mirror of
https://github.com/GreptimeTeam/greptimedb.git
synced 2026-10-04 19:15:34 +00:00
Ning Sun
28f01d2ffe
* revert(ci): pin the query-regression runner toolchain to nightly-2026-03-21 The query-regression benchmark compiles both the candidate and the BASE checkout (the previous nightly build). Base refs can predate the stable-toolchain migration and still use #![feature] gates, so the runner toolchain must stay a nightly that can build historical revisions; deriving it from the workspace rust-toolchain.toml (now stable 1.96.1) breaks base builds. Revert the toolchain-toml coupling introduced in #9369 and keep the parts that were correct: - query-regression.yml: RUSTUP_TOOLCHAIN hard-pinned to nightly-2026-03-21 again (with a comment explaining why), Verify assertions back to the exact nightly versions, and the test-tooling pin-derivation machinery removed - runner Dockerfile: ARG RUST_TOOLCHAIN=nightly-2026-03-21 + baked ENV restored; the COPY rust-toolchain.toml parsing removed - build-ecs-image.py: the toml staging in the builder user-data removed; base-image auto-resolution kept but retargeted to Ubuntu 26.04 to match the Verify tool pins (python3 3.14 etc.) - the rebuild job keeps the epoch-bump lockstep, now as a PR from a timestamped ci/ branch mirroring update-dev-builder-version.sh (direct pushes to main fail GH006 under branch protection) Complements #9376 (actions-runner bump), which requires a rebuilt image with the non-deprecated runner. Part of #9289. Signed-off-by: Ning Sun <sunning@greptime.com> * chore: skip qreg for rust-toolchain change --------- Signed-off-by: Ning Sun <sunning@greptime.com>
454 lines
22 KiB
YAML
454 lines
22 KiB
YAML
name: Release builder images
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
paths:
|
|
- rust-toolchain.toml
|
|
- 'docker/dev-builder/**'
|
|
- '.github/runner-scale-sets/query-regression/**'
|
|
workflow_dispatch: # Allows you to run this workflow manually.
|
|
inputs:
|
|
release_dev_builder_ubuntu_image:
|
|
type: boolean
|
|
description: Release dev-builder-ubuntu image
|
|
required: false
|
|
default: false
|
|
release_dev_builder_centos_image:
|
|
type: boolean
|
|
description: Release dev-builder-centos image
|
|
required: false
|
|
default: false
|
|
release_dev_builder_android_image:
|
|
type: boolean
|
|
description: Release dev-builder-android image
|
|
required: false
|
|
default: false
|
|
release_dev_builder_riscv64_image:
|
|
type: boolean
|
|
description: Release dev-builder-riscv64 image
|
|
required: false
|
|
default: false
|
|
release_query_regression_runner_image:
|
|
type: boolean
|
|
description: Rebuild the query-regression ECS runner image (and update QUERY_REGRESSION_ECS_IMAGE_ID + RUNNER_IMAGE_EPOCH)
|
|
required: false
|
|
default: false
|
|
update_dev_builder_image_tag:
|
|
type: boolean
|
|
description: Update the DEV_BUILDER_IMAGE_TAG in Makefile and create a PR
|
|
required: false
|
|
default: false
|
|
|
|
jobs:
|
|
changes:
|
|
name: Detect changed components
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
dev-builder: ${{ steps.filter.outputs.dev-builder }}
|
|
query-regression-runner: ${{ steps.filter.outputs.query-regression-runner }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
- name: Filter changes
|
|
id: filter
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
base="${{ github.event.before }}"
|
|
head="${{ github.sha }}"
|
|
if [[ "${{ github.event_name }}" != "push" ]] || [[ -z "${base}" ]] || ! git cat-file -e "${base}^{commit}" 2>/dev/null; then
