Skip to content

Add Ubuntu 26.04 packages and release workflows for ProxySQL 3.0+ - #6518

Merged
renecannao merged 2 commits into
v3.0from
v3.0-6517
Oct 22, 2026
Merged

renecannao merged 2 commits into
v3.0from
v3.0-6517

Conversation

@renecannao

@renecannao renecannao commented Oct 21, 2026 •

Copy link
Copy Markdown
Contributor

Fixes #6517.

Add native Ubuntu 26.04 (resolute) packaging starting with ProxySQL 3.0.12, 3.1.12, and 4.0.12. Support is limited to ProxySQL 3.0 and later; no 2.x backport is included.

The change adds ubuntu26, ubuntu26-clang, and ubuntu26-dbg build targets and Compose services, includes Ubuntu 26 in the AMD64/ARM64 package aggregates, and verifies package installation using the clean ubuntu:26.04 image. Installation documentation records the supported versions and tier flags.

Package release workflows are included for all three product tiers:

  • AMD64: release, debug, and Clang packages for each tier (9 workflows).
  • ARM64: release packages for each tier (3 workflows).

Each workflow supports manual dispatch, finds or creates the branch's draft release, builds the selected package, performs the existing CI package-install verification, and uploads the package and executable checksum. They follow the existing Ubuntu 24 workflow pattern and retain the current runner versions. The automatic package-build workflow also discovers Ubuntu 26 through the updated Makefile aggregates.

Dependency: ProxySQL/docker-images#21 adds the corresponding GCC/Clang builders. Publish proxysql/packaging:build-ubuntu26-v4.0.0 and proxysql/packaging:build-clang-ubuntu26-v4.0.0 for the required architectures before running the new release workflows.

Validation:

  • Built both Ubuntu 26 AMD64 builder images successfully.
  • Built proxysql_3.0.12-ubuntu26_amd64.deb, installed it on a clean Ubuntu 26.04 container, and passed the binary startup/ELF smoke test. Local validation used host networking for container downloads and a local Compose override to expose worktree Git metadata.
  • Verified all 12 architecture/tier/variant packaging plans and Compose service resolution.
  • Package install mapping regression tests and the existing package CI verification-hook test pass.
  • All 12 release workflows pass Actionlint; their YAML, tier flags, shell scripts, draft-release creation, and artifact-upload steps were checked.
  • All 10 existing CI script tests pass; git diff --check passes.

ARM64 execution and full 3.1/4.0 package builds have not been run locally. Builder-image publication and repository package publication remain release operations.


Summary by cubic

Adds native Ubuntu 26.04 (resolute) package builds and release workflows for the ProxySQL 3.0, 3.1, and 4.0 lines, starting at 3.0.12, 3.1.12, and 4.0.12. Ubuntu 26.04 packages are only built for 3.0 and later; no 2.x backport is included.

Release workflows

  • Adds 12 manually dispatched workflows: AMD64 release, debug, and Clang packages for each tier, plus ARM64 release packages for each tier.
  • Each workflow finds or creates the draft release, builds the package, runs the existing install verification, and uploads the package and checksum.
  • Updates INSTALL.md, the AMD64/ARM64 package aggregates, docker-compose.yml, and the package-install verification mapping.

Dependency

  • Requires the Ubuntu 26.04 builder images (proxysql/packaging:build-ubuntu26-v4.0.0 and build-clang-ubuntu26-v4.0.0) from ProxySQL/docker-images PR ProxySQL needs GCC 4.7+ #21 to be published for AMD64 and ARM64 before these workflows are run.

Written for commit 86f5358. Summary will update on new commits.

View guided diff Turn on auto-fix

Summary by CodeRabbit

  • New Features

    • Added Ubuntu 26.04 package support for AMD64 and ARM64 architectures.
    • Added standard, Clang, debug, and version-specific package builds, including GenAI variants.
    • Added automated draft prerelease asset generation and upload workflows.
  • Documentation

    • Documented Ubuntu 26.04 package requirements, Docker builds, image tags, and architecture-specific naming.
  • Tests

    • Added package-install verification coverage for Ubuntu 26.04 AMD64, ARM64, debug, and Clang packages.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 21, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-21T20:22:50.108027Z 86f5358 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@coderabbitai

coderabbitai Bot commented Oct 21, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 054cefb6-4d62-4793-b4f4-4d00d762e9ae
📥 Commits

Reviewing files that changed from the base of the PR and between a0781dd and 86f5358.

