chore(lifecycle): call lifecycle.yml from projectbluefin/actions - #779
Closed
castrojo wants to merge 25 commits into
Closed
chore(lifecycle): call lifecycle.yml from projectbluefin/actions#779castrojo wants to merge 25 commits into
castrojo wants to merge 25 commits into
Conversation
…next stream (#752) - Document GitHub API 422 idempotent fast-forward pattern - Document merge-queue head_branch never equals 'main' - Document :next/:btw as fully automated rolling stream (no human gate) Assisted-by: Claude Sonnet 4.6 via GitHub Copilot
…this The renovate.yml GHA workflow has never worked (RENOVATE_TOKEN was never set). The projectbluefin Renovate GitHub App (id 92805263) creates all dependency PRs. This workflow is dead weight that fails startup every 6h. Assisted-by: Claude Sonnet 4.6 via pi
Renovate and auto/track-* PRs target the testing branch for auto-merge before promotion to main. The build workflow must run on testing-targeted PRs so the renovate-automerge workflow can fire when validation passes. Assisted-by: Claude Sonnet 4.6 via pi
Fires when Build Bluefin dakota completes successfully on a testing- targeted PR from renovate[bot] or app/mergeraptor. Enables native GitHub auto-merge so PRs land without manual intervention. Mirrors the pattern used in projectbluefin/bluefin and bluefin-lts. Assisted-by: Claude Sonnet 4.6 via pi
auto-merge group (brew, common, extensions, etc.) should land on testing first — no review gate — and flow to main via weekly promotion. This unblocks auto-merge which was stuck because main requires 1 review. manual-merge and core-junctions still target main (need human review). Assisted-by: Claude Sonnet 4.6 via pi
auto-merge group (brew, common, extensions, etc.) should land on testing first — no review gate — and flow to main via weekly promotion. This unblocks auto-merge which was stuck because main requires 1 review. manual-merge and core-junctions still target main (require human review). Assisted-by: Claude Sonnet 4.6 via pi
The remote CAS storage-service routes the local casd through cache.projectbluefin.io. GNOME 51 produces ~8.5GB artifacts which exceed the remote server's per-client quota during bst export, causing: OutOfSpaceException: Insufficient storage quota Build jobs (push=true) keep storage-service — artifacts are written directly to the remote CAS as they are built. Export/publish jobs (push=false) now use local disk for the casd. The runner's BTRFS volume has sufficient space to materialise the artifact for podman push. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot
Assisted-by: Claude Sonnet 4.6 via pi
…#758) AGENTS.md: - Add :next/:btw to repo map and image stream summary - Clarify no stable promotion ever for next stream docs/skills/overview.md: - Add Image Streams table (testing/latest/stable/next/btw) - Add :next/:btw section — positioning, key differences, ops patterns docs/skills/ci.md: - export/publish jobs skip storage-service (remote CAS quota too small for GNOME 51 ~8.5GB artifacts) - Cold build strategy for next branch: retrigger until cache warms - next branch needs manual cherry-picks of main fixes - :next build only fires on junction bumps, not guaranteed nightly docs/skills/README.md: - Add routing table entry for :next/:btw stream Assisted-by: Claude Sonnet 4.6 via GitHub Copilot
…#757) Add the PR-as-gate release model to dakota. The weekly cron-based promotion workflow is replaced by an always-open auto/promote-testing-to-main PR that maintainers merge (requires 2 approvals) to cut a stable release. Dakota does not have a testing->main code flow (images publish directly from main). A .github/release-state.yaml tracking file is used to create a real diff on the promotion branch, recording the :testing digests being promoted. New workflows: - promote-testing-to-main.yml: triggers on push to testing branch. Resolves :testing digests for dakota and dakota-nvidia. Creates/updates auto/promote-testing-to-main branch with release-state.yaml. Opens or updates the promotion PR against main. - pr-release-gate.yml: gate checks on the promotion PR (digest resolution, cosign verification). Sticky status comment. release/ready or release/blocked label. E2E gate disabled (no post-testing-e2e workflow in this repo). - release-reminder.yml: daily cron. Reminder after 7 days; escalates at 14. - execute-release.yml: runs on PR merge; promotes testing -> stable for dakota and dakota-nvidia. Creates GitHub release. New file: - .github/release-state.yaml: initial stub; updated by promote-testing-to-main.yml. Deleted: - weekly-testing-promotion.yml: replaced by the above. Variants promoted: dakota, dakota-nvidia (testing -> stable) Depends on: projectbluefin/actions#135 (must merge first) Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