|
|
# Dispatch, or an unknown base (new branch/force-push): treat
|
|
# everything as changed so gating falls back to job inputs.
|
|
echo "dev-builder=true" >> "$GITHUB_OUTPUT"
|
|
echo "query-regression-runner=true" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
files="$(git diff --name-only "${base}" "${head}")"
|
|
dev_builder=false
|
|
query_regression_runner=false
|
|
# rust-toolchain.toml only gates the dev-builder images: they bake
|
|
# the workspace toolchain. The query-regression runner toolchain is
|
|
# pinned inside its Dockerfile (nightly-2026-03-21) and must NOT
|
|
# follow the workspace pin, so its rebuild triggers only on changes
|
|
# under its own directory.
|
|
if grep -qx 'rust-toolchain.toml' <<<"${files}"; then
|
|
dev_builder=true
|
|
fi
|
|
if grep -q '^docker/dev-builder/' <<<"${files}"; then
|
|
dev_builder=true
|
|
fi
|
|
if grep -q '^\.github/runner-scale-sets/query-regression/' <<<"${files}"; then
|
|
query_regression_runner=true
|
|
fi
|
|
echo "dev-builder=${dev_builder}" >> "$GITHUB_OUTPUT"
|
|
echo "query-regression-runner=${query_regression_runner}" >> "$GITHUB_OUTPUT"
|
|
|
|
release-dev-builder-images:
|
|
name: Release dev builder images
|
|
# The jobs are triggered by the following events:
|
|
# 1. Manually triggered workflow_dispatch event
|
|
# 2. Push event when the PR that modifies the `rust-toolchain.toml` or `docker/dev-builder/**` is merged to main
|
|
needs: [changes]
|
|
if: ${{ (github.event_name == 'push' && needs.changes.outputs.dev-builder == 'true') || inputs.release_dev_builder_ubuntu_image || inputs.release_dev_builder_centos_image || inputs.release_dev_builder_android_image || inputs.release_dev_builder_riscv64_image }}
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
version: ${{ steps.set-version.outputs.version }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Configure build image version
|
|
id: set-version
|
|
shell: bash
|
|
run: |
|
|
commitShortSHA=`echo ${{ github.sha }} | cut -c1-8`
|
|
buildTime=`date +%Y%m%d%H%M%S`
|
|
BUILD_VERSION="$commitShortSHA-$buildTime"
|
|
# Extract the full channel string (e.g. "1.96.1" or
|
|
# "nightly-2026-03-21") so the image version always carries the
|
|
# toolchain it was built with.
|
|
RUST_TOOLCHAIN_VERSION=$(grep -E '^channel' rust-toolchain.toml | cut -d'"' -f2)
|
|
IMAGE_VERSION="${RUST_TOOLCHAIN_VERSION}-${BUILD_VERSION}"
|
|
echo "VERSION=${IMAGE_VERSION}" >> $GITHUB_ENV
|
|
echo "version=$IMAGE_VERSION" >> $GITHUB_OUTPUT
|
|
|
|
- name: Build and push dev builder images
|
|
uses: ./.github/actions/build-dev-builder-images
|
|
with:
|
|
version: ${{ env.VERSION }}
|
|
dockerhub-image-registry-username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
dockerhub-image-registry-token: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
