Skip to content

fix(ci,docker): gate docker-publish-version test to Linux, key concurrency on dispatch version (D-0204) - #1000

Merged
acamarata merged 8 commits into
mainfrom
dw9-cli-2
Oct 29, 2026
Merged

fix(ci,docker): gate docker-publish-version test to Linux, key concurrency on dispatch version (D-0204)#1000
acamarata merged 8 commits into
mainfrom
dw9-cli-2

Conversation

@acamarata

@acamarata acamarata commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

D-0204: docker-publish follow-ups from P7-HYG-06 review

What changed

  • .github/workflows/ci.yml: gated the docker-publish-version_test.sh step to ubuntu-latest only, and added steps for the concurrency and promote tests (also ubuntu only). The make contract-check gate is not re-added: nself-ci runs it via .nself/ci.yaml (D-0140).
  • .github/workflows/docker-publish.yml: the concurrency group keys on the normalised v<ver> tag for workflow_dispatch (with or without a leading v; blank input falls back to github.ref), so a dispatch and a workflow_run for the same tag serialise.
  • New promote-latest job (needs docker, runs only when docker output latest == 'true'). It sits in one shared concurrency group, docker-publish-latest, with cancel-in-progress: false, so promotions run one at a time. It logs in to Docker Hub and runs scripts/ci/docker-publish-promote.sh.
  • New scripts/ci/docker-publish-promote.sh: inside that lock it re-reads GitHub's latest release. If TAG is still latest it runs docker buildx imagetools create -t nself/nself:latest nself/nself:<ver> (no rebuild, same index digest). If not, it logs a notice and exits 0. A failed read or failed imagetools create exits 1. This stops an older release's run that finishes last from moving :latest backwards.
  • Removed unused id-token: write from the docker job.

Verification

  • bash scripts/ci/docker-publish-version_test.sh: all cases pass.
  • bash scripts/ci/docker-publish-concurrency_test.sh: asserts the group expression (dispatch keyed on normalised inputs.version, blank falls to github.ref); fails on the pre-fix expression, passes on the fix.
  • bash scripts/ci/docker-publish-promote_test.sh: stubbed gh and docker; covers promote, skip when no longer latest, failed read, failed create, missing env.
  • ci.yml parses as valid YAML.

@acamarata acamarata changed the title fix(ci,docker): wire docker-publish-version test, key concurrency on tag, drop unused id-token (D-0204) fix(ci,docker): gate docker-publish-version test to Linux, key concurrency on dispatch version (D-0204) Oct 28, 2026
@acamarata

acamarata commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator Author

Review findings fixed in fad6446:

  1. ci.yml: added if: matrix.os == 'ubuntu-latest' to the docker-publish-version test step so it no longer runs on Windows/macOS legs.
  2. docker-publish.yml: concurrency group now keys workflow_dispatch on inputs.version, so a dispatch and a workflow_run for the same tag serialise (previously the dispatch keyed on github.ref and raced).
  3. D-0204 mutants killed: added /tmp/concurrency-group-test.sh that asserts the expression contains the workflow_dispatch && inputs.version branch; verified it fails against the pre-fix expression and passes with the fix. PR title/body updated to reflect resolution.

All existing tests still pass (bash scripts/ci/docker-publish-version_test.sh: 17/17 ok).

@acamarata

acamarata commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator Author

Review findings fixed in 7bab287:

  1. docker-publish.yml concurrency: normalised dispatch input to v<ver> via startsWith/format so bare 1.4.13 matches workflow_run head_branch v1.4.13; blank input now falls through to github.ref instead of producing an empty suffix that would race. Comment updated to describe the normalisation.
  2. Committed concurrency test: added scripts/ci/docker-publish-concurrency_test.sh asserting the expression contains the dispatch-keys-on-inputs-version branch, v-prefix normalisation, and blank-input guard; wired into ci.yml near line 227 (ubuntu-latest only). Replaces the uncommitted /tmp script.
  3. Mutant-killing cases: added two cases to docker-publish-version_test.sh verifying bare 1.4.12 and v1.4.12 dispatch inputs both produce tag=v1.4.12, killing the surviving mutants from D-0204.

All tests pass: docker-publish-version_test.sh 19/19 ok, docker-publish-concurrency_test.sh 3/3 ok.

@acamarata

acamarata commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator Author

No review findings were attached, so I checked the diff independently and found one real break, fixed in 0ce3c44.

  • ci.yml: the docker-publish-version step added in a64d92f was indented 5 spaces against its 6-space siblings. The file did not parse as YAML (did not find expected key ... line 67), so the whole CI workflow would not load. The base parses fine. Re-indented.
  • docker-publish.yml: removed a stale duplicate comment line left above the concurrency group.
  • scripts/ci/docker-publish-concurrency_test.sh: now also parses ci.yml and docker-publish.yml as YAML, via ruby or python3 with PyYAML. It fails if neither is available. Against the previous ci.yml it fails with FAIL: ci.yml is not valid YAML. With the fix all cases pass, and docker-publish-version_test.sh still passes.

