From ef9ffe0a2cfdec55cbb339a60e50c6b45f2e7cb5 Mon Sep 17 00:00:00 2001 From: Maurus Decimus <11444311+mdecimus@users.noreply.github.com> Date: Thu, 10 Sep 2026 21:22:16 +0100 Subject: [PATCH] Fix CI job --- .github/workflows/ci-retry.yml | 29 +++++++++++++++++++ .github/workflows/ci.yml | 53 ++++++++++++++++++++++------------ Dockerfile.build | 19 ++++++++++-- 3 files changed, 79 insertions(+), 22 deletions(-) create mode 100644 .github/workflows/ci-retry.yml diff --git a/.github/workflows/ci-retry.yml b/.github/workflows/ci-retry.yml new file mode 100644 index 0000000..83f41bf --- /dev/null +++ b/.github/workflows/ci-retry.yml @@ -0,0 +1,29 @@ +name: "CI retry" + +on: + workflow_run: + workflows: ["CI"] + types: [completed] + +permissions: + actions: write + +jobs: + rerun: + name: Re-run failed jobs + if: > + github.event.workflow_run.conclusion == 'failure' && + github.event.workflow_run.run_attempt < 3 + runs-on: ubuntu-latest + steps: + - name: Re-run failed jobs + env: + GH_TOKEN: ${{ secrets.CI_RETRY_TOKEN || github.token }} + GH_REPO: ${{ github.repository }} + RUN_ID: ${{ github.event.workflow_run.id }} + RUN_ATTEMPT: ${{ github.event.workflow_run.run_attempt }} + run: | + set -eu + echo "Run $RUN_ID failed on attempt $RUN_ATTEMPT, re-running failed jobs" + sleep 60 + gh run rerun "$RUN_ID" --failed diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3488ce8..db0791d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,6 +18,8 @@ env: SCCACHE_GHA_ENABLED: true RUSTC_WRAPPER: sccache CARGO_TERM_COLOR: always + CARGO_NET_RETRY: 10 + CARGO_NET_GIT_FETCH_WITH_CLI: true AWS_LC_SYS_PREBUILT_NASM: 1 concurrency: @@ -43,7 +45,7 @@ jobs: if: github.event_name == 'push' || inputs.Docker steps: - name: Install Cosign - uses: sigstore/cosign-installer@v4.1.1 + uses: sigstore/cosign-installer@v4.1.2 - name: Log In to GitHub Container Registry uses: docker/login-action@v4 with: @@ -140,11 +142,24 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@v7 + + - name: Free disk space (heavy ARM targets) + if: contains(matrix.target, 'arm') || contains(matrix.target, 'aarch64') + run: | + df -h /mnt / + sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android /usr/local/.ghcup /usr/local/share/powershell /usr/share/swift /opt/hostedtoolcache/CodeQL + sudo docker image prune --all --force || true + df -h /mnt / - name: Add swap (heavy ARM targets) - if: contains(matrix.target, 'arm') + if: contains(matrix.target, 'arm') || contains(matrix.target, 'aarch64') run: | + mnt_avail=$(df --output=avail -k /mnt | tail -1) + if [ "$mnt_avail" -lt 18874368 ]; then + echo "Insufficient space on /mnt (${mnt_avail}K available), aborting swap setup" + exit 1 + fi sudo fallocate -l 16G /mnt/swapfile sudo chmod 600 /mnt/swapfile sudo mkswap /mnt/swapfile @@ -186,7 +201,7 @@ jobs: echo "checksum=$(yq -p toml -oy '.package[] | select((.source | contains("")) or (.checksum | contains("")))' Cargo.lock | sha256sum | awk '{print $1}')" >> "$GITHUB_OUTPUT" - name: Cache apt - uses: actions/cache@v5.0.5 + uses: actions/cache@v6.1.0 id: apt-cache with: path: | @@ -195,7 +210,7 @@ jobs: key: apt-cache-${{ hashFiles('Dockerfile.build') }} - name: Cache Cargo - uses: actions/cache@v5.0.5 + uses: actions/cache@v6.1.0 id: cargo-cache with: path: | @@ -204,7 +219,7 @@ jobs: key: cargo-cache-${{ steps.cal-dep-shasum.outputs.checksum }} - name: Inject cache into docker - uses: reproducible-containers/buildkit-cache-dance@v3.3.2 + uses: reproducible-containers/buildkit-cache-dance@v3.4.0 with: cache-map: | { @@ -251,7 +266,7 @@ jobs: targets: ${{(github.event_name == 'push' || inputs.Docker) && 'build,image' || 'build'}} - name: Upload Artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@v7.0.1 