build-dev-builder-ubuntu: ${{ inputs.release_dev_builder_ubuntu_image || github.event_name == 'push' }}
|
|
build-dev-builder-centos: ${{ inputs.release_dev_builder_centos_image || github.event_name == 'push' }}
|
|
build-dev-builder-android: ${{ inputs.release_dev_builder_android_image || github.event_name == 'push' }}
|
|
build-dev-builder-riscv64: ${{ inputs.release_dev_builder_riscv64_image || github.event_name == 'push' }}
|
|
|
|
release-dev-builder-images-ecr:
|
|
name: Release dev builder images to AWS ECR
|
|
runs-on: ubuntu-latest
|
|
needs: [
|
|
release-dev-builder-images
|
|
]
|
|
steps:
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@v4
|
|
with:
|
|
aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_KEY_ID }}
|
|
aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ACCESS_KEY }}
|
|
aws-region: ${{ vars.ECR_REGION }}
|
|
|
|
- name: Login to Amazon ECR
|
|
id: login-ecr-public
|
|
uses: aws-actions/amazon-ecr-login@v2
|
|
env:
|
|
AWS_REGION: ${{ vars.ECR_REGION }}
|
|
with:
|
|
registry-type: public
|
|
|
|
- name: Push dev-builder-ubuntu image
|
|
shell: bash
|
|
if: ${{ inputs.release_dev_builder_ubuntu_image || github.event_name == 'push' }}
|
|
env:
|
|
IMAGE_VERSION: ${{ needs.release-dev-builder-images.outputs.version }}
|
|
IMAGE_NAMESPACE: ${{ vars.IMAGE_NAMESPACE }}
|
|
ECR_IMAGE_REGISTRY: ${{ vars.ECR_IMAGE_REGISTRY }}
|
|
ECR_IMAGE_NAMESPACE: ${{ vars.ECR_IMAGE_NAMESPACE }}
|
|
run: |
|
|
docker run -v "${DOCKER_CONFIG:-$HOME/.docker}:/root/.docker:ro" \
|
|
-e "REGISTRY_AUTH_FILE=/root/.docker/config.json" \
|
|
quay.io/skopeo/stable:latest \
|
|
copy -a docker://docker.io/$IMAGE_NAMESPACE/dev-builder-ubuntu:$IMAGE_VERSION \
|
|
docker://$ECR_IMAGE_REGISTRY/$ECR_IMAGE_NAMESPACE/dev-builder-ubuntu:$IMAGE_VERSION
|
|
|
|
docker run -v "${DOCKER_CONFIG:-$HOME/.docker}:/root/.docker:ro" \
|
|
-e "REGISTRY_AUTH_FILE=/root/.docker/config.json" \
|
|
quay.io/skopeo/stable:latest \
|
|
copy -a docker://docker.io/$IMAGE_NAMESPACE/dev-builder-ubuntu:latest \
|
|
docker://$ECR_IMAGE_REGISTRY/$ECR_IMAGE_NAMESPACE/dev-builder-ubuntu:latest
|
|
|
|
- name: Push dev-builder-centos image
|
|
shell: bash
|
|
if: ${{ inputs.release_dev_builder_centos_image || github.event_name == 'push' }}
|
|
env:
|
|
IMAGE_VERSION: ${{ needs.release-dev-builder-images.outputs.version }}
|
|
IMAGE_NAMESPACE: ${{ vars.IMAGE_NAMESPACE }}
|
|
ECR_IMAGE_REGISTRY: ${{ vars.ECR_IMAGE_REGISTRY }}
|
|
ECR_IMAGE_NAMESPACE: ${{ vars.ECR_IMAGE_NAMESPACE }}
|
|
run: |
|
|
docker run -v "${DOCKER_CONFIG:-$HOME/.docker}:/root/.docker:ro" \
|
|
-e "REGISTRY_AUTH_FILE=/root/.docker/config.json" \
|
|
quay.io/skopeo/stable:latest \
|
|
copy -a docker://docker.io/$IMAGE_NAMESPACE/dev-builder-centos:$IMAGE_VERSION \
|
|
docker://$ECR_IMAGE_REGISTRY/$ECR_IMAGE_NAMESPACE/dev-builder-centos:$IMAGE_VERSION
|
|
|
|
docker run -v "${DOCKER_CONFIG:-$HOME/.docker}:/root/.docker:ro" \
