T8943: scripts/package-build: migrate broken commit_id refs after 1c rename

[andamasov]

Summary

T8943 Rollout 1c renamed the default branch of seven vyos-owned repos that scripts/package-build/ clones, but #1204 only swept .github/workflows/. Seven commit_id values in scripts/package-build/*/package.toml were missed and now break build.py.

Why this breaks builds

build.py (line 90-92) runs:

git clone <scm_url> <repo_dir>
git checkout <commit_id>

GitHub's branch-rename redirect works for the REST API and the web UI, not for git refs in a fresh clone. After the 1c rename, git checkout current (or master) errors with pathspec ... did not match any file(s) known to git.

Empirically verified:

$ git clone --depth 1 https://github.com/vyos/vyos-1x.git /tmp/test
$ cd /tmp/test && git checkout current
error: pathspec 'current' did not match any file(s) known to git

Changes

Seven commit_id values in five files, all pointing to vyos-owned repos whose default branch was renamed current/master → rolling in 1c:

File	Sub-package	scm_url	before	after
libnss-mapuser/package.toml	libnss-mapuser	vyos/libnss-mapuser	current	rolling
libpam-radius-auth/package.toml	libpam-radius-auth	vyos/libpam-radius-auth	current	rolling
vpp/package.toml	vyos-vpp-patches	vyos/vyos-vpp-patches	current	rolling
vyos-1x/package.toml	vyos-1x	vyos/vyos-1x	current	rolling
tacacs/package.toml	libtacplus-map	vyos/libtacplus-map	master	rolling
tacacs/package.toml	libpam-tacplus	vyos/libpam-tacplus	master	rolling
tacacs/package.toml	libnss-tacplus	vyos/libnss-tacplus	master	rolling

Post-rename default branches verified via gh api repos/vyos/<r> --jq .default_branch for all seven.

Out of scope

• LTS branches (sagitta/circinus/equuleus): scanned, no vyos-owned commit_id="current"/"master" refs found. Only third-party evgeny-gridasov/openvpn-otp master on circinus, unaffected by 1c.
• Tagged / SHA-pinned / debian/* refs: independent of 1c renames.
• stable/2510 on upstream FDio/vpp in vpp/package.toml: third-party, unaffected.

Test plan

• scripts/package-build/build.py vyos-1x succeeds (clone + checkout rolling).
• scripts/package-build/build.py libnss-mapuser succeeds.
• scripts/package-build/build.py libpam-radius-auth succeeds.
• scripts/package-build/build.py vpp succeeds.
• scripts/package-build/build.py tacacs succeeds (all 3 sub-packages clone + checkout rolling).

Backport

• No — LTS branches are unaffected.

Advances: T8943

🤖 Generated by robots

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: b96dd44b-ebc0-4d6c-8e2d-3beb844bfbe1

📥 Commits

Reviewing files that changed from the base of the PR and between 78e43ad and 08ef440.

📒 Files selected for processing (5)

• scripts/package-build/libnss-mapuser/package.toml
• scripts/package-build/libpam-radius-auth/package.toml
• scripts/package-build/tacacs/package.toml
• scripts/package-build/vpp/package.toml
• scripts/package-build/vyos-1x/package.toml

📜 Recent review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)

• GitHub Check: codeql-analysis-call / Analyze (python)
• GitHub Check: Mergify Merge Protections
• GitHub Check: Summary

🧰 Additional context used

🔍 Remote MCP

I'll search for additional context about the 1c rollout and branch rename mentioned in this PR, which will help understand the scope and reasoning behind these changes.Based on my search results, I've found relevant context about the VyOS build system and the branch naming convention that's critical to understanding this PR. Let me search for more specific information about the 1c rollout and default branch changes.Based on my search results, I now have sufficient context to provide a comprehensive summary. Let me compile the findings.

Additional Context Found

Build System Architecture & commit_id Handling

The commit_id field in package.toml specifies the specific commit, tag, or branch to check out from the source repository. When building packages, the build.py script checks out the source code from the configured repository, and crucially, uses git checkout to access the specified reference.