📒 Files selected for processing: 17
  • .github/workflows/CI-package-amd64-ubuntu26-clang.yml
  • .github/workflows/CI-package-amd64-ubuntu26-dbg.yml
  • .github/workflows/CI-package-amd64-ubuntu26-genai-clang.yml
  • .github/workflows/CI-package-amd64-ubuntu26-genai-dbg.yml
  • .github/workflows/CI-package-amd64-ubuntu26-genai.yml
  • .github/workflows/CI-package-amd64-ubuntu26-v31-clang.yml
  • .github/workflows/CI-package-amd64-ubuntu26-v31-dbg.yml
  • .github/workflows/CI-package-amd64-ubuntu26-v31.yml
  • .github/workflows/CI-package-amd64-ubuntu26.yml
  • .github/workflows/CI-package-arm64-ubuntu26-genai.yml
  • .github/workflows/CI-package-arm64-ubuntu26-v31.yml
  • .github/workflows/CI-package-arm64-ubuntu26.yml
  • INSTALL.md
  • Makefile
  • docker-compose.yml
  • test/infra/control/test-verify-package-install.bash
  • test/infra/control/verify-package-install.bash

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout: 17
  • GitHub Check: CI-legacy-g2-genai / tests (v4.0, mysql57, coverage)
  • GitHub Check: CI-legacy-g10 / tests (v4.0, mysql57, coverage)
  • GitHub Check: CI-legacy-g1 / tests (v4.0, mysql57, coverage)
  • GitHub Check: CI-legacy-clickhouse-g1 / tests (v4.0, clickhouse23, coverage)
  • GitHub Check: CI-legacy-binlog-g1 / tests (v4.0, mysql84, coverage)
  • GitHub Check: CI-basictests / tests (v4.0, mysql57, coverage)
  • GitHub Check: CI-ai-g2 / tests (v4.0, mysql84, coverage)
  • GitHub Check: CI-ai-g1 / tests (v4.0, mysql84, coverage)
  • GitHub Check: CI-builds / builds (v4.0, coverage)
  • GitHub Check: CI / selected tiers
  • GitHub Check: macOS smoke / v40
  • GitHub Check: build / v40
  • GitHub Check: cubic · AI code reviewer
  • GitHub Check: Gitar
  • GitHub Check: lint
  • GitHub Check: run / trigger
  • GitHub Check: lint
🧰 Additional context used
🪛 checkmake (0.3.2)
Makefile

[warning] 463-463: Target "amd64-ubuntu" should be declared PHONY.

(phonydeclared)

[warning] 475-475: Target "arm64-ubuntu" should be declared PHONY.

(phonydeclared)

🪛 zizmor (1.30.1)
.github/workflows/CI-package-amd64-ubuntu26-genai.yml

[warning] 28-33: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 8-8: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level

(excessive-permissions)

[warning] 9-9: overly broad permissions (excessive-permissions): checks: write is overly broad at the workflow level

(excessive-permissions)

[error] 42-42: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

.github/workflows/CI-package-amd64-ubuntu26-genai-clang.yml

[warning] 28-33: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 8-8: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level

(excessive-permissions)

[warning] 9-9: overly broad permissions (excessive-permissions): checks: write is overly broad at the workflow level

(excessive-permissions)

[error] 42-42: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

.github/workflows/CI-package-amd64-ubuntu26-v31-dbg.yml

[warning] 28-33: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 8-8: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level

(excessive-permissions)

[warning] 9-9: overly broad permissions (excessive-permissions): checks: write is overly broad at the workflow level

(excessive-permissions)

[error] 42-42: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

.github/workflows/CI-package-amd64-ubuntu26-clang.yml

[warning] 28-33: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 8-8: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level

(excessive-permissions)

[warning] 9-9: overly broad permissions (excessive-permissions): checks: write is overly broad at the workflow level

(excessive-permissions)

[error] 42-42: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

.github/workflows/CI-package-arm64-ubuntu26-genai.yml

[warning] 28-33: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 8-8: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level

(excessive-permissions)

[warning] 9-9: overly broad permissions (excessive-permissions): checks: write is overly broad at the workflow level

(excessive-permissions)

[error] 42-42: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

.github/workflows/CI-package-amd64-ubuntu26-genai-dbg.yml

[warning] 28-33: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 8-8: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level

(excessive-permissions)

[warning] 9-9: overly broad permissions (excessive-permissions): checks: write is overly broad at the workflow level

(excessive-permissions)

[error] 42-42: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

.github/workflows/CI-package-amd64-ubuntu26-v31-clang.yml

[warning] 28-33: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 8-8: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level

(excessive-permissions)

[warning] 9-9: overly broad permissions (excessive-permissions): checks: write is overly broad at the workflow level

(excessive-permissions)

[error] 42-42: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

.github/workflows/CI-package-amd64-ubuntu26-v31.yml

[warning] 28-33: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 8-8: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level

(excessive-permissions)

[warning] 9-9: overly broad permissions (excessive-permissions): checks: write is overly broad at the workflow level

