bvandeusen
7e065fed70
CI / extension-version (push) Successful in 4s
CI / lint (push) Failing after 4s
Build images / sign-extension (push) Successful in 4s
CI / backend-lint-and-test (push) Failing after 13s
CI / frontend-build (push) Successful in 20s
extension / lint (push) Successful in 22s
CI / integration (push) Failing after 2m24s
Build images / build-web (push) Successful in 2m44s
Build images / build-ml (push) Successful in 3m13s
Build images / build-agent (push) Successful in 8m56s
The shadow (dee93fa, run 4732) answered the gate: `imagetools inspect
--format` reads `.Image.Config.Labels` against this registry on buildx
v0.36.1. So the reuse check now asks the moving channel tag whether the image
it already points at carries this commit's `fc.revision`, and the r-<rev>
identity tags stop being published.
Three things this removes rather than manages:
A name minted per build that one thing read. Rule 145's narrowing is aimed
exactly there — "a third name for the same thing is upkeep for a model we do
not run."
The -main/-dev qualifier, and the CHANNELLED list behind it. Which tag you
inspect IS the channel, so the distinction has nowhere to live. cmd_identity
goes with it.
A silent expiry nobody wrote down. r-<rev> matches no branch of the
registry's keep_pattern (#3157), so identity tags were prunable past the
newest 10 — a pruned one costs a rebuild, in the safe direction and entirely
invisibly. A label rides inside a tag that has to exist anyway.
It also dissolves #3154 instead of deferring it: a scheduled base refresh
rebuilds :latest with the same revision label, the next unrelated push sees a
match and skips, and the refreshed base survives. Under the tag scheme that
push repointed :latest back to the older base.
The measured detail that shapes the code: a missing label returns an EMPTY
STRING and exits 0. Branching on the exit code would read "no label yet" as
success and skip a build that was needed. So it compares values, and every
uncertain case — absent label, unreachable tag, older image — lands as empty,
never equals a 12-char revision, and falls through to a build.
Reading the specific key matters too. The map carries the base image's labels,
and org.opencontainers.image.version sits right beside ours reading 24.04 on
the agent — a plausible-looking wrong answer.
Expect every artifact to rebuild once on this push: nothing carries a label
yet and it cannot be backfilled, since the reuse path copies a manifest and
config labels are not manifest annotations. One rebuild per artifact, ever,
self-healing after.
test_artifact_identity.py is rewritten around what is now load-bearing. The
CHANNELLED drift test had nothing left to guard; in its place the revision is
asked of git directly, so the file fails if the derivation ever stops being
"the commit this artifact's own shipped files last changed in".
103 lines
4.4 KiB
Python
103 lines
4.4 KiB
Python
"""`artifacts.sh revision` is what decides whether a build gets skipped.
|
|
|
|
Milestone 318 step 3: each image carries its revision as an `fc.revision`
|
|
label, and build.yml reads that label back off the moving channel tag. Equal
|
|
to the derived revision means the bytes this push would produce are already
|
|
published, so the build is skipped.
|
|
|
|
That makes the revision load-bearing in a way a version string is not — it is
|
|
compared for equality against a value stamped into a real published artifact.
|
|
Both ways of getting it wrong are silent:
|
|
|
|
* **it does not identify the content** — a revision that moves when the source
|
|
did not (a HEAD-derived value, say) never matches, nothing is ever skipped,
|
|
and the mechanism quietly buys nothing while every lane stays green.
|
|
* **it identifies the wrong content** — a revision that holds still when the
|
|
source DID change matches a stale label, the build is skipped, and the
|
|
channel serves bytes that do not correspond to the commit. This is the
|
|
dangerous direction, and it is what `test_artifact_paths.py` guards from the
|
|
other side by pinning the path sets.
|
|
|
|
This module owns the narrower claim: whatever the path sets say, the revision
|
|
is genuinely the commit those paths last changed in.
|
|
|
|
The identity-TAG tests this file used to hold are gone with the tag. There is
|
|
no longer a `CHANNELLED` list to drift (the channel is which tag you inspect),
|
|
and no `identity` subcommand to refuse an unqualified call.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import re
|
|
import subprocess
|
|
|
|
import pytest
|
|
|
|
from test_artifact_paths import ROOT, declared_paths
|
|
|
|
ARTIFACTS = ("web", "ml", "agent", "extension")
|
|
|
|
# 12 hex chars — the prefix build.yml stamps and compares.
|
|
_REVISION = re.compile(r"^[0-9a-f]{12}$")
|
|
|
|
|
|
def revision(artifact: str) -> str:
|
|
return subprocess.run(
|
|
["sh", str(ROOT / "scripts" / "artifacts.sh"), "revision", artifact],
|
|
capture_output=True, text=True, check=True, cwd=ROOT,
|
|
).stdout.strip()
|
|
|
|
|
|
@pytest.mark.parametrize("artifact", ARTIFACTS)
|
|
def test_revision_is_the_commit_its_own_shipped_files_last_changed_in(artifact):
|
|
"""The claim the whole skip decision rests on.
|
|
|
|
Asked of git directly rather than of the script, so this fails if the
|
|
derivation ever stops meaning what it says — deriving from HEAD, from a
|
|
build clock, or from a path set it did not actually use.
|
|
"""
|
|
paths = declared_paths(artifact)
|
|
expected = subprocess.run(
|
|
["git", "log", "--format=%H", "-1", "HEAD", "--", *paths],
|
|
capture_output=True, text=True, check=True, cwd=ROOT,
|
|
).stdout.strip()
|
|
|
|
assert expected, (
|
|
f"no commit in this history touches the {artifact} path set — the "
|
|
f"derivation has nothing to stand on"
|
|
)
|
|
assert expected.startswith(revision(artifact)), (
|
|
f"{artifact} derives {revision(artifact)!r}, but the newest commit "
|
|
f"touching its shipped files is {expected[:12]!r}. The label stamped "
|
|
f"into the image would not identify its own content."
|
|
)
|
|
|
|
|
|
@pytest.mark.parametrize("artifact", ARTIFACTS)
|
|
def test_revision_is_a_legal_label_value_and_is_stable(artifact):
|
|
"""It is stamped as a docker label and compared for string equality, so a
|
|
stray newline or a varying value breaks the comparison rather than the
|
|
build — the mechanism would simply stop hitting, silently."""
|
|
first = revision(artifact)
|
|
assert _REVISION.match(first), f"{first!r} is not a 12-char hex revision"
|
|
assert first == revision(artifact), "revision is not stable across calls"
|
|
|
|
|
|
def test_an_artifact_whose_paths_did_not_change_keeps_its_revision():
|
|
"""The property that makes skipping possible at all.
|
|
|
|
The agent's set is disjoint from web's, so the two must be free to differ.
|
|
Asserting they *are* different today would pin an accident of history —
|
|
what matters is that the derivation is per-artifact rather than global, so
|
|
this asserts each artifact's revision is drawn from its own path set.
|
|
"""
|
|
seen = {a: revision(a) for a in ARTIFACTS}
|
|
for artifact, rev in seen.items():
|
|
touched = subprocess.run(
|
|
["git", "log", "--format=%H", "-1", "HEAD", "--", *declared_paths(artifact)],
|
|
capture_output=True, text=True, check=True, cwd=ROOT,
|
|
).stdout.strip()
|
|
assert touched.startswith(rev), (
|
|
f"{artifact}'s revision {rev!r} is not the newest commit touching "
|
|
f"its own paths — the derivation is not per-artifact"
|
|
)
|