fix: prevent images publication if not latest Weekly or LTS

[lemeurherve]

This change prevents the publication of images if JENKINS_VERSION is not the latest Weekly nor the latest LTS, to avoid unexpectedly republishing old tags.

In case we would need to publish an image with a JENKINS_VERSION not in https://repo.jenkins-ci.org/releases/org/jenkins-ci/main/jenkins-war/maven-metadata.xml, BYPASS_ONLY_LATEST_PUBLICATION can be set to true.

Ref:

• Thread in #jenkinsci/release gitter channel: https://matrix.to/#/!JlkqzpdEnsUUuVtjgE:matrix.org/$Umz_fnStdhmzhPD4RGasDXt8L_nIHD4jiB8wxCR-9Qg?via=matrix.org&via=gitter.im

Testing done

.ci/publish.sh

# No JENKINS_VERSION set, using the one currently defined in the repository (no exit as expected)
$ .ci/publish.sh -n 
Using the following settings:
* JENKINS_REPO: jenkins/jenkins
* JENKINS_VERSION: 2.550
* COMMIT_SHA: 37b46e7ac2ba61131f417987d566f57506d7e02f
* LATEST_WEEKLY: true
* LATEST_LTS: false
* latest_weekly_version: 2.550
* latest_lts_version: 2.541.1
* BYPASS_ONLY_LATEST_PUBLICATION: false
<snip>

# Old Weekly version
$ JENKINS_VERSION=2.123 .ci/publish.sh   
ERROR: 2.123 is neither the lastest Weekly nor the latest LTS version, not publishing any image

# Old Weekly version with bypass
$ BYPASS_ONLY_LATEST_PUBLICATION=true JENKINS_VERSION=2.123 .ci/publish.sh
WARNING: 2.123 is neither the lastest Weekly nor the latest LTS version
As BYPASS_ONLY_LATEST_PUBLICATION has been set to "true", still proceeding to its publication
Using the following settings:
* JENKINS_REPO: jenkins/jenkins
* JENKINS_VERSION: 2.123
* COMMIT_SHA: 37b46e7ac2ba61131f417987d566f57506d7e02f
* LATEST_WEEKLY: false
* LATEST_LTS: false
* latest_weekly_version: 2.550
* latest_lts_version: 2.541.1
* BYPASS_ONLY_LATEST_PUBLICATION: true
<snip>

# Old LTS version
$ JENKINS_VERSION=2.123.4 .ci/publish.sh
ERROR: 2.123.4 is neither the lastest Weekly nor the latest LTS version, not publishing any image

# Old LTS version with bypass
$ BYPASS_ONLY_LATEST_PUBLICATION=true JENKINS_VERSION=2.123.4 .ci/publish.sh
WARNING: 2.123.4 is neither the lastest Weekly nor the latest LTS version
As BYPASS_ONLY_LATEST_PUBLICATION has been set to "true", still proceeding to its publication
Using the following settings:
* JENKINS_REPO: jenkins/jenkins
* JENKINS_VERSION: 2.123.4
* COMMIT_SHA: 37b46e7ac2ba61131f417987d566f57506d7e02f
* LATEST_WEEKLY: false
* LATEST_LTS: false
* latest_weekly_version: 2.550
* latest_lts_version: 2.541.1
* BYPASS_ONLY_LATEST_PUBLICATION: true
<snip>

# Current LTS version
$ JENKINS_VERSION=2.541.1 .ci/publish.sh
Using the following settings:
* JENKINS_REPO: jenkins/jenkins
* JENKINS_VERSION: 2.541.1
* COMMIT_SHA: 61cc78de5ccbcfb230da57f1d52b2d76c7ce620e
* LATEST_WEEKLY: false
* LATEST_LTS: true
* latest_weekly_version: 2.550
* latest_lts_version: 2.541.1
* BYPASS_ONLY_LATEST_PUBLICATION: false
<snip>

./make.ps1

$ pwsh

# No JENKINS_VERSION set, using the one currently defined in the repository (no exit as expected)
PS> ./make.ps1 -Target publish                        
yq (https://github.com/mikefarah/yq/) version v4.47.1
= PREPARE: Checking if 2.550 is latest Weekly or LTS...
latest Weekly version: 2.550
latest LTS version: 2.541.1
= PREPARE: Initialize the docker compose file 'build-windows_windowsservercore-ltsc2022.yaml' containing the image definitions.
= PREPARE: Docker compose file generation for windowsservercore-ltsc2022
= PREPARE: List of images and tags to be processed:
<snip>
= PUBLISH: push all images and tags
<snip, publication>

# Old Weekly version
PS> $env:JENKINS_VERSION = "2.123"        
PS> ./make.ps1 -Target publish                        
yq (https://github.com/mikefarah/yq/) version v4.47.1
= PREPARE: Checking if 2.123 is latest Weekly or LTS...
latest Weekly version: 2.550
latest LTS version: 2.541.1
WARNING: 2.123 is neither the lastest Weekly nor the latest LTS version
= PREPARE: Initialize the docker compose file 'build-windows_windowsservercore-ltsc2022.yaml' containing the image definitions.
<snip>
= PUBLISH: push all images and tags
ERROR: 2.123 is neither the lastest Weekly nor the latest LTS version