|
|
-e "REGISTRY_AUTH_FILE=/root/.docker/config.json" \
|
|
quay.io/skopeo/stable:latest \
|
|
copy -a docker://docker.io/$IMAGE_NAMESPACE/dev-builder-centos:latest \
|
|
docker://$ECR_IMAGE_REGISTRY/$ECR_IMAGE_NAMESPACE/dev-builder-centos:latest
|
|
|
|
- name: Push dev-builder-android image
|
|
shell: bash
|
|
if: ${{ inputs.release_dev_builder_android_image || github.event_name == 'push' }}
|
|
env:
|
|
IMAGE_VERSION: ${{ needs.release-dev-builder-images.outputs.version }}
|
|
IMAGE_NAMESPACE: ${{ vars.IMAGE_NAMESPACE }}
|
|
ECR_IMAGE_REGISTRY: ${{ vars.ECR_IMAGE_REGISTRY }}
|
|
ECR_IMAGE_NAMESPACE: ${{ vars.ECR_IMAGE_NAMESPACE }}
|
|
run: |
|
|
docker run -v "${DOCKER_CONFIG:-$HOME/.docker}:/root/.docker:ro" \
|
|
-e "REGISTRY_AUTH_FILE=/root/.docker/config.json" \
|
|
quay.io/skopeo/stable:latest \
|
|
copy -a docker://docker.io/$IMAGE_NAMESPACE/dev-builder-android:$IMAGE_VERSION \
|
|
docker://$ECR_IMAGE_REGISTRY/$ECR_IMAGE_NAMESPACE/dev-builder-android:$IMAGE_VERSION
|
|
|
|
docker run -v "${DOCKER_CONFIG:-$HOME/.docker}:/root/.docker:ro" \
|
|
-e "REGISTRY_AUTH_FILE=/root/.docker/config.json" \
|
|
quay.io/skopeo/stable:latest \
|
|
copy -a docker://docker.io/$IMAGE_NAMESPACE/dev-builder-android:latest \
|
|
docker://$ECR_IMAGE_REGISTRY/$ECR_IMAGE_NAMESPACE/dev-builder-android:latest
|
|
|
|
- name: Push dev-builder-riscv64 image
|
|
shell: bash
|
|
if: ${{ inputs.release_dev_builder_riscv64_image || github.event_name == 'push' }}
|
|
env:
|
|
IMAGE_VERSION: ${{ needs.release-dev-builder-images.outputs.version }}
|
|
IMAGE_NAMESPACE: ${{ vars.IMAGE_NAMESPACE }}
|
|
ECR_IMAGE_REGISTRY: ${{ vars.ECR_IMAGE_REGISTRY }}
|
|
ECR_IMAGE_NAMESPACE: ${{ vars.ECR_IMAGE_NAMESPACE }}
|
|
run: |
|
|
docker run -v "${DOCKER_CONFIG:-$HOME/.docker}:/root/.docker:ro" \
|
|
-e "REGISTRY_AUTH_FILE=/root/.docker/config.json" \
|
|
quay.io/skopeo/stable:latest \
|
|
copy -a docker://docker.io/$IMAGE_NAMESPACE/dev-builder-riscv64:$IMAGE_VERSION \
|
|
docker://$ECR_IMAGE_REGISTRY/$ECR_IMAGE_NAMESPACE/dev-builder-riscv64:$IMAGE_VERSION
|
|
|
|
- name: Push latest dev-builder-riscv64 image
|
|
shell: bash
|
|
if: ${{ github.event_name == 'push' }}
|
|
env:
|
|
IMAGE_NAMESPACE: ${{ vars.IMAGE_NAMESPACE }}
|
|
ECR_IMAGE_REGISTRY: ${{ vars.ECR_IMAGE_REGISTRY }}
|
|
ECR_IMAGE_NAMESPACE: ${{ vars.ECR_IMAGE_NAMESPACE }}
|
|
run: |
|
|
docker run -v "${DOCKER_CONFIG:-$HOME/.docker}:/root/.docker:ro" \
|
|
-e "REGISTRY_AUTH_FILE=/root/.docker/config.json" \
|
|
quay.io/skopeo/stable:latest \
|
|
copy -a docker://docker.io/$IMAGE_NAMESPACE/dev-builder-riscv64:latest \
|
|
docker://$ECR_IMAGE_REGISTRY/$ECR_IMAGE_NAMESPACE/dev-builder-riscv64:latest
|
|
|
|
release-dev-builder-images-cn: # Note: Be careful issue: https://github.com/containers/skopeo/issues/1874 and we decide to use the latest stable skopeo container.