(excessive-permissions)

[error] 42-42: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

.github/workflows/CI-package-arm64-ubuntu26-v31.yml

[warning] 28-33: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 8-8: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level

(excessive-permissions)

[warning] 9-9: overly broad permissions (excessive-permissions): checks: write is overly broad at the workflow level

(excessive-permissions)

[error] 42-42: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

.github/workflows/CI-package-arm64-ubuntu26.yml

[warning] 28-33: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 8-8: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level

(excessive-permissions)

[warning] 9-9: overly broad permissions (excessive-permissions): checks: write is overly broad at the workflow level

(excessive-permissions)

[error] 42-42: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

.github/workflows/CI-package-amd64-ubuntu26.yml

[warning] 28-33: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 8-8: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level

(excessive-permissions)

[warning] 9-9: overly broad permissions (excessive-permissions): checks: write is overly broad at the workflow level

(excessive-permissions)

[error] 42-42: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

.github/workflows/CI-package-amd64-ubuntu26-dbg.yml

[warning] 28-33: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 8-8: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level

(excessive-permissions)

[warning] 9-9: overly broad permissions (excessive-permissions): checks: write is overly broad at the workflow level

(excessive-permissions)

[error] 42-42: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

🔇 Additional comments: 17
Makefile: 1

463-463: LGTM!

Also applies to: 475-475

docker-compose.yml: 1

282-306: LGTM!

test/infra/control/verify-package-install.bash: 1

76-76: LGTM!

test/infra/control/test-verify-package-install.bash: 1

77-80: LGTM!

INSTALL.md: 1

23-23: LGTM!

Also applies to: 31-35, 158-177

.github/workflows/CI-package-amd64-ubuntu26-clang.yml: 1

1-152: LGTM!

.github/workflows/CI-package-amd64-ubuntu26-dbg.yml: 1

1-152: LGTM!

.github/workflows/CI-package-amd64-ubuntu26-genai-clang.yml: 1

1-152: LGTM!

.github/workflows/CI-package-amd64-ubuntu26-genai-dbg.yml: 1

1-152: LGTM!

.github/workflows/CI-package-amd64-ubuntu26-genai.yml: 1

1-152: LGTM!

.github/workflows/CI-package-amd64-ubuntu26-v31-clang.yml: 1

1-152: LGTM!

.github/workflows/CI-package-amd64-ubuntu26-v31-dbg.yml: 1

1-152: LGTM!

.github/workflows/CI-package-amd64-ubuntu26-v31.yml: 1

1-152: LGTM!

.github/workflows/CI-package-amd64-ubuntu26.yml: 1

1-152: LGTM!

.github/workflows/CI-package-arm64-ubuntu26-genai.yml: 1

1-152: LGTM!

.github/workflows/CI-package-arm64-ubuntu26-v31.yml: 1

1-152: LGTM!

.github/workflows/CI-package-arm64-ubuntu26.yml: 1

1-152: LGTM!

📝 Walkthrough

The change adds Ubuntu 26.04 package targets for AMD64 and ARM64, including AMD64 Clang and debug variants. It adds package-install verification, Docker build configuration, installation documentation, and manually dispatched workflows that build packages and upload them to draft prereleases.

Changes: Ubuntu 26.04 package support

Layer / File(s) Summary
Package targets and local build configuration
Makefile, docker-compose.yml
The package matrices include Ubuntu 26 targets. Docker Compose adds Ubuntu 26 standard, Clang, and debug build services.
Installation checks and instructions
test/infra/control/*, INSTALL.md
Package-install verification recognizes ubuntu26 as Ubuntu 26.04 and adds AMD64, ARM64, debug, and Clang cases. The installation guide documents platform support, version availability, package naming, and Docker build instructions.
Workflow release initialization
.github/workflows/CI-package-*-ubuntu26*.yml
The AMD64 and ARM64 workflows find or create matching draft prereleases. They select the lowest matching release ID and retry when release lookup or creation does not succeed.
Package builds and publishing
.github/workflows/CI-package-*-ubuntu26*.yml
The workflows build the configured Ubuntu 26 package variants, replace same-named release assets, upload package and hash files, and report build status through GitHub Checks.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~30 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant init_release
  participant GitHubReleases
  participant build
  participant GitHubChecks
  GitHubActions->>init_release: Start with commit SHA and branch
  init_release->>GitHubReleases: Find or create matching draft prerelease
  GitHubReleases-->>init_release: Return selected release ID
  GitHubActions->>build: Start build after release initialization
  build->>GitHubChecks: Create and finalize build check
  build->>GitHubReleases: Replace and upload package and hash assets
Loading
Merge Risk: ⚪ Minimal · up to 86f53

This adds Ubuntu 26.04 package targets, manually dispatched release workflows, install verification and documentation. No concrete defect was found in the changes. Before running the workflows, make sure the Ubuntu 26 builder images are published and run an ARM64 build.