Critical Issue with GitHub Branch Renames

The PR addresses a real problem: The default branch in VyOS repositories is called "current", and all new code goes to the current branch. However, the search results show that VyOS has references to both the "current" branch in Docker images and build documentation, indicating that the migration from "current" to "rolling" as a default branch name is in progress.

The issue described in the PR is technically valid: when build.py clones a fresh repository and runs git checkout <commit_id>, GitHub's branch-rename redirects don't apply in the same way they would to a cloned repository with tracking references. This would cause git checkout master or git checkout current to fail if those branches no longer exist.

Test Plan Validation

The build process applies patches, executes pre-build hooks, builds packages using specified commands, and generates Debian packages, making the PR's test plan of running scripts/package-build/build.py for each affected package an appropriate validation method.

Scope Considerations

The PR notes that LTS branches (sagitta/circinus/equuleus) require no changes and that third-party or SHA/tag-pinned references are out of scope—this is consistent with the fact that LTS releases have their own branches named after constellations, and only vyos-owned repositories with dynamic default branch references needed updating.

🔇 Additional comments (6)

scripts/package-build/libpam-radius-auth/package.toml (1)

3-3: LGTM!

scripts/package-build/libnss-mapuser/package.toml (1)

3-3: LGTM!

scripts/package-build/tacacs/package.toml (1)

3-3: LGTM!

Also applies to: 9-9, 15-15

scripts/package-build/vpp/package.toml (1)

3-3: LGTM!

scripts/package-build/vyos-1x/package.toml (2)

3-3: LGTM!

---

1-4: Ensure rolling branch exists for all repos checked out via commit_id="rolling"

• scripts/package-build/build.py clones package['scm_url'] and runs git checkout package['commit_id'] (uses commit_id directly).
• commit_id = "rolling" is set for the following repos (by scm_url) and line numbers:
  • vyos-vpp-patches (scripts/package-build/vpp/package.toml:3-4)
  • vyos-1x (scripts/package-build/vyos-1x/package.toml:3-4)
  • libtacplus-map, libpam-tacplus, libnss-tacplus (scripts/package-build/tacacs/package.toml:3-4, 9-10, 15-16)
  • libnss-mapuser (scripts/package-build/libnss-mapuser/package.toml:3-4)
  • libpam-radius-auth (scripts/package-build/libpam-radius-auth/package.toml:3-4)
• GitHub API results show the rolling branch exists for all 7 corresponding repositories, so git checkout should not fail.

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated package build configurations to use rolling release tracking for multiple system packages, including authentication and VyOS components.

Walkthrough

Five package manifest files in scripts/package-build/ update their commit_id field to use rolling release tracking. libnss-mapuser, libpam-radius-auth, vpp, and vyos-1x change from "current" to "rolling". tacacs updates three package entries from "master" to "rolling".

Changes

Package build commit ID updates

Layer / File(s)	Summary
Update package manifest commit IDs to rolling scripts/package-build/libpam-radius-auth/package.toml, scripts/package-build/libnss-mapuser/package.toml, scripts/package-build/tacacs/package.toml, scripts/package-build/vpp/package.toml, scripts/package-build/vyos-1x/package.toml	Five package manifests update commit_id values to "rolling" instead of fixed references: libpam-radius-auth ("current" → "rolling"), libnss-mapuser ("current" → "rolling"), tacacs entries for libtacplus-map, libpam-tacplus, and libnss-tacplus ("master" → "rolling"), vpp's vyos-vpp-patches ("current" → "rolling"), and vyos-1x ("current" → "rolling").

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the primary change: migrating commit_id references in package.toml files to 'rolling' after the 1c branch rename.
Description check	✅ Passed	The description clearly explains the problem (branch rename breaks git checkouts in fresh clones), provides empirical verification, details all seven changes across five files with a verification table, and outlines scope and test plan.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch claude/T8943-package-toml-refs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[c-po]

Default branch rename. All checked!

[hedrok]

Approve: changed all current and master commit_id in all packages that have such branches to rolling according to renaming of branches in repos.