigger is seen from outside only.** It was read from the + builder's public job history, not from its configuration. The first push + to `main` after this change, a successful Build Package run followed by a + `main` job on the builder, confirms it. - **`check()` duration.** About 10 of the package job's ~18 minutes are `cargo test --release` linking every test binary with fat LTO (`[profile.release]`). Testing without `--release` in `check()` would be