Pre-merge checks: Passed 5
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly summarizes the primary change: adding Ubuntu 26.04 packages and release workflows for ProxySQL 3.0 and later.
Linked Issues check Passed Issue #6517 requests Ubuntu 26.04 (resolute) package support. The PR adds ubuntu26, ubuntu26-clang, and ubuntu26-dbg Compose services and package aggregates. The services use the Ubuntu 26 bui…
Out of Scope Changes check Passed The changed workflows, Makefile aggregates, Compose services, installation documentation, and package-install verification changes all support the Ubuntu 26.04 packaging objective in issue #6517. The …
Docstring Coverage Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Full details: Linked Issues check

Explanation

Issue #6517 requests Ubuntu 26.04 (resolute) package support. The PR adds ubuntu26, ubuntu26-clang, and ubuntu26-dbg Compose services and package aggregates. The services use the Ubuntu 26 builder image and the required package release identifiers. The install verifier maps ubuntu26 to ubuntu:26.04, and the PR adds AMD64 and ARM64 package-install cases. The PR also adds release workflows for the 3.0, 3.1, and 4.0 tiers and documents the minimum versions. The reported native AMD64 build and clean Ubuntu 26.04 installation test support the implementation. The issue does not require a noble compatibility claim when native resolute packages are provided.

Full details: Out of Scope Changes check

Explanation

The changed workflows, Makefile aggregates, Compose services, installation documentation, and package-install verification changes all support the Ubuntu 26.04 packaging objective in issue #6517. The release initialization, checksum upload, tier flags, debug and Clang variants, and architecture coverage are supporting implementation details. The external builder-image publication and repository package publication are identified as release operations, not unrelated code changes. No unrelated change is demonstrated by the supplied change summary.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2 files. (15 skipped: 15 unsupported.)

✨ Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

A rabbit checks the build list twice,
Ubuntu packages hop in rows.
A draft release receives each file,
Hashes follow where the binaries go.
Checks turn green, and carrots grow.

Comment @coderabbitai help to get the list of available commands.

@gitar-bot

gitar-bot Bot commented Oct 21, 2026

Copy link
Copy Markdown

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

Gitar

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

26 issues found across 17 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="INSTALL.md">

<violation number="1" location="INSTALL.md:158">
P3: The target list in the Docker build section still omits `ubuntu26`, although the new paragraph below documents it. Add `ubuntu26` to that list so the two sections agree.</violation>

<violation number="2" location="INSTALL.md:158">
P2: These tier commands assume a 3.0.x version base; `PROXYSQL40=1` from `v4.0.12`, for example, produces `5.0.12`. Specify a `v3.0.x` release tag so users do not build an unintended version.</violation>

<violation number="3" location="INSTALL.md:169">
P3: The debug package does not append `-dbg` to the base filename: it is `proxysql_<version>-dbg-ubuntu26_<architecture>.deb`, while Clang uses `...-ubuntu26-clang_...`. List the exact variant patterns to avoid misleading download searches.</violation>
</file>

<file name=".github/workflows/CI-package-amd64-ubuntu26-genai-clang.yml">

<violation number="1" location=".github/workflows/CI-package-amd64-ubuntu26-genai-clang.yml:124">
P2: The asset lookup is not paginated, so on a release with more than 30 assets an existing file can be missed. The re-upload then fails instead of replacing it. Add `--paginate` to this `gh api` call, as the release lookup in `init_release` does.</violation>
</file>

<file name=".github/workflows/CI-package-arm64-ubuntu26-genai.yml">

<violation number="1" location=".github/workflows/CI-package-arm64-ubuntu26-genai.yml:19">
P3: This comment is inaccurate: the workflow-level `concurrency` block still applies to `init_release`, so the job does have a concurrency group. Either correct the comment or move the group to the job level if the intent is to exempt init.</violation>

<violation number="2" location=".github/workflows/CI-package-arm64-ubuntu26-genai.yml:67">
P2: The release-create call discards stderr (`2>&1`) and ignores its exit status, so the real API error is never logged. Drop the stderr redirect and keep `|| true` so the `gh` error appears in the job log when creation fails.</violation>

<violation number="3" location=".github/workflows/CI-package-arm64-ubuntu26-genai.yml:128">
P3: The existing asset is deleted before the replacement upload starts, so a failed upload leaves the draft release without that package. Upload the new file first, or accept that a rerun is required to restore it.</violation>
</file>