GITHUB_TOKEN pushes from promote-testing-to-main.yml do not trigger pull_request synchronize events (GitHub anti-loop protection). Add an explicit workflow_dispatch trigger to pr-release-gate.yml and dispatch it from promote-testing-to-main.yml after each PR update so gate checks always run against the current promotion state. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
GITHUB_TOKEN cannot trigger workflow_dispatch events (anti-loop protection). Replace the failed dispatch approach with an inline gate job that calls reusable-release-gate.yml@main directly after the promote job completes. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ject_name casing Three cleanups from org-wide CI audit: 1. Remove release.yml (dead code): The old workflow_call-triggered release workflow has no callers since execute-release.yml now handles releases via the PR-merge trigger with reusable-release.yml@main. Leaving both creates confusion about which release path is canonical. 2. Add daily schedule to promote-testing-to-main: bluefin and bluefin-lts both run at cron '0 23 * * *' in addition to push/dispatch triggers. Without the schedule, the promotion PR can go stale if no build pushes to testing for a day. 3. Fix project_name: 'Bluefin dakota' -> 'Dakota' to match repo branding conventions (bluefin uses 'Bluefin', lts uses 'Bluefin LTS'). Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…elta patterns (#742) Two new lessons from a session investigating a slow in-progress build: 1. Diagnosing slow in-progress builds via GitHub API — gh api job logs, counting SKIPPED vs compiling, live log truncation caveat (~23K line snapshot cap), when to re-trigger vs let it run. 2. gnome-build-meta nightly delta pattern — after the GNOME nightly (~08:00 UTC), 10–30 core-deps elements rebuild; this is expected, takes 60–120 extra minutes, and completes within the 330-min timeout. Lists commonly rebuilt elements and how to confirm nightly drift vs a local cache bust. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot
baseBranchPatterns was set to ["testing"] but the testing branch is a stale diverged pointer — the CI gate (on-pr-opened-or-updated) blocks any PR not targeting main, so Renovate PRs targeting testing can never pass or merge. Two fixes: 1. baseBranchPatterns: ["testing"] → ["main"] so new Renovate PRs target main and pass the CI gate 2. Add packageRules entry to exempt projectbluefin/bonedigger from digest pinning — @main is an intentional managed floating tag (documented in bonedigger.yml and docs/skills/ci-tooling.md) Assisted-by: Claude Sonnet 4.6 via GitHub Copilot
Bump CHUNKAH_REF to v0.6.0 (sha256:ff8b8b...). chunkah#113 closed via overlay workaround; overlay+fakecap-restore path unchanged. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…h base (#766) * fix(ci): track-bst-sources: branch from target base, not main auto-merge PRs target the testing branch, but the workflow was creating the tracking branch from origin/main. This caused two problems: 1. All commits that main had but testing lacked showed up in the PR, inflating the commit count and causing CI confusion. 2. If main and testing had diverged on workflow files, the PR diff included CI regressions (e.g. PR 764 would have removed testing branch triggers from build.yml). Fix: determine BASE_BRANCH before the git checkout, stash the BST-tracked element changes, switch to origin/$BASE_BRANCH, then pop the stash. The PR diff is now relative to the actual target branch, and only contains the element ref update. Also commit docs/skills/vm-stack.md: VM stack (virt-manager + QEMU flatpaks) lessons from 2026-06-09 session. Assisted-by: Claude Sonnet 4.6 via pi * fix(ci): publish :testing on every merge to testing branch publish.yml was only triggered by builds on main and next. Auto-merge PRs target the testing branch, so their builds completed successfully but no image was ever published. promote-testing-to-main.yml fires on push to testing and immediately does skopeo inspect dakota:testing — this silently failed whenever testing advanced without a prior main publish. Fix: add testing and gh-readonly-queue/testing/** to the workflow_run branches filter, allow testing in the setup job condition, and map the testing branch to testing_tag=testing. The fast-forward-testing step in the promote job is already gated on branch==main so there is no loop. Result: every merge to testing now publishes :testing immediately, matching the bluefin/bluefin-lts behaviour. Assisted-by: Claude Sonnet 4.6 via pi