|
|
name: Release dev builder images to CN region
|
|
runs-on: ubuntu-latest
|
|
needs: [
|
|
release-dev-builder-images
|
|
]
|
|
steps:
|
|
- name: Login to AliCloud Container Registry
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ${{ vars.ACR_IMAGE_REGISTRY }}
|
|
username: ${{ secrets.ALICLOUD_USERNAME }}
|
|
password: ${{ secrets.ALICLOUD_PASSWORD }}
|
|
|
|
- name: Push dev-builder-ubuntu image
|
|
shell: bash
|
|
if: ${{ inputs.release_dev_builder_ubuntu_image || github.event_name == 'push' }}
|
|
env:
|
|
IMAGE_VERSION: ${{ needs.release-dev-builder-images.outputs.version }}
|
|
IMAGE_NAMESPACE: ${{ vars.IMAGE_NAMESPACE }}
|
|
ACR_IMAGE_REGISTRY: ${{ vars.ACR_IMAGE_REGISTRY }}
|
|
run: |
|
|
docker run -v "${DOCKER_CONFIG:-$HOME/.docker}:/root/.docker:ro" \
|
|
-e "REGISTRY_AUTH_FILE=/root/.docker/config.json" \
|
|
quay.io/skopeo/stable:latest \
|
|
copy -a docker://docker.io/$IMAGE_NAMESPACE/dev-builder-ubuntu:$IMAGE_VERSION \
|
|
docker://$ACR_IMAGE_REGISTRY/$IMAGE_NAMESPACE/dev-builder-ubuntu:$IMAGE_VERSION
|
|
|
|
- name: Push dev-builder-centos image
|
|
shell: bash
|
|
if: ${{ inputs.release_dev_builder_centos_image || github.event_name == 'push' }}
|
|
env:
|
|
IMAGE_VERSION: ${{ needs.release-dev-builder-images.outputs.version }}
|
|
IMAGE_NAMESPACE: ${{ vars.IMAGE_NAMESPACE }}
|
|
ACR_IMAGE_REGISTRY: ${{ vars.ACR_IMAGE_REGISTRY }}
|
|
run: |
|
|
docker run -v "${DOCKER_CONFIG:-$HOME/.docker}:/root/.docker:ro" \
|
|
-e "REGISTRY_AUTH_FILE=/root/.docker/config.json" \
|
|
quay.io/skopeo/stable:latest \
|
|
copy -a docker://docker.io/$IMAGE_NAMESPACE/dev-builder-centos:$IMAGE_VERSION \
|
|
docker://$ACR_IMAGE_REGISTRY/$IMAGE_NAMESPACE/dev-builder-centos:$IMAGE_VERSION
|
|
|
|
- name: Push dev-builder-android image
|
|
shell: bash
|
|
if: ${{ inputs.release_dev_builder_android_image || github.event_name == 'push' }}
|
|
env:
|
|
IMAGE_VERSION: ${{ needs.release-dev-builder-images.outputs.version }}
|
|
IMAGE_NAMESPACE: ${{ vars.IMAGE_NAMESPACE }}
|
|
ACR_IMAGE_REGISTRY: ${{ vars.ACR_IMAGE_REGISTRY }}
|
|
run: |
|
|
docker run -v "${DOCKER_CONFIG:-$HOME/.docker}:/root/.docker:ro" \
|
|
-e "REGISTRY_AUTH_FILE=/root/.docker/config.json" \
|
|
quay.io/skopeo/stable:latest \
|
|
copy -a docker://docker.io/$IMAGE_NAMESPACE/dev-builder-android:$IMAGE_VERSION \
|
|
docker://$ACR_IMAGE_REGISTRY/$IMAGE_NAMESPACE/dev-builder-android:$IMAGE_VERSION
|
|
- name: Push dev-builder-riscv64 image
|
|
shell: bash
|
|
if: ${{ inputs.release_dev_builder_riscv64_image || github.event_name == 'push' }}
|
|
env:
|
|
IMAGE_VERSION: ${{ needs.release-dev-builder-images.outputs.version }}
|
|
IMAGE_NAMESPACE: ${{ vars.IMAGE_NAMESPACE }}
|
|
ACR_IMAGE_REGISTRY: ${{ vars.ACR_IMAGE_REGISTRY }}
|
|
run: |
|
|
docker run -v "${DOCKER_CONFIG:-$HOME/.docker}:/root/.docker:ro" \
|
|
-e "REGISTRY_AUTH_FILE=/root/.docker/config.json" \
|
|
quay.io/skopeo/stable:latest \
|
|
copy -a docker://docker.io/$IMAGE_NAMESPACE/dev-builder-riscv64:$IMAGE_VERSION \
|
|
docker://$ACR_IMAGE_REGISTRY/$IMAGE_NAMESPACE/dev-builder-riscv64:$IMAGE_VERSION
|
|
|
|
update-dev-builder-image-tag:
|
|
name: Update dev-builder image tag