<file name=".github/workflows/CI-package-amd64-ubuntu26-dbg.yml">

<violation number="1" location=".github/workflows/CI-package-amd64-ubuntu26-dbg.yml:124">
P2: The existing-asset lookup only reads the first page of release assets (30 by default), so replacing an asset that sits beyond that page fails the upload with a duplicate-name error. Add `--paginate` to the `gh api` call so every page is searched. The same lookup is copied into the sibling package workflows.</violation>
</file>

<file name=".github/workflows/CI-package-amd64-ubuntu26-v31-clang.yml">

<violation number="1" location=".github/workflows/CI-package-amd64-ubuntu26-v31-clang.yml:124">
P2: The asset lookup does not paginate, so an existing asset past the first 30 is missed. Re-running the upload then fails with 'already_exists' instead of replacing the asset. Add `--paginate` to the `gh api .../assets` call, as the release lookup in `init_release` already does.</violation>
</file>

<file name=".github/workflows/CI-package-amd64-ubuntu26-genai.yml">

<violation number="1" location=".github/workflows/CI-package-amd64-ubuntu26-genai.yml:56">
P2: The find-or-create loop can split workers across different drafts. A worker breaks on the first matching draft it sees, but a lower-id draft from a concurrent workflow may not be visible yet. Re-check after creation until the lowest id stays stable, or fail if more than one draft exists, so all workflows converge on one release.</violation>
</file>

<file name=".github/workflows/CI-package-amd64-ubuntu26-genai-dbg.yml">

<violation number="1" location=".github/workflows/CI-package-amd64-ubuntu26-genai-dbg.yml:42">
P3: `${{ github.ref_name }}` is expanded straight into the shell script, so a branch name containing `$(...)` would execute. Pass it through an `env:` variable and reference `"$BRANCH"` instead.</violation>

<violation number="2" location=".github/workflows/CI-package-amd64-ubuntu26-genai-dbg.yml:124">
P2: The existing-asset lookup only reads the first page of assets (30 by default), so re-runs fail once the shared release has more than 30 assets. Add `--paginate` so the delete-and-replace branch finds the asset.</violation>
</file>

<file name=".github/workflows/CI-package-amd64-ubuntu26-v31-dbg.yml">

<violation number="1" location=".github/workflows/CI-package-amd64-ubuntu26-v31-dbg.yml:52">
P2: The final create in attempt 6 is never verified, so the job can fail after successfully creating the draft. Run one more lookup after the loop, or make the loop search again after the last create, before reporting the error.</violation>

<violation number="2" location=".github/workflows/CI-package-amd64-ubuntu26-v31-dbg.yml:67">
P3: The `2>&1 || true` hides why release creation failed, so the only signal is the generic error after six attempts. Keep stderr visible so the log shows the API error.</violation>

<violation number="3" location=".github/workflows/CI-package-amd64-ubuntu26-v31-dbg.yml:124">
P2: The existing-asset lookup reads only the first page of the assets API (30 items by default). On a release that already has more assets, re-runs will miss the old file and the POST will fail on the duplicate name. Add `--paginate` to this call.</violation>
</file>

<file name=".github/workflows/CI-package-arm64-ubuntu26.yml">

<violation number="1" location=".github/workflows/CI-package-arm64-ubuntu26.yml:42">
P1: This inserts the selected ref name into the Bash script, so a crafted branch name such as `$(...)` executes in the step holding `GITHUB_TOKEN`. Pass `github.ref_name` through an environment variable and use the quoted variable here and in the v31/genai workflows.</violation>

<violation number="2" location=".github/workflows/CI-package-arm64-ubuntu26.yml:67">
P3: The create call sends stdout and stderr to `/dev/null` and ignores failures, so when all six attempts fail the log has no API error. Keep stderr visible and log the failed attempt.</violation>
</file>

<file name=".github/workflows/CI-package-arm64-ubuntu26-v31.yml">

<violation number="1" location=".github/workflows/CI-package-arm64-ubuntu26-v31.yml:124">
P2: The asset lookup does not paginate, so the replace-on-rerun path fails once the shared release has more than 30 assets. Add `--paginate` so existing assets on later pages are found and deleted before upload.</violation>
</file>

<file name=".github/workflows/CI-package-amd64-ubuntu26-clang.yml">

<violation number="1" location=".github/workflows/CI-package-amd64-ubuntu26-clang.yml:67">
P3: The create call sends its stderr to /dev/null, so a permission or validation failure leaves no trace in the log. Remove the redirect so gh's error is printed. The loop also never re-lists after its final create, which is a minor logic gap.</violation>

<violation number="2" location=".github/workflows/CI-package-amd64-ubuntu26-clang.yml:124">
P2: The existing-asset lookup reads only the first page of the release's assets (30 by default). Once the release holds more than 30 assets, a re-run cannot find the asset to replace, and the duplicate upload fails. Add `--paginate` to the lookup.</violation>
</file>