…767) The repo has allowMergeCommit=false — only squash merges are permitted. The previous --merge call silently fell through to the warning echo, leaving auto-merge never set on tracking PRs. Switch to --squash. Assisted-by: Claude Sonnet 4.6 via pi
…#773) * feat(ci): use centralized bootc-build/chunka action for chunkify Replace the inline `just chunkify` step in publish.yml with the centralized `projectbluefin/actions/bootc-build/chunka` composite action. Dakota uses the BST code path (xattr-manifest input) which: - Mounts a writable overlay on the exported OCI rootfs - Injects user.component xattrs from files/fakecap-manifest.tsv - Runs chunkah via podman run against the overlay - Returns the rechunked image in user podman storage The fakecap-manifest.tsv is pre-committed (Cargo.lock pattern) and regenerated by .github/workflows/update-filemap.yml when BST elements change. max-layers kept at 120 (matching previous just chunkify value). Also removes scripts/apply-xattrs.py (dead code — superseded by fakecap-restore.c for local dev and inject-xattrs.py in the action for CI) and fixes a stale comment in fakecap-restore.c that claimed coreos/chunkah#113 would eventually deliver a libc fallback (it closed without that; the overlay approach is the resolution). Depends on: projectbluefin/actions#<PR> (xattr-manifest input) SHA must be updated to post-merge actions SHA before this lands. Closes #769 Closes #770 Closes #771 Closes #772 Assisted-by: Claude Sonnet 4.5 via pi * fix(ci): pin chunka action to post-merge SHA cb230ad Update the SHA pin from the feature branch commit to the squash-merged SHA on projectbluefin/actions main after actions#141 landed. Assisted-by: Claude Sonnet 4.5 via pi
…erence Contributors arriving from mainline Bluefin had no indication that dakota uses BuildStream 2 (not Containerfiles/DNF) and no path to the actual build instructions. This adds the critical context and points to AGENTS.md where everything lives. Addresses hive advisory finding in projectbluefin/common#557 Assisted-by: Claude Sonnet 4.5 via pi
…ync testing mirror (#777) Every merge to main now triggers a build and publishes :testing immediately. No intermediate staging branch — the weekly promotion is the only gate. Changes: - build.yml: push trigger adds 'main' (removes 'testing' — no longer the source branch) - publish.yml: fast-forward testing branch uses force=true so it never silently fails - track-bst-sources.yml: auto-merge group PRs target main instead of testing, eliminating the branch divergence that stranded bootc 1.16 and other updates Assisted-by: Claude Sonnet 4.5 via pi
ci.md: - publish.yml must include testing branch in workflow_run.branches - track-bst-sources: branch from origin/$BASE_BRANCH not origin/main - track-bst-sources: use --squash not --merge (allowMergeCommit=false) - corrupted auto-track PR anatomy and how to spot one pr-review.md: - check new service/file additions are wired into BST install-commands Fixes landed: PR 766 (publish testing), PR 767 (--squash automerge) Assisted-by: Claude Sonnet 4.6 via pi
…oves the lifecycle state machine out of common and into the org CI hub\n(projectbluefin/actions). common no longer hosts the 747-line workflow.\n\nAlso fixes pull_request trigger: adds `labeled` type so on-pr-lgtm\nfires when the `lgtm` label is applied (was silently broken before).\n\nMerge order: projectbluefin/actions#<N> must merge first; then update\nthe SHA pin above to the resulting HEAD SHA on actions/main.\n\nAssisted-by: Claude Sonnet 4.5 via pi
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
This PR targets |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updates the lifecycle caller to reference
lifecycle.ymlfrom its new home inprojectbluefin/actions(moved fromprojectbluefin/common).Changes
lifecycle-caller.ymlto referenceprojectbluefin/actionspull_request: types: [opened, labeled]—labeledwas missing;on-pr-lgtmauto-merge onlgtmlabel was silently never firing in this repoMerge
projectbluefin/actionschore/lifecycle-from-common PR first, then update the SHA:Replace
7df3176a...with HEAD SHA ofactions/mainafter that PR merges.Token audit
No PATs.
github.tokenonly —github.repositoryresolves toprojectbluefin/dakotaat runtime.Assisted-by: Claude Sonnet 4.5 via pi