Skip to content

Commit 39f29b5

Browse files
rbarker-devrbarker-dev
authored
ci(workflows-fix): Determinism checks failing python setup for debian (cp #23350) (#23882)
Signed-off-by: Roger Barker <roger.barker@swirldslabs.com>
1 parent d0e1eb9 commit 39f29b5

4 files changed

Lines changed: 74 additions & 74 deletions

File tree

‎.github/workflows/flow-artifact-determinism.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,5 +72,6 @@ jobs:
7272
java-distribution: ${{ inputs.java-distribution || 'temurin' }}
7373
java-version: ${{ inputs.java-version || '21.0.6' }}
7474
secrets:
75+
github-token: ${{ secrets.GITHUB_TOKEN }}
7576
gradle-cache-username: ${{ secrets.GRADLE_CACHE_USERNAME }}
7677
gradle-cache-password: ${{ secrets.GRADLE_CACHE_PASSWORD }}

‎.github/workflows/zxc-mats-tests.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -279,6 +279,7 @@ jobs:
279279
java-version: ${{ inputs.java-version || '21.0.6' }}
280280
java-distribution: ${{ inputs.java-distribution || 'temurin' }}
281281
secrets:
282+
github-token: ${{ secrets.access-token }}
282283
gradle-cache-username: ${{ secrets.gradle-cache-username }}
283284
gradle-cache-password: ${{ secrets.gradle-cache-password }}
284285

@@ -294,6 +295,7 @@ jobs:
294295
java-version: ${{ inputs.java-version || '21.0.6' }}
295296
java-distribution: ${{ inputs.java-distribution || 'temurin' }}
296297
secrets:
298+
github-token: ${{ secrets.access-token }}
297299
gradle-cache-username: ${{ secrets.gradle-cache-username }}
298300
gradle-cache-password: ${{ secrets.gradle-cache-password }}
299301

‎.github/workflows/zxc-verify-docker-build-determinism.yaml‎

Lines changed: 35 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ on:
2020
default: "21.0.6"
2121

2222
secrets:
23+
github-token:
24+
description: "GitHub Token with permissions to checkout the repository."
25+
required: true
2326
gradle-cache-username:
2427
description: "The username used to authenticate with the Gradle Build Cache Node."
2528
required: true
@@ -58,15 +61,18 @@ jobs:
5861
name: ${{ steps.baseline.outputs.name }}
5962

6063
steps:
61-
- name: Harden Runner
62-
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
63-
with:
64-
egress-policy: audit
65-
66-
- name: Checkout Code
67-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
64+
- name: Prepare Job
65+
uses: pandaswhocode/initialize-github-job@a57cd6d8d768b2f3c95334bdd4fa8c21609fc651 # v1.0.5
6866
with:
69-
ref: ${{ inputs.ref }}
67+
checkout: "true"
68+
checkout-ref: "${{ inputs.ref }}"
69+
checkout-token: "${{ secrets.github-token }}"
70+
checkout-fetch-depth: "1"
71+
setup-java: "true"
72+
java-distribution: "${{ inputs.java-distribution }}"
73+
java-version: "${{ inputs.java-version }}"
74+
setup-gradle: "true"
75+
gradle-cache-read-only: "false"
7076

7177
- name: Authenticate to Google Cloud
7278
id: google-auth
@@ -102,19 +108,6 @@ jobs:
102108
echo "name=${BASELINE_NAME}" >> "${GITHUB_OUTPUT}"
103109
echo "file=${BASELINE_FILE}" >> "${GITHUB_OUTPUT}"
104110
105-
- name: Setup Java
106-
uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
107-
if: ${{ steps.baseline.outputs.exists == 'false' && !failure() && !cancelled() }}
108-
with:
109-
distribution: ${{ inputs.java-distribution }}
110-
java-version: ${{ inputs.java-version }}
111-
112-
- name: Setup Gradle
113-
uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
114-
if: ${{ steps.baseline.outputs.exists == 'false' && !failure() && !cancelled() }}
115-
with:
116-
cache-disabled: true
117-
118111
- name: Install Skopeo and JQ
119112
if: ${{ steps.baseline.outputs.exists == 'false' && !failure() && !cancelled() }}
120113
run: |
@@ -224,25 +217,35 @@ jobs:
224217
- hl-cn-docker-determinism-lin-u24-lg
225218
- hl-cn-docker-determinism-lin-d12-lg
226219
steps:
227-
- name: Harden Runner
228-
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
229-
with:
230-
egress-policy: audit
231-
232220
- name: Standardize Git Line Endings
233221
run: |
234222
git config --global core.autocrlf false
235223
git config --global core.eol lf
236224
237-
- name: Checkout Code
238-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
225+
- name: Prepare Job
226+
uses: pandaswhocode/initialize-github-job@a57cd6d8d768b2f3c95334bdd4fa8c21609fc651 # v1.0.5
239227
with:
240-
ref: ${{ inputs.ref }}
228+
checkout: "true"
229+
checkout-ref: "${{ inputs.ref }}"
230+
checkout-token: "${{ secrets.github-token }}"
231+
checkout-fetch-depth: "1"
232+
setup-java: "true"
233+
java-distribution: "${{ inputs.java-distribution }}"
234+
java-version: "${{ inputs.java-version }}"
235+
setup-gradle: "true"
236+
gradle-cache-read-only: "false"
237+
238+
- name: Install Python (Linux)
239+
if: ${{ runner.os == 'Linux' }}
240+
run: |
241+
sudo apt-get update
242+
sudo apt-get install --yes --no-install-recommends python3 python3-venv python3-pip
241243
242-
- name: Setup Python
243-
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
244+
- name: Install Python
245+
if: ${{ runner.os != 'Linux' }}
246+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
244247
with:
245-
python-version: 3.9
248+
python-version: "3.12"
246249