<file name=".github/workflows/CI-package-amd64-ubuntu26-v31.yml">

<violation number="1" location=".github/workflows/CI-package-amd64-ubuntu26-v31.yml:53">
P2: A failing `gh api` lookup exits the step under `set -e` before the retry loop runs. Guard the substitution, for example with `|| true` or an explicit status check, so the loop can retry.</violation>

<violation number="2" location=".github/workflows/CI-package-amd64-ubuntu26-v31.yml:63">
P2: The final iteration creates a draft but never looks it up, so the step can fail after a successful create. Re-list drafts after the loop, or skip the create on the last attempt.</violation>

<violation number="3" location=".github/workflows/CI-package-amd64-ubuntu26-v31.yml:124">
P2: The existing-asset lookup is not paginated, so it only sees the first 30 assets on the shared release. Re-running for the same SHA then fails with a 422 duplicate-name error for any asset past that page. Add `--paginate` to this call.</violation>
</file>

<file name=".github/workflows/CI-package-amd64-ubuntu26.yml">

<violation number="1" location=".github/workflows/CI-package-amd64-ubuntu26.yml:42">
P1: Dispatching on a branch like `x$(id)` executes the substitution in the init job, where `GITHUB_TOKEN` has write scope; read the ref from an environment variable instead.</violation>

<violation number="2" location=".github/workflows/CI-package-amd64-ubuntu26.yml:67">
P2: The create call sends its error output to `/dev/null`, so a failing draft creation leaves no trace in the job log. Keep stderr visible and log the failed attempt so the root cause can be diagnosed.</violation>

<violation number="3" location=".github/workflows/CI-package-amd64-ubuntu26.yml:124">
P2: This lookup reads only the first 30 release assets, so rerunning a job whose asset is on a later page misses it and the replacement upload fails on the duplicate name; add `--paginate`.</violation>
</file>

Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic

run: |
set -euo pipefail
GIT_DESC=$(git describe --long --abbrev=7 --tags)
TAG_NAME="${{ github.ref_name }}-head"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: This inserts the selected ref name into the Bash script, so a crafted branch name such as $(...) executes in the step holding GITHUB_TOKEN. Pass github.ref_name through an environment variable and use the quoted variable here and in the v31/genai workflows.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/CI-package-arm64-ubuntu26.yml, line 42:

<comment>This inserts the selected ref name into the Bash script, so a crafted branch name such as `$(...)` executes in the step holding `GITHUB_TOKEN`. Pass `github.ref_name` through an environment variable and use the quoted variable here and in the v31/genai workflows.</comment>

<file context>
@@ -0,0 +1,152 @@
+      run: |
+        set -euo pipefail
+        GIT_DESC=$(git describe --long --abbrev=7 --tags)
+        TAG_NAME="${{ github.ref_name }}-head"
+        RELEASE_NAME="${TAG_NAME} - ${GIT_DESC}"
+        REPO="${{ github.repository }}"
</file context>

run: |
set -euo pipefail
GIT_DESC=$(git describe --long --abbrev=7 --tags)
TAG_NAME="${{ github.ref_name }}-head"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: Dispatching on a branch like x$(id) executes the substitution in the init job, where GITHUB_TOKEN has write scope; read the ref from an environment variable instead.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/CI-package-amd64-ubuntu26.yml, line 42:

<comment>Dispatching on a branch like `x$(id)` executes the substitution in the init job, where `GITHUB_TOKEN` has write scope; read the ref from an environment variable instead.</comment>

<file context>
@@ -0,0 +1,152 @@
+      run: |
+        set -euo pipefail
+        GIT_DESC=$(git describe --long --abbrev=7 --tags)
+        TAG_NAME="${{ github.ref_name }}-head"
+        RELEASE_NAME="${TAG_NAME} - ${GIT_DESC}"
+        REPO="${{ github.repository }}"
</file context>

Comment on lines +124 to +125
EXISTING=$(gh api "repos/${{ github.repository }}/releases/${RELEASE_ID}/assets" \
--jq ".[] | select(.name==\"${FNAME}\") | .id" | head -1)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: The asset lookup is not paginated, so on a release with more than 30 assets an existing file can be missed. The re-upload then fails instead of replacing it. Add --paginate to this gh api call, as the release lookup in init_release does.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/CI-package-amd64-ubuntu26-genai-clang.yml, line 124:

<comment>The asset lookup is not paginated, so on a release with more than 30 assets an existing file can be missed. The re-upload then fails instead of replacing it. Add `--paginate` to this `gh api` call, as the release lookup in `init_release` does.</comment>

