Repository navigation
refactor(seismic)!: one release-assets target and script - #89
Merged
Merged
Conversation
`bash -n a b c` checks only `a`: bash takes the first file as the script and the rest as its arguments, so the step only ever syntax-checked mkosi.build. shellcheck parses every file it is given and reports a syntax error as one, so it alone covers what `bash -n` was meant to. scripts/seismic/*.sh replaces the list of its scripts, so a new one is checked without editing the workflow.
… says image.json used to be written by the publish job after the push, so it needed an az login to look up the storage account's ARM ID, and nothing tied it to the release assets it summarizes. It now follows them: - `make image-json` depends on `founding-inputs`, and `make release-assets` ends with it. The record names the blob the VHD will go to, in the container AZURE_CONTAINER picks, and takes the account's ARM ID from the Makefile (not a secret: every release's image.json carries it). It needs no credentials, so CI writes it in the build job, and every pull request checks it. - `make push-azure` (scripts/seismic/push_azure.sh) reads the destination from build/image.json and uploads the VHD beside it there, which makes the record true. It has no account or container settings of its own, so the two cannot disagree. The publish job no longer writes image.json, and its principal no longer needs Reader on the storage account. BREAKING CHANGE: `make push-azure` requires build/image.json (run `make release-assets` first) and ignores VHD, AZURE_STORAGE_ACCOUNT and AZURE_CONTAINER; the container is chosen at `make release-assets AZURE_CONTAINER=...`. push-azure-dev and push-azure-releases are gone.
founding-inputs and image-json were separate targets, and founding_inputs.sh and image_json.sh separate scripts, because they ran at different times (the build job and, after the push, the publish job) and in different places (the build environment, and the host for its az). Neither holds now: image.json is written with the build and needs only jq. So `make release-assets` runs one script, scripts/seismic/release_assets.sh, through the build wrapper, after `measure`. One script also drops what only the split needed: image_json.sh's check that SHA256SUMS hashes the UKI the measurements name, since the same run now writes SHA256SUMS, and its own reading of the sources.yaml pins. The wrapper does not carry the environment into the build VM, so the Makefile passes the Azure settings through `env`. In `make help`, release-assets and push-azure sit together under Seismic, and the measure targets under Measure. BREAKING CHANGE: `make founding-inputs` and `make image-json` are gone; `make release-assets` runs both steps.
A docs-only change built the image twice and, on `seismic`, published it. Pushes and pull requests that touch only docs, the other images' modules and configs, tests, lima.yaml or the other workflows now skip it. A deny-list rather than a list of the image's inputs, so a path missing from it costs a build, never a skipped one. Tooling (the Makefile, scripts/, this workflow) still builds: it shapes the release assets, and only a build tests them. Dispatch always runs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Accompanies https://github.com/SeismicSystems/deploy/pull/172
Refactor of build/release related scripts, to allow running devnet.sh against a locally built image more easily (so we can test before merging PRs).
Also cleaned up the release-assets building scripts into a single .sh script.
Only downside is that now it puts the azure blob URL in the image.json before the blob gets published (needed for CI since the first job runs without permissions, and pushing to azure is a second job with permissions). So locally one just has to run release-assets first and the npush-azure, and then can run the devnet against the local image.json file.
Merging as 4 separate PRs so see individual commits for more info.