From 5858670d82c69d0ae13d1565f71486d634c536b2 Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Fri, 7 Aug 2026 07:37:01 -0700 Subject: [PATCH 1/3] ci: run workflows on the release branch --- .github/workflows/docker-build-check.yml | 4 ++-- .github/workflows/prek-check.yml | 4 ++-- .github/workflows/rust.yml | 4 ++-- .github/workflows/sdk.yaml | 4 ++-- .github/workflows/spdx-check.yml | 4 ++-- .github/workflows/vmm-ui.yml | 4 ++-- 6 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/docker-build-check.yml b/.github/workflows/docker-build-check.yml index 189a2ae59..5dc4b0566 100644 --- a/.github/workflows/docker-build-check.yml +++ b/.github/workflows/docker-build-check.yml @@ -6,9 +6,9 @@ name: Docker Build Check on: push: - branches: [ master, next, dev-* ] + branches: [ 'release/**' ] pull_request: - branches: [ master, next, dev-* ] + branches: [ 'release/**' ] env: DSTACK_REV: ${{ github.event.pull_request.head.sha || github.sha }} diff --git a/.github/workflows/prek-check.yml b/.github/workflows/prek-check.yml index a1a60394c..20e67e0ea 100644 --- a/.github/workflows/prek-check.yml +++ b/.github/workflows/prek-check.yml @@ -6,9 +6,9 @@ name: Prek checks on: push: - branches: [ master, next, dev-* ] + branches: [ 'release/**' ] pull_request: - branches: [ master, next, dev-* ] + branches: [ 'release/**' ] permissions: contents: read diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 90155c259..d8df26d12 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -6,9 +6,9 @@ name: Rust checks on: push: - branches: [ master, next, dev-* ] + branches: [ 'release/**' ] pull_request: - branches: [ master, next, dev-* ] + branches: [ 'release/**' ] env: CARGO_TERM_COLOR: always diff --git a/.github/workflows/sdk.yaml b/.github/workflows/sdk.yaml index 2372ba89e..cb4a71c61 100644 --- a/.github/workflows/sdk.yaml +++ b/.github/workflows/sdk.yaml @@ -9,9 +9,9 @@ permissions: on: push: - branches: [master, next, dev-*] + branches: ['release/**'] pull_request: - branches: [master, next, dev-*] + branches: ['release/**'] env: CARGO_TERM_COLOR: always diff --git a/.github/workflows/spdx-check.yml b/.github/workflows/spdx-check.yml index 2839a74bb..87df4efd2 100644 --- a/.github/workflows/spdx-check.yml +++ b/.github/workflows/spdx-check.yml @@ -6,9 +6,9 @@ name: SPDX License Check on: push: - branches: [ master, main ] + branches: [ 'release/**' ] pull_request: - branches: [ master, main ] + branches: [ 'release/**' ] jobs: reuse-lint: diff --git a/.github/workflows/vmm-ui.yml b/.github/workflows/vmm-ui.yml index 6b2c5c626..52a6eaaec 100644 --- a/.github/workflows/vmm-ui.yml +++ b/.github/workflows/vmm-ui.yml @@ -9,9 +9,9 @@ permissions: on: push: - branches: [ master, next, dev-* ] + branches: [ 'release/**' ] pull_request: - branches: [ master, next, dev-* ] + branches: [ 'release/**' ] jobs: build: From 14eca25775a58ee2457ef8bf3c83c049035b321e Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Fri, 7 Aug 2026 07:47:37 -0700 Subject: [PATCH 2/3] style: fix trailing whitespace in spdx-check workflow --- .github/workflows/spdx-check.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/spdx-check.yml b/.github/workflows/spdx-check.yml index 87df4efd2..9f6b5d4b2 100644 --- a/.github/workflows/spdx-check.yml +++ b/.github/workflows/spdx-check.yml @@ -13,12 +13,12 @@ on: jobs: reuse-lint: runs-on: ubuntu-latest - + steps: - name: Checkout repository uses: actions/checkout@v4 - + - name: REUSE Compliance Check uses: fsfe/reuse-action@v5 with: - args: lint \ No newline at end of file + args: lint From 8737b4781319735639359e8798d0e7c23ae4d94a Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Fri, 7 Aug 2026 08:01:58 -0700 Subject: [PATCH 3/3] fix(ci): lock snapshot for Debian 13 (trixie) base images --- build/shared/pin-packages.sh | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/build/shared/pin-packages.sh b/build/shared/pin-packages.sh index bb5bc6e27..dbc036ad0 100755 --- a/build/shared/pin-packages.sh +++ b/build/shared/pin-packages.sh @@ -22,8 +22,25 @@ if [ -z "$PKG_LIST" ]; then exit 1 fi -echo "deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/${SNAPSHOT_DATE} bookworm main" > /etc/apt/sources.list -echo "deb [check-valid-until=no] http://snapshot.debian.org/archive/debian-security/${SNAPSHOT_DATE} bookworm-security main" >> /etc/apt/sources.list +# Detect base image suite (e.g. bookworm, trixie). Different Debian releases +# ship different sources layouts (legacy sources.list vs deb822 +# sources.list.d/*.sources), so we must wipe both and rewrite from scratch +# pointing at the frozen snapshot for this exact suite. Otherwise the base +# image's default live sources stay active and packages drift on every build. +# shellcheck source=/dev/null +SUITE=$(. /etc/os-release && echo "${VERSION_CODENAME:-}") +if [ -z "$SUITE" ]; then + echo "could not detect Debian suite from /etc/os-release" >&2 + exit 1 +fi + +rm -f /etc/apt/sources.list +rm -f /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources + +cat > /etc/apt/sources.list < /etc/apt/apt.conf.d/10no-check-valid-until mkdir -p /etc/apt/preferences.d