Skip to content

ci: Split RPM building into separate job #1813

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
cgwalters merged 10 commits into from
Dec 8, 2025
Merged

ci: Split RPM building into separate job #1813

cgwalters merged 10 commits into from
Dec 8, 2025

Conversation

@cgwalters
Copy link
Collaborator

@cgwalters cgwalters commented Nov 26, 2025 •
edited
Loading

This splits the RPM package building into a separate CI job that runs
before the integration tests. The built packages are then downloaded
and used by the integration test jobs, avoiding redundant builds.

Assisted-by: Claude Code (Sonnet 4.5)
Signed-off-by: Colin Walters walters@verbum.org

@bootc-bot bootc-bot bot requested a review from jmarrero November 26, 2025 15:01
@cgwalters cgwalters requested a review from henrywang November 26, 2025 15:02
@cgwalters
Copy link
Collaborator Author

cgwalters commented Nov 26, 2025

OK pushed this too early, this one has some broken bits, still iterating. But hopefully illustrates the idea

@cgwalters cgwalters force-pushed the split-buildrpm branch 2 times, most recently from 4281a51 to bb2026e Compare November 26, 2025 17:06
@henrywang
Copy link
Collaborator

henrywang commented Dec 3, 2025

Hi @cgwalters, can we land this PR? Thanks.

@cgwalters
Copy link
Collaborator Author

cgwalters commented Dec 3, 2025

/rebase

@henrywang henrywang added the needs-rebase Used by the rebase helper label Dec 3, 2025
@bootc-bot bootc-bot bot removed the needs-rebase Used by the rebase helper label Dec 3, 2025
@cgwalters
Copy link
Collaborator Author

cgwalters commented Dec 3, 2025

Hm, did the rebase bot not work?

@henrywang
Copy link
Collaborator

henrywang commented Dec 3, 2025 •
edited
Loading

Hm, did the rebase bot not work?

I'm working on a PR to grant our bot workflow write permission. We use our bot token, not github token. It should be secure.

@cgwalters
Copy link
Collaborator Author

cgwalters commented Dec 3, 2025

I'm working on a PR to grant our bot workflow write permission. We use our bot token, not github token. It should be secure.

Yep agree. That said, I think it can't be a PR, an organization admin needs to edit the bot permissions right now (unless we switch to something to git-ops it in the infra repo).

Also on this topic, while I agree workflow edit perms should be fine, we also do want to be sure we actually are careful that no code submitted as part of a pull request gets access to that bot token.

@henrywang
Copy link
Collaborator

henrywang commented Dec 4, 2025 •
edited
Loading

Granting workflow write permission to our bot is safe because rebase.yml only checks out the base repo. It's not checking out untrusted PR code — it's checking out the base repository. No attacker can inject code into that unless they already have write access.

I think we can grant our bot workflow write permission from organization admin UI.

cgwalters
cgwalters commented Dec 4, 2025
View reviewed changes
Copy link
Collaborator Author

@cgwalters cgwalters left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for helping push this forward!

I'd like to get #1809 in first though

.github/workflows/ci.yml
sudo podman build -t localhost/bootc-fsverity -f ci/Containerfile.install-fsverity
# Grant permission
sudo chown -R "$(id -u):$(id -g)" /home/runner/work/bootc/bootc
Copy link
Collaborator Author

@cgwalters cgwalters Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, we need to get these tests out of live mutating the host. There's no need for it anymore; the nested virt stuff is working well.

@henrywang
Copy link
Collaborator

henrywang commented Dec 5, 2025 •
edited
Loading

I'd like to get #1809 in first though

OK, let's land #1809 first and I'll make rebase.

cgwalters and others added 9 commits December 5, 2025 21:44
@cgwalters @henrywang
ci: Split RPM building into separate job
a011e2e 
This splits the RPM package building into a separate CI job that runs
before the integration tests. The built packages are then downloaded
and used by the integration test jobs, avoiding redundant builds.

Assisted-by: Claude Code (Sonnet 4.5)
Signed-off-by: Colin Walters <walters@verbum.org>
@henrywang
test: Fix justfile issue and add fedora-44 into test_os
6c9dabb 
Signed-off-by: Xiaofeng Wang <henrywangxf@me.com>
@henrywang
ci: Fix RPM version
5e19758 
Signed-off-by: Xiaofeng Wang <henrywangxf@me.com>
@henrywang
ci: No copy RPM package required
5ed6f98 
The download-artifact already save RPMs into target/packages/

Signed-off-by: Xiaofeng Wang <henrywangxf@me.com>
@henrywang
test: Fix composefs test image build issue
4230b89 
Signed-off-by: Xiaofeng Wang <henrywangxf@me.com>
@henrywang
ci: Fix remove target folder permission issue in Test install
a9ba594 
Signed-off-by: Xiaofeng Wang <henrywangxf@me.com>
@henrywang
test: Fix Dockerfile ARG issue
cbcd1c2 
Signed-off-by: Xiaofeng Wang <henrywangxf@me.com>
@henrywang
Justfile: Fix unbound buildroot_base issue
be74183 
Signed-off-by: Xiaofeng Wang <henrywangxf@me.com>
@henrywang
ci: Fix Permission denied error for cargo build
c4e2302 
Signed-off-by: Xiaofeng Wang <henrywangxf@me.com>
@henrywang
test: Check rpm-ostree and rpm-ostreed service status
4e1d6ad 
And collect info for flaky "error: System transaction in progress"

Signed-off-by: Xiaofeng Wang <henrywangxf@me.com>
@henrywang henrywang marked this pull request as ready for review December 8, 2025 07:08
@bootc-bot bootc-bot bot requested a review from ckyrouac December 8, 2025 07:08
@henrywang
Copy link
Collaborator

henrywang commented Dec 8, 2025 •
edited
Loading

@cgwalters, I changed this PR to ready to review. Two CS10 flaky issues should be fixed by #1817. May I approve and land (auto-merge after approve) this PR? Thanks.

@henrywang henrywang mentioned this pull request Dec 8, 2025
Merged
@cgwalters cgwalters enabled auto-merge (rebase) December 8, 2025 13:51
@cgwalters
Copy link
Collaborator Author

cgwalters commented Dec 8, 2025

Looks sane to me, but this is technically my PR, so I can't approve - please go ahead and do so!

@cgwalters cgwalters merged commit 6a9309e into main Dec 8, 2025
47 of 49 checks passed
@cgwalters cgwalters deleted the split-buildrpm branch December 8, 2025 14:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@henrywang henrywang henrywang approved these changes

@jmarrero jmarrero Awaiting requested review from jmarrero

@ckyrouac ckyrouac Awaiting requested review from ckyrouac

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@cgwalters @henrywang