[ci]: fix flyteconsole image pull and ECR push scoping in CI workflows - #15
Merged
Merged
Conversation
…flow perms - Default get_flyteconsole_dist.sh to public ghcr.io/flyteorg/flyteconsole (no ECR auth needed in CI) - Allow ECR override via FLYTECONSOLE_IMAGE env var for local/deploy builds - Add OIDC permissions to build-and-push-single-binary-image job - Install yq before using it in single-binary.yml - Restrict ECR push steps to tag events only (startsWith refs/tags/) - Remove 'Ensure ECR repository exists' steps (repos managed by Pulumi) - Fix ECR prefix default to exa-hephaestus
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
3 tasks
…s python version - manifest.txt: bitnami/* -> bitnamilegacy/* (images removed from Docker Hub) - generate_helm.sh: install helm to TMPDIR, prepend PATH (upstream fix) - buf.gen.yaml: pin neoeinstein-prost to v0.4.0 (match upstream, fix version drift) - tests.yml: python 3.9 -> 3.10 (flytekit requires >=3.10)
Parameterize Dockerfile FLYTECONSOLE_IMAGE so the ECR push step passes the exa ECR flyteconsole image. CI/PR builds still default to public ghcr.io/flyteorg/flyteconsole.
…rate limits - generate_helm.sh: add explicit helm repo adds before dep update (fixes cache miss), default HELM_INSTALL_DIR to /tmp when TMPDIR is unset - tests.yml: remove docs job (conda lock pins Python 3.9, flytekit requires >=3.10; upstream removed this job entirely) - go_generate.yml: FLYTE_BOT_PAT optional, fall back to github.token (fixes API rate limits when secret is not configured in fork)
…ache helm dep update resolves from Chart.lock using URL-hashed cache keys that don't exist on fresh CI runners. helm dep build rebuilds from Chart.yaml using named repos added via helm repo add. Also make helm repo update non-fatal since some upstream repos may be offline.
- kubernetes-dashboard: kubernetes.github.io -> kubernetes-retired.github.io - docker-registry (twuni): helm.twun.io -> twuni.github.io/docker-registry.helm - Remove flyte-sandbox/Chart.lock from tracking (add to .gitignore like others) - Revert generate_helm.sh to upstream pattern (helm dep update, no manual repo adds) Chart.lock files are gitignored and regenerated by helm dep update in CI.
CI's go-installed helm-docs v1.12.0 omits the footer while the prebuilt binary includes it. Remove to match CI output.
Update rendered manifests to match chart values.yaml which uses the ECR flyteconsole image. This was already configured in values.yaml but the generated manifests were stale.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why are the changes needed?
CI has been broken on master since Aug 2025 with multiple distinct failures. This PR fixes 5 of the 7 broken checks.
What changes were proposed in this pull request?
1. flyteconsole ECR auth fix (
compile,build-and-push-single-binary-image)script/get_flyteconsole_dist.sh: Hardcoded ECR URL → env-var with public GHCR fallback:.github/workflows/single-binary.yml: ECR push scoped to tag events only (startsWith(github.ref, 'refs/tags/')), add OIDC perms, install yq..github/workflows/pr-ecr-images.yml: Remove "Ensure ECR repository exists" step (managed by Pulumi).2. Sandbox bitnami image rot (
sandbox-bundled-functional-tests,sandbox-bundled-offloaded-functional-tests)docker/sandbox-bundled/images/manifest.txt:bitnami/*→bitnamilegacy/*(old images removed from Docker Hub, matching upstream fix).3. Helm install path (
generate_helm)script/generate_helm.sh: Install helm to$TMPDIR, prepend to$PATH(upstream fix — ensures CI uses v3.15.4 not the runner's pre-installed version).4. Buf prost plugin version drift (
Check Go Generate / flyteidl)flyteidl/buf.gen.yaml: Pinneoeinstein-prosttov0.4.0(matching upstream andneoeinstein-tonic— unpinned version caused "read datacatalog.rs: file does not exist").5. Docs Python version (
docs).github/workflows/tests.yml: Python 3.9 → 3.10 (flytekit now requires>=3.10).Still failing (not fixable from CI):
dependency-review: Requires "Dependency graph" enabled in repo Settings → Code security. A repo admin needs to toggle this.Test Getting started:flytectl demo startpullscr.flyte.org/flyteorg/flyte-sandbox-bundled:sha-<SHA>using the fork's commit SHA, which doesn't exist in the upstream container registry.How was this patch tested?
bitnamilegacy/*images exist on Docker Hubghcr.io/flyteorg/flyteconsole:latestis publicly accessiblecompile+build-and-push-single-binary-imagepassLabels
Check all the applicable boxes
Related PRs
Link to Devin session: https://app.devin.ai/sessions/8b509ec6867a43d2a8a2988a465afd3f
Requested by: @pfernandes21