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
if: ${{ github.event_name == 'push' || inputs.update_dev_builder_image_tag }}
|
|
needs: [
|
|
release-dev-builder-images
|
|
]
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Update dev-builder image tag
|
|
shell: bash
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
./.github/scripts/update-dev-builder-version.sh ${{ needs.release-dev-builder-images.outputs.version }}
|
|
|
|
rebuild-query-regression-runner-image:
|
|
# Rebuilds the query-regression ECS runner image via the ops tool in
|
|
# .github/runner-scale-sets/query-regression/ecs-image/: boots a
|
|
# temporary pay-as-you-go ECS builder, snapshots a new custom image,
|
|
# then completes the documented lockstep updates:
|
|
# 1. bumps RUNNER_IMAGE_EPOCH in query-regression.yml (target-cache
|
|
# invalidation) via a PR from a timestamped ci/ branch (main is
|
|
# branch-protected; mirrors update-dev-builder-version.sh), and
|
|
# 2. points the repo variable QUERY_REGRESSION_ECS_IMAGE_ID at the
|
|
# new image. The runner toolchain is pinned inside the Dockerfile
|
|
# (nightly-2026-03-21, independent of rust-toolchain.toml — the
|
|
# benchmark must compile historical base checkouts), so image
|
|
# rebuilds do not change the cache ABI.
|
|
#
|
|
# Required repository configuration (same names the provisioning job
|
|
# uses): vars ALIYUN_ECS_REGION_ID, ALIYUN_ECS_VSWITCH_ID,
|
|
# ALIYUN_ECS_SECURITY_GROUP_ID, optionally ALIYUN_ECS_RESOURCE_GROUP_ID
|
|
# and ALIYUN_ECS_BASE_IMAGE_ID (deterministic base-image pin; otherwise
|
|
# the rebuild auto-resolves the latest public Ubuntu 26.04 image).
|
|
# Secrets: ALICLOUD_ECS_ACCESS_KEY_ID, ALICLOUD_ECS_ACCESS_KEY_SECRET,
|
|
# GH_PERSONAL_ACCESS_TOKEN (repo push + actions-variable write).
|
|
name: Rebuild query-regression runner image
|
|
needs: [changes]
|
|
if: ${{ github.repository == 'GreptimeTeam/greptimedb' && ((github.event_name == 'push' && needs.changes.outputs.query-regression-runner == 'true') || inputs.release_query_regression_runner_image) }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 150
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
|
|
# Keep the PAT credential for the epoch-bump push below.
|
|
persist-credentials: true
|
|
|
|
- name: Install uv
|
|
uses: astral-sh/setup-uv@v6
|
|
|
|
- name: Rebuild the runner image
|
|
id: rebuild
|
|
env:
|
|
ALIBABA_CLOUD_ACCESS_KEY_ID: ${{ secrets.ALICLOUD_ECS_ACCESS_KEY_ID }}
|
|
ALIBABA_CLOUD_ACCESS_KEY_SECRET: ${{ secrets.ALICLOUD_ECS_ACCESS_KEY_SECRET }}
|
|
run: |
|
|
set -euo pipefail
|
|
args=(
|
|
--region-id "${{ vars.ALIYUN_ECS_REGION_ID }}"
|
|
--vswitch-id "${{ vars.ALIYUN_ECS_VSWITCH_ID }}"
|
|
--security-group-id "${{ vars.ALIYUN_ECS_SECURITY_GROUP_ID }}"
|
|
--base-image-id "${{ vars.ALIYUN_ECS_BASE_IMAGE_ID }}"
|
|
)
|
|
if [[ -n "${{ vars.ALIYUN_ECS_RESOURCE_GROUP_ID }}" ]]; then
|
|
args+=(--resource-group-id "${{ vars.ALIYUN_ECS_RESOURCE_GROUP_ID }}")
|
|
fi
|
|
uv run .github/runner-scale-sets/query-regression/ecs-image/build-ecs-image.py \
|
|
"${args[@]}" 2>&1 | tee rebuild.log
|
|
image_id="$(sed -n 's/^Custom image ready: \([^ ]*\) .*/\1/p' rebuild.log | tail -n1)"