<file context>
@@ -0,0 +1,152 @@
+        uploaded=0
+        for f in binaries/*[mb] binaries/*.id-hash; do
+          FNAME=$(basename "$f")
+          EXISTING=$(gh api "repos/${{ github.repository }}/releases/${RELEASE_ID}/assets" \
+            --jq ".[] | select(.name==\"${FNAME}\") | .id" | head -1)
+          if [ -n "$EXISTING" ]; then
</file context>
Suggested change
EXISTING=$(gh api "repos/${{ github.repository }}/releases/${RELEASE_ID}/assets" \
--jq ".[] | select(.name==\"${FNAME}\") | .id" | head -1)
EXISTING=$(gh api --paginate "repos/${{ github.repository }}/releases/${RELEASE_ID}/assets" \
--jq ".[] | select(.name==\"${FNAME}\") | .id" | head -1)

-f tag_name="${TAG_NAME}" \
-f name="${RELEASE_NAME}" \
-f target_commitish="${SHA}" \
-F draft=true -F prerelease=true >/dev/null 2>&1 || true

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: The release-create call discards stderr (2>&1) and ignores its exit status, so the real API error is never logged. Drop the stderr redirect and keep || true so the gh error appears in the job log when creation fails.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/CI-package-arm64-ubuntu26-genai.yml, line 67:

<comment>The release-create call discards stderr (`2>&1`) and ignores its exit status, so the real API error is never logged. Drop the stderr redirect and keep `|| true` so the `gh` error appears in the job log when creation fails.</comment>

<file context>
@@ -0,0 +1,152 @@
+            -f tag_name="${TAG_NAME}" \
+            -f name="${RELEASE_NAME}" \
+            -f target_commitish="${SHA}" \
+            -F draft=true -F prerelease=true >/dev/null 2>&1 || true
+          sleep $(( (RANDOM % 4) + 2 ))
+        done
</file context>

uploaded=0
for f in binaries/*[mb] binaries/*.id-hash; do
FNAME=$(basename "$f")
EXISTING=$(gh api "repos/${{ github.repository }}/releases/${RELEASE_ID}/assets" \

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: The existing-asset lookup only reads the first page of release assets (30 by default), so replacing an asset that sits beyond that page fails the upload with a duplicate-name error. Add --paginate to the gh api call so every page is searched. The same lookup is copied into the sibling package workflows.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/CI-package-amd64-ubuntu26-dbg.yml, line 124:

<comment>The existing-asset lookup only reads the first page of release assets (30 by default), so replacing an asset that sits beyond that page fails the upload with a duplicate-name error. Add `--paginate` to the `gh api` call so every page is searched. The same lookup is copied into the sibling package workflows.</comment>

<file context>
@@ -0,0 +1,152 @@
+        uploaded=0
+        for f in binaries/*[mb] binaries/*.id-hash; do
+          FNAME=$(basename "$f")
+          EXISTING=$(gh api "repos/${{ github.repository }}/releases/${RELEASE_ID}/assets" \
+            --jq ".[] | select(.name==\"${FNAME}\") | .id" | head -1)
+          if [ -n "$EXISTING" ]; then
</file context>

run: |
set -euo pipefail
GIT_DESC=$(git describe --long --abbrev=7 --tags)
TAG_NAME="${{ github.ref_name }}-head"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P3: ${{ github.ref_name }} is expanded straight into the shell script, so a branch name containing $(...) would execute. Pass it through an env: variable and reference "$BRANCH" instead.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/CI-package-amd64-ubuntu26-genai-dbg.yml, line 42:

<comment>`${{ github.ref_name }}` is expanded straight into the shell script, so a branch name containing `$(...)` would execute. Pass it through an `env:` variable and reference `"$BRANCH"` instead.</comment>

<file context>
@@ -0,0 +1,152 @@
+      run: |
+        set -euo pipefail
+        GIT_DESC=$(git describe --long --abbrev=7 --tags)
+        TAG_NAME="${{ github.ref_name }}-head"
+        RELEASE_NAME="${TAG_NAME} - ${GIT_DESC}"
+        REPO="${{ github.repository }}"
</file context>

-f tag_name="${TAG_NAME}" \
-f name="${RELEASE_NAME}" \
-f target_commitish="${SHA}" \
-F draft=true -F prerelease=true >/dev/null 2>&1 || true

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P3: The 2>&1 || true hides why release creation failed, so the only signal is the generic error after six attempts. Keep stderr visible so the log shows the API error.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/CI-package-amd64-ubuntu26-v31-dbg.yml, line 67:

<comment>The `2>&1 || true` hides why release creation failed, so the only signal is the generic error after six attempts. Keep stderr visible so the log shows the API error.</comment>

