fix(ci): publish system-tests image via S3 + GH Actions dispatch - #4065
fix(ci): publish system-tests image via S3 + GH Actions dispatch#4065MilanGarnier wants to merge 1 commit into
Conversation
|
f4dedbc to
97f2a40
Compare
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 97f2a40fe0
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6e12d4abed
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Benchmarks [ tracer ]Benchmark execution time: 2026-07-30 11:04:18 Comparing candidate commit 1cc5cf5 in PR branch Found 3 performance improvements and 2 performance regressions! Performance is the same for 189 metrics, 0 unstable metrics.
|
Standalone workflow that pulls per-branch build artifacts from S3 and pushes a multi-arch dd-library-php image so system-tests can pull it by branch slug. Lands first, before GitLab CI is wired to dispatch it, since workflow_dispatch resolves the workflow by filename against the default branch's registered workflows regardless of target ref.
6e12d4a to
1cc5cf5
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1cc5cf50d3
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| curl -fSL --retry 3 "${base}/dd-library-php-x86_64-linux-gnu.tar.gz" -o packages/amd64/dd-library-php-x86_64-linux-gnu.tar.gz | ||
| curl -fSL --retry 3 "${base}/dd-library-php-aarch64-linux-gnu.tar.gz" -o packages/arm64/dd-library-php-aarch64-linux-gnu.tar.gz |
There was a problem hiding this comment.
When system-tests consumes this image, its PHP installer searches /binaries with the glob dd-library-php-*-${ARCH}-linux-gnu.tar.gz (system-tests install script). The files written here are dd-library-php-x86_64-linux-gnu.tar.gz and dd-library-php-aarch64-linux-gnu.tar.gz, which do not have the required version/commit segment before the architecture, so the glob finds no local package and the build falls back to the latest release instead of testing the branch artifact. Preserve the original artifact filename, or rename to include any segment before ${ARCH} before copying it into the image.
Useful? React with 👍 / 👎.
| --jq '.[] | select(.metadata.container.tags == []) | "\(.id) \(.name)"' \ | ||
| | while read -r id digest; do | ||
| if grep -qxF "$digest" <<< "$keep_digests"; then |
There was a problem hiding this comment.
When another branch tag is still in use, its multi-arch child manifests are also untagged package versions, but this cleanup enumerates every untagged version in the package and only skips digests referenced by the just-pushed ${REF_SLUG} tag. A publish for branch B can therefore delete the amd64/arm64 manifests still referenced by branch A's tagged index, making system-tests pulls for branch A fail; the fresh evidence beyond the earlier thread is that the filter still selects untagged versions globally while the keep list is current-tag-only. Delete only digests known to have been superseded for this tag, or skip the global untagged cleanup.
Useful? React with 👍 / 👎.
| # the just-pushed multi-arch index's own child manifests are untagged too, so | ||
| # keep whatever digest the current tag still references. |
There was a problem hiding this comment.
With these comment lines indented deeper than the first shell command in the run: | block, YAML parsers infer the block content indentation from the comments and then reject set -euo pipefail as an unexpected key. As a result, GitHub Actions will not load or dispatch this workflow at all; move the comments above run: or indent them exactly like the shell script content.
Useful? React with 👍 / 👎.
| docker buildx build --platform linux/amd64,linux/arm64 \ | ||
| --label org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }} \ | ||
| -f Dockerfile.system-tests -t "${IMAGE}:${REF_SLUG}" --push . |
There was a problem hiding this comment.
On the first dispatch against the existing dd-trace-php/dd-library-php package, this GITHUB_TOKEN push will be rejected if that package is still the current org-scoped package: GitHub documents that GITHUB_TOKEN cannot push to a namespace that was previously published but not connected to the workflow repository, and the public package page for dd-library-php does not redirect under the repo the way the linked dd-lib-php-init package does. The source label cannot grant access until the push succeeds, so connect the existing package/add Actions access first or publish to a new linked package.
Useful? React with 👍 / 👎.
1 participant
Description
#4013 pushed the per-branch system-tests image to GHCR directly from GitLab CI, authenticating with an octo-sts token scoped
packages: write. That token is minted from a GitHub App installation, and GHCR refuses package writes from installation tokens (permission_denied: installation not allowed to Write organization package).The fix replaces that job with a two-step, two-runtime pipeline:
s3://dd-trace-php-builds/ci/<ref-slug>/, then dispatches a GitHub Actions workflow (actions: write-scoped octo-sts token). (in fix(ci): wire GitLab CI to publish the system-tests image #4079).github/workflows/publish-system-tests-image.yml(this PR) downloads the artifacts from S3 and pushes to GHCR using the workflow's nativeGITHUB_TOKEN, which — unlike the octo-sts token — is actually allowed to write org packages.Scope of this PR: only the GitHub Actions workflow file. The GitLab CI wiring (S3 upload + dispatch, plus the octo-sts policy scope change) is stacked on top in #4079, split out because
workflow_dispatchresolves a workflow by filename against the default branch's registered workflow list, regardless of therefthe dispatch targets — so this file has to land onmasterbefore the GitLab side can successfully dispatch it from any branch. Nothing calls the workflow until #4079 is merged.