From 2def214ae27ba8beeb30438c5ee823f0c9e40b5d Mon Sep 17 00:00:00 2001 From: Lio Lunesu Date: Mon, 3 Aug 2026 13:33:28 +0000 Subject: [PATCH] fix(ci): refresh-amis must dispatch the publisher, not rely on its push MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Commits pushed with GITHUB_TOKEN do not trigger workflows, so the AMI-map push never fired publish-template.yml — which watches pushes touching aws/template.yaml. The refreshed map landed on master and never reached the S3 template the 1-click Launch buttons serve. Not theoretical: 5542d8f (2026-07-06) is the only AMI bump that has ever landed, and there is no publish-template run for it — 60 runs going back to 2026-07-04, 55 push-triggered and 5 manual, none with that SHA. aws-ci.yml never validated it either. Every 1-click launch since has used a template whose AMI map was published by an unrelated merge rather than by the job that changed it. Add an explicit `gh workflow run publish-template.yml` after a successful push, gated on a step output so a no-change run stays a no-op. Needs `actions: write`. The alternative is pushing under a PAT or GitHub App so the push itself triggers downstream workflows, which would additionally give the AMI bump a review gate. Rejected for now: it re-enables workflow cascades for every job sharing that identity, and this job's output is a generated map. Worth revisiting if the bump ever needs review. publish-template.yml runs `cfn-lint aws/template.yaml` before uploading, so the dispatched run validates the map it is about to publish. No AWS cost, IAM, or networking impact. Checks run: file validated as parsing, with permissions, the new step id, and the `if:` gate confirmed to resolve. The loop itself cannot be verified until this is on master and an AMI bump lands — `workflow_dispatch` on refresh-amis is the way to force it. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01PsqGhkpjsb4kKAdVz25xKN --- .github/workflows/refresh-amis.yml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/.github/workflows/refresh-amis.yml b/.github/workflows/refresh-amis.yml index b9eeafdc..63f44e05 100644 --- a/.github/workflows/refresh-amis.yml +++ b/.github/workflows/refresh-amis.yml @@ -7,6 +7,7 @@ on: permissions: contents: write # push AMI-map bump directly to master + actions: write # dispatch publish-template.yml (see "Publish the bump" below) concurrency: group: refresh-amis @@ -24,9 +25,11 @@ jobs: run: python3 scripts/refresh_amis.py - name: Commit if changed + id: commit run: | if git diff --quiet aws/template.yaml; then echo "No AMI changes." + echo "changed=false" >> "$GITHUB_OUTPUT" exit 0 fi git config user.name 'github-actions[bot]' @@ -34,3 +37,25 @@ jobs: git add aws/template.yaml git commit -m "Refresh NixOS AMI map (25.11)" git push + echo "changed=true" >> "$GITHUB_OUTPUT" + + # Commits pushed with GITHUB_TOKEN do not trigger workflows, so the push + # above never fired publish-template.yml (which watches pushes touching + # aws/template.yaml) — the refreshed AMI map stayed on master and never + # reached the S3 template the 1-click Launch buttons serve. That is not + # theoretical: 5542d8f (2026-07-06) landed the only AMI bump so far, and + # there is no publish run for it in 60 runs going back to 2026-07-04. + # + # Dispatching explicitly closes the loop while keeping this job on + # GITHUB_TOKEN. The alternative — pushing under a PAT or GitHub App so the + # push itself triggers downstream workflows — would also give the AMI bump + # a review gate, but it re-enables workflow cascades for every job sharing + # that identity. Not worth it for a job whose output is a generated map. + # + # publish-template.yml runs `cfn-lint aws/template.yaml` before uploading, + # so the dispatched run validates the map it is about to publish. + - name: Publish the bump + if: steps.commit.outputs.changed == 'true' + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: gh workflow run publish-template.yml --ref "$GITHUB_REF_NAME"