# Old Weekly version with bypass
PS> $env:JENKINS_VERSION = "2.123"
PS> $env:BYPASS_ONLY_LATEST_PUBLICATION = $true    
PS> ./make.ps1 -Target publish                        
yq (https://github.com/mikefarah/yq/) version v4.47.1
= PREPARE: Checking if 2.123 is latest Weekly or LTS...
latest Weekly version: 2.550
latest LTS version: 2.541.1
WARNING: 2.123 is neither the lastest Weekly nor the latest LTS version
= PREPARE: Initialize the docker compose file 'build-windows_windowsservercore-ltsc2022.yaml' containing the image definitions.
<snip>
= PUBLISH: push all images and tags
WARNING: as BYPASS_ONLY_LATEST_PUBLICATION has been set to "true", still proceeding to publication
<snip, publication>

# Old LTS version
PS> $env:JENKINS_VERSION = "2.123.4"          
PS> ./make.ps1 -Target publish      
yq (https://github.com/mikefarah/yq/) version v4.47.1
= PREPARE: Checking if 2.123.4 is latest Weekly or LTS...
latest Weekly version: 2.550
latest LTS version: 2.541.1
WARNING: 2.123.4 is neither the lastest Weekly nor the latest LTS version
= PREPARE: Initialize the docker compose file 'build-windows_windowsservercore-ltsc2022.yaml' containing the image definitions.
<snip>
= PUBLISH: push all images and tags
ERROR: 2.123.4 is neither the lastest Weekly nor the latest LTS version

# Current LTS version
PS> $env:JENKINS_VERSION = "2.541.1"                  
PS> ./make.ps1 -Target publish      
yq (https://github.com/mikefarah/yq/) version v4.47.1
= PREPARE: Checking if 2.541.1 is latest Weekly or LTS...
latest Weekly version: 2.550
latest LTS version: 2.541.1
= PREPARE: Initialize the docker compose file 'build-windows_windowsservercore-ltsc2022.yaml' containing the image definitions.
<snip>
= PUBLISH: push all images and tags
<snip, publication>

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests that demonstrate the feature works or the issue is fixed

[lemeurherve]

Setting those env vars there and moved that block under the new Test-IsLatestJenkinsRelease as they will certainly help wrt #2242 (Windows images publication is not using .ci/publish.sh nor it currently has a proper equivalent)

[lemeurherve]

FWIW, I'm looking into getting rid of most of make.ps1 code by using docker buildx instead of docker compose to build Windows images, but I need to complete my initial testing first.

[timja]

Looks ok, as I said on matrix I don't think this will help much as the tags will build whats in them at the tagged time.

[lemeurherve]

Looks ok, as I said on matrix I don't think this will help much as the tags will build whats in them at the tagged time.

Indeed.

Potentially useful for future mistakes/surprises?

[lemeurherve]

Still interested in integrating some of those changes into make.ps1: the retrieval of latest Weekly & LTS from Artifactory to properly set LATEST_WEEKLY & LATEST_LTS during Windows images publication. (re #2242 that I need to fix before LTS 2.541.2).

Extracting that and the complete fix in a distinct PR.

[timja]

Potentially useful for future mistakes/surprises?

Yes it should fix it going forward but I expect the issue is from a long time ago.

[lemeurherve]

OK, merging it then.

[dduportal]

Looks ok, as I said on matrix I don't think this will help much as the tags will build whats in them at the tagged time.

+1 with Tim. The unwanted publication is a Jenkins build trigger bug and shall be fixed where the problem is (e.g. not in the pipeline and not in the tooling)

This PR does not fix anything related to unwanted publication and it will only bite us in the future by adding new corner case only for publication while we already struggle to align ci.jio and trusted.ci.jio.

I would suggest to revert this change and open a PR with only the changes which seem useful for you in regard to your work on the tooling, with explanation on the purpose.

[lemeurherve]

Looks ok, as I said on matrix I don't think this will help much as the tags will build whats in them at the tagged time.

+1 with Tim. The unwanted publication is a Jenkins build trigger bug and shall be fixed where the problem is (e.g. not in the pipeline and not in the tooling)

This PR does not fix anything related to unwanted publication and it will only bite us in the future by adding new corner case only for publication while we already struggle to align ci.jio and trusted.ci.jio.

I would suggest to revert this change and open a PR with only the changes which seem useful for you in regard to your work on the tooling, with explanation on the purpose.

All good points!

Opened #2257

I'll cherry-pick LATEST_WEEKLY & LATEST_LTS fetch from Artifactory in make.ps1 in #2255 as that fix needs this (amending #2189).

[dduportal]

I'll cherry-pick LATEST_WEEKLY & LATEST_LTS fetch from Artifactory in make.ps1 in #2255 as that fix needs this (amending #2189).

It is still not clear to me why should we need this while publication gets the version to build from its tag 🤔 Is it a CI-only thing?

[lemeurherve]

I'll cherry-pick LATEST_WEEKLY & LATEST_LTS fetch from Artifactory in make.ps1 in #2255* as that fix needs this (amending #2189* ).

It is still not clear to me why should we need this while publication gets the version to build from its tag 🤔 Is it a CI-only thing?

See #2242 (comment) 🙂