247250
- name: Install JQ (Linux)
248251
if: ${{ runner.os == 'Linux' }}

‎.github/workflows/zxc-verify-gradle-build-determinism.yaml‎

Lines changed: 36 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ on:
2020
default: "21.0.6"
2121

2222
secrets:
23+
github-token:
24+
description: "GitHub Token with permissions to checkout the repository."
25+
required: true
2326
gradle-cache-username:
2427
description: "The username used to authenticate with the Gradle Build Cache Node."
2528
required: true
@@ -52,26 +55,18 @@ jobs:
5255
file: ${{ steps.baseline.outputs.file }}
5356
name: ${{ steps.baseline.outputs.name }}
5457
steps:
55-
- name: Harden Runner
56-
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
57-
with:
58-
egress-policy: audit
59-
60-
- name: Checkout Code
61-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
62-
with:
63-
ref: ${{ inputs.ref }}
64-
65-
- name: Setup Java
66-
uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
67-
with:
68-
distribution: ${{ inputs.java-distribution }}
69-
java-version: ${{ inputs.java-version }}
70-
71-
- name: Setup Gradle
72-
uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
58+
- name: Prepare Job
59+
uses: pandaswhocode/initialize-github-job@a57cd6d8d768b2f3c95334bdd4fa8c21609fc651 # v1.0.5
7360
with:
74-
cache-disabled: true
61+
checkout: "true"
62+
checkout-ref: "${{ inputs.ref }}"
63+
checkout-token: "${{ secrets.github-token }}"
64+
checkout-fetch-depth: "1"
65+
setup-java: "true"
66+
java-distribution: "${{ inputs.java-distribution }}"
67+
java-version: "${{ inputs.java-version }}"
68+
setup-gradle: "true"
69+
gradle-cache-read-only: "false"
7570

7671
- name: Authenticate to Google Cloud
7772
id: google-auth
@@ -121,7 +116,7 @@ jobs:
121116
run: gsutil cp "${{ steps.manifest.outputs.file }}" "${{ steps.baseline.outputs.file }}"
122117

123118
generate-matrix:
124-
name: "Generate OS Matrix for Determinism Verification"
119+
name: "Gradle: Generate OS Matrix"
125120
runs-on: hl-cn-gradle-determinism-lin-ss
126121
outputs:
127122
os-matrix: ${{ steps.set-matrix.outputs.os-matrix }}
@@ -182,36 +177,35 @@ jobs:
182177
fail-fast: false
183178
matrix: ${{ fromJSON(needs.generate-matrix.outputs.os-matrix) }}
184179
steps:
185-
- name: Harden Runner
186-
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
187-
with:
188-
egress-policy: audit
189-
190180
- name: Standardize Git Line Endings
191181
run: |
192182
git config --global core.autocrlf false
193183
git config --global core.eol lf
194184
195-
- name: Checkout Code
196-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
185+
- name: Prepare Job
186+
uses: pandaswhocode/initialize-github-job@a57cd6d8d768b2f3c95334bdd4fa8c21609fc651 # v1.0.5
197187
with:
198-
ref: ${{ inputs.ref }}
199-
200-
- name: Setup Python
201-
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
202-
with:
203-
python-version: 3.9
204-
205-
- name: Setup Java
206-
uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
207-
with:
208-
distribution: ${{ inputs.java-distribution }}
209-
java-version: ${{ inputs.java-version }}
188+
checkout: "true"
189+
checkout-ref: "${{ inputs.ref }}"
190+
checkout-token: "${{ secrets.github-token }}"
191+
checkout-fetch-depth: "1"
192+
setup-java: "true"
193+
java-distribution: "${{ inputs.java-distribution }}"
194+
java-version: "${{ inputs.java-version }}"
195+
setup-gradle: "true"
196+
gradle-cache-read-only: "false"
197+
198+
- name: Install Python (Linux)
199+
if: ${{ runner.os == 'Linux' }}
200+
run: |
201+
sudo apt-get update
202+
sudo apt-get install --yes --no-install-recommends python3 python3-venv python3-pip
210203
211-
- name: Setup Gradle
212-
uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
204+
- name: Install Python
205+
if: ${{ runner.os != 'Linux' }}
206+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
213207
with:
214-
cache-disabled: true
208+
python-version: "3.12"
215209

216210
- name: Setup CoreUtils (macOS)
217211
if: ${{ runner.os == 'macOS' }}

0 commit comments

Comments
 (0)