The branch merges cleanly with origin/main, so no rebase was needed.

@acamarata

acamarata commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator Author

Review fix (788e62a): :latest promotion moved out of the per-tag docker job into a promote-latest job in one shared concurrency group (docker-publish-latest, no cancel). scripts/ci/docker-publish-promote.sh re-reads GitHub's latest release inside that lock and skips (notice) when the tag is no longer latest, so an older run finishing late cannot move :latest backwards. Tests: docker-publish-promote_test.sh (stub gh/docker; fails with the recheck removed) and a structural case in docker-publish-concurrency_test.sh (fails against the previous workflow). Known limit: GitHub keeps one pending run per group, so a displaced pending promotion shows as cancelled; re-dispatching the release repairs it.

@acamarata

acamarata commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator Author

Rebased onto origin/main; TestPackageSizeBudget now passes (ratchet failure was due to main moving, not this branch). Force-pushed c970ab9.

@acamarata

acamarata commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator Author

Rebased onto origin/main to resolve merge conflict in .github/workflows/ci.yml. Kept both sides: D-0140 contract-check comment from main and D-0204 docker-publish-version/concurrency test steps plus contract gate from this branch. Workflow lint passes (78 files, no duplicate keys). Force-pushed to dw9-cli-2.

@acamarata

acamarata commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator Author

Review fixes: removed the re-added Contract gate (make contract-check) step and its P7-REG-10 comment from ci.yml (D-0140; nself-ci runs it via .nself/ci.yaml). PR body now names the real test script paths and describes the promote-latest job and docker-publish-promote.sh. The three docker-publish tests still pass and ci.yml parses.

@acamarata

acamarata commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator Author

nself-ci failed on go:sdk-remote-mutation. Main's #1015 moved the i < len(pairs) loop in sdk/go/remote/scan.go from line 124 to 140, so its equivalent-mutant entry in mutation-allow.txt no longer matched and the mutant counted as lived. I moved the entry to scan.go:140:16 with its reason unchanged. The allowlist did not grow and no ratchet was loosened. Locally, nself-ci --check failed before the fix on that gate alone and bash scripts/ci/sdk-remote-mutation.sh exits 0 after it. go test -mod=vendor ./... is green. The branch was already level with origin/main, so no rebase was needed.

@acamarata
fix(ci,docker): wire docker-publish-version test, key concurrency on …
429af32 
…tag, drop unused id-token (D-0204)
@acamarata
fix(ci,docker): gate docker-publish-version test to Linux, key concur…
c30f7b1 
…rency on dispatch version (D-0204)
@acamarata
fix(ci): normalise docker-publish concurrency key to v<ver> for dispa…
f697279 
…tch input

- Concurrency group now normalises bare dispatch input (e.g. 1.4.13) to
  v1.4.13 via startsWith/format so it matches workflow_run head_branch;
  blank input falls through to github.ref instead of producing an empty
  suffix that would race with other runs.
- Added scripts/ci/docker-publish-concurrency_test.sh asserting the
  expression contains the dispatch-keys-on-inputs-version branch, the
  v-prefix normalisation, and the blank-input guard; wired into ci.yml.
- Added two mutant-killing cases to docker-publish-version_test.sh
  verifying bare and v-prefixed dispatch inputs both produce tag=v<ver>.
@acamarata
fix(ci): repair mis-indented docker-publish-version step that made ci…
0e1f7f8 
….yml invalid YAML (D-0204)

The version-test step added in a64d92f was indented 5 spaces against its 6-space siblings, so GitHub could not parse ci.yml at all. Re-indent it, drop a stale duplicate comment in docker-publish.yml, and make docker-publish-concurrency_test.sh parse both workflows so this class of break fails the gate.
@acamarata
fix(ci,docker): serialise :latest promotion and recheck latest releas…
d5b17aa 
…e before writing (D-0204)
@acamarata
fix(ci): drop re-added contract-check step, nself-ci already runs it …
cf7b377 
…(D-0140)
@acamarata
fix(ci): retain pending Docker latest promotions
09b8e85
@acamarata

acamarata commented Oct 29, 2026

Copy link
Copy Markdown
Collaborator Author

Review fixes: removed the hard-coded $HOME/nself-worker/tmp from both tests (plain mktemp -d; version_test back to base for that line). Dropped the self-referential ordering block in promote_test and added a real check in docker-publish-concurrency_test.sh that promote-latest sets queue: max (verified it fails when that line is removed from the workflow, passes with it). The two D-0204 dispatch-normalisation cases in version_test are kept: they cover the concurrency-key tag output, not the temp dir.

@acamarata
acamarata merged commit 187f84f into main Oct 29, 2026
13 of 18 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@acamarata