|
|
if [[ -z "${image_id}" ]]; then
|
|
echo "Error: no image id found in build output" >&2
|
|
exit 1
|
|
fi
|
|
echo "image_id=${image_id}" >> "$GITHUB_OUTPUT"
|
|
echo "## Rebuilt runner image" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "New image: \`${image_id}\`" >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
- name: Open the epoch-bump PR and update the image id variable
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
image_id="${{ steps.rebuild.outputs.image_id }}"
|
|
old_epoch="$(grep -oE 'readonly RUNNER_IMAGE_EPOCH="[0-9]+"' \
|
|
.github/workflows/query-regression.yml | grep -oE '[0-9]+' | head -n1)"
|
|
if [[ -z "${old_epoch}" ]]; then
|
|
echo "Error: RUNNER_IMAGE_EPOCH not found in query-regression.yml" >&2
|
|
exit 1
|
|
fi
|
|
new_epoch=$((old_epoch + 1))
|
|
|
|
# main is branch-protected (required reviews + status checks), so
|
|
# the epoch bump cannot be pushed there directly. Mirror
|
|
# .github/scripts/update-dev-builder-version.sh: timestamped bot
|
|
# branch, plain push, and a PR with reviewers. Do NOT use [skip ci]
|
|
# on the commit: the required checks must be able to run for the PR
|
|
# to become mergeable.
|
|
BRANCH="ci/update-query-regression-epoch-$(date +%Y%m%d%H%M%S)"
|
|
git config user.name "greptimedb-ci"
|
|
git config user.email "greptimedb-ci@greptime.com"
|
|
git fetch origin main
|
|
git checkout -b "${BRANCH}" origin/main
|
|
sed -i "s/readonly RUNNER_IMAGE_EPOCH=\"${old_epoch}\"/readonly RUNNER_IMAGE_EPOCH=\"${new_epoch}\"/" \
|
|
.github/workflows/query-regression.yml
|
|
git add .github/workflows/query-regression.yml
|
|
git commit -s -m "ci(query-regression): bump RUNNER_IMAGE_EPOCH to ${new_epoch} for image ${image_id}"
|
|
git push origin "${BRANCH}"
|
|
|
|
gh pr create \
|
|
--title "ci(query-regression): bump RUNNER_IMAGE_EPOCH to ${new_epoch}" \
|
|
--body "Auto-generated by the \`Rebuild query-regression runner image\` job in ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID} for image \`${image_id}\`. Merging this invalidates the query-regression target cache (RUNNER_IMAGE_EPOCH ${old_epoch} → ${new_epoch}). The \`QUERY_REGRESSION_ECS_IMAGE_ID\` repo variable already points at the new image; the epoch bump is belt-and-suspenders for image-content drift." \
|
|
--base main \
|
|
--head "${BRANCH}" \
|
|
--reviewer sunng87 \
|
|
--reviewer daviderli614 \
|
|
--reviewer killme2008 \
|
|
--reviewer evenyag \
|
|
--reviewer fengjiachun \
|
|
--reviewer WenyXu
|
|
|
|
# Point the variable at the new image once the PR exists. Image
|
|
# rebuilds keep the same pinned toolchain, so the cache ABI is
|
|
# unchanged and not waiting for the PR merge is fine.
|
|
gh api -X PATCH "repos/${{ github.repository }}/actions/variables/QUERY_REGRESSION_ECS_IMAGE_ID" \
|
|
-f value="${image_id}"
|
|
|
|
echo "## Lockstep updates" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "- QUERY_REGRESSION_ECS_IMAGE_ID → \`${image_id}\`" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "- RUNNER_IMAGE_EPOCH → \`${new_epoch}\` (PR on \`${BRANCH}\`, pending review/merge)" >> "$GITHUB_STEP_SUMMARY"
|