<file context>
@@ -0,0 +1,152 @@
+            -f tag_name="${TAG_NAME}" \
+            -f name="${RELEASE_NAME}" \
+            -f target_commitish="${SHA}" \
+            -F draft=true -F prerelease=true >/dev/null 2>&1 || true
+          sleep $(( (RANDOM % 4) + 2 ))
+        done
</file context>

-f tag_name="${TAG_NAME}" \
-f name="${RELEASE_NAME}" \
-f target_commitish="${SHA}" \
-F draft=true -F prerelease=true >/dev/null 2>&1 || true

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P3: The create call sends stdout and stderr to /dev/null and ignores failures, so when all six attempts fail the log has no API error. Keep stderr visible and log the failed attempt.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/CI-package-arm64-ubuntu26.yml, line 67:

<comment>The create call sends stdout and stderr to `/dev/null` and ignores failures, so when all six attempts fail the log has no API error. Keep stderr visible and log the failed attempt.</comment>

<file context>
@@ -0,0 +1,152 @@
+            -f tag_name="${TAG_NAME}" \
+            -f name="${RELEASE_NAME}" \
+            -f target_commitish="${SHA}" \
+            -F draft=true -F prerelease=true >/dev/null 2>&1 || true
+          sleep $(( (RANDOM % 4) + 2 ))
+        done
</file context>

-f tag_name="${TAG_NAME}" \
-f name="${RELEASE_NAME}" \
-f target_commitish="${SHA}" \
-F draft=true -F prerelease=true >/dev/null 2>&1 || true

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P3: The create call sends its stderr to /dev/null, so a permission or validation failure leaves no trace in the log. Remove the redirect so gh's error is printed. The loop also never re-lists after its final create, which is a minor logic gap.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/CI-package-amd64-ubuntu26-clang.yml, line 67:

<comment>The create call sends its stderr to /dev/null, so a permission or validation failure leaves no trace in the log. Remove the redirect so gh's error is printed. The loop also never re-lists after its final create, which is a minor logic gap.</comment>

<file context>
@@ -0,0 +1,152 @@
+            -f tag_name="${TAG_NAME}" \
+            -f name="${RELEASE_NAME}" \
+            -f target_commitish="${SHA}" \
+            -F draft=true -F prerelease=true >/dev/null 2>&1 || true
+          sleep $(( (RANDOM % 4) + 2 ))
+        done
</file context>

Comment thread INSTALL.md
Comment on lines +169 to +170
are named `proxysql_<version>-ubuntu26_<architecture>.deb` (with `-clang` or
`-dbg` for the corresponding variants).

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P3: The debug package does not append -dbg to the base filename: it is proxysql_<version>-dbg-ubuntu26_<architecture>.deb, while Clang uses ...-ubuntu26-clang_.... List the exact variant patterns to avoid misleading download searches.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At INSTALL.md, line 169:

<comment>The debug package does not append `-dbg` to the base filename: it is `proxysql_<version>-dbg-ubuntu26_<architecture>.deb`, while Clang uses `...-ubuntu26-clang_...`. List the exact variant patterns to avoid misleading download searches.</comment>

<file context>
@@ -151,6 +155,27 @@ Install the package as usual on the target system.
+
+The `ubuntu26-clang` and `ubuntu26-dbg` targets build Clang and debug packages
+on AMD64. ARM64 release packages use `ubuntu26` on an ARM64 host. Packages
+are named `proxysql_<version>-ubuntu26_<architecture>.deb` (with `-clang` or
+`-dbg` for the corresponding variants).
+
</file context>
Suggested change
are named `proxysql_<version>-ubuntu26_<architecture>.deb` (with `-clang` or
`-dbg` for the corresponding variants).
are named `proxysql_<version>-ubuntu26_<architecture>.deb`; Clang and debug variants use
`proxysql_<version>-ubuntu26-clang_<architecture>.deb` and `proxysql_<version>-dbg-ubuntu26_<architecture>.deb`, respectively.

@sonarqubecloud

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

@codecov

codecov Bot commented Oct 21, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.64%. Comparing base (a0781dd) to head (86f5358).

Additional details and impacted files
@@            Coverage Diff             @@
##             v3.0    #6518      +/-   ##
==========================================
+ Coverage   65.77%   66.64%   +0.86%     
==========================================
  Files         754      755       +1     
  Lines      217143   217934     +791     
  Branches    55085    55302     +217     
==========================================
+ Hits       142824   145234    +2410     
+ Misses      48454    46315    -2139     
- Partials    25865    26385     +520     
Flag Coverage Δ
integration-tests 60.15% <ø> (-0.03%) ⬇️
simulation-tests 23.67% <ø> (?)
unit-tests 36.33% <ø> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renecannao
renecannao merged commit 8b23f48 into v3.0 Oct 22, 2026
115 of 121 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Packages for Ubuntu 26.04 (resolute)

1 participant