with: name: artifact-${{matrix.target}} path: | @@ -268,7 +283,7 @@ jobs: - name: Upload digest if: github.event_name == 'push' || inputs.Docker - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@v7.0.1 with: name: digests-${{matrix.suffix == '' && 'gnu' || 'musl'}}-${{ matrix.target }} path: ${{ runner.temp }}/digests/* @@ -276,7 +291,7 @@ jobs: retention-days: 1 - name: Upload GNU meta bake definition - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@v7.0.1 if: (github.event_name == 'push' || inputs.Docker) && endsWith(matrix.target,'gnu') && startsWith(matrix.target,'x86') with: name: bake-meta-gnu @@ -285,7 +300,7 @@ jobs: retention-days: 1 - name: Upload musl meta bake definition - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@v7.0.1 if: (github.event_name == 'push' || inputs.Docker) && endsWith(matrix.target,'musl') && startsWith(matrix.target,'x86') with: name: bake-meta-musl @@ -303,10 +318,10 @@ jobs: - target: x86_64-pc-windows-msvc steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@v7 - name: Run sccache-cache - uses: mozilla-actions/sccache-action@v0.0.9 + uses: mozilla-actions/sccache-action@v0.0.11 with: disable_annotations: true @@ -318,7 +333,7 @@ jobs: mv ./target/${{matrix.target}}/release/proxy.exe ./artifacts/proxy.exe - name: Upload Artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@v7.0.1 with: name: artifact-${{matrix.target}} path: artifacts @@ -334,10 +349,10 @@ jobs: - target: x86_64-apple-darwin steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@v7 - name: Run sccache-cache - uses: mozilla-actions/sccache-action@v0.0.9 + uses: mozilla-actions/sccache-action@v0.0.11 with: disable_annotations: true @@ -349,7 +364,7 @@ jobs: mv ./target/${{matrix.target}}/release/proxy ./artifacts/proxy - name: Upload Artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@v7.0.1 with: name: artifact-${{matrix.target}} path: artifacts @@ -367,7 +382,7 @@ jobs: # Must run before artifacts are downloaded: checkout cleans the workspace. - name: Checkout (for CHANGELOG) if: startsWith(github.ref, 'refs/tags/') - uses: actions/checkout@v6.0.2 + uses: actions/checkout@v7 - name: Download Artifacts uses: actions/download-artifact@v8 @@ -410,7 +425,7 @@ jobs: archive/**/*.zip - name: Use cosign to sign existing artifacts - uses: sigstore/gh-action-sigstore-python@v3.3.0 + uses: sigstore/gh-action-sigstore-python@v3.5.0 with: inputs: | archive/**/*.tar.gz @@ -461,7 +476,7 @@ jobs: cleanup: name: Cleanup failed release needs: [linux, windows, macos, multiarch, release] - if: failure() && startsWith(github.ref, 'refs/tags/') + if: failure() && startsWith(github.ref, 'refs/tags/') && github.run_attempt >= 3 runs-on: ubuntu-latest permissions: contents: write diff --git a/Dockerfile.build b/Dockerfile.build index 5a9acfe..5a3255c 100644 --- a/Dockerfile.build +++ b/Dockerfile.build @@ -9,6 +9,8 @@ FROM --platform=$BUILDPLATFORM rust:slim-trixie AS base ENV DEBIAN_FRONTEND="noninteractive" \ BINSTALL_DISABLE_TELEMETRY=true \ CARGO_TERM_COLOR=always \ + CARGO_NET_RETRY=10 \ + CARGO_NET_GIT_FETCH_WITH_CLI=true \ LANG=C.UTF-8 \ TZ=UTC \ TERM=xterm-256color \ @@ -21,7 +23,7 @@ RUN \ rm -f /etc/apt/apt.conf.d/docker-clean && \ echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' >/etc/apt/apt.conf.d/keep-cache && \ apt-get update && \ - apt-get install -yq --no-install-recommends ca-certificates curl jq xz-utils make libclang-19-dev + apt-get install -yq --no-install-recommends ca-certificates curl git jq xz-utils make libclang-19-dev # Zig is pinned to 0.13.0. Zig 0.14+ changed how its default target ABI is # resolved for `x86_64-linux-gnu`-style triples, and on this dependency tree # (aws-lc-sys, libsqlite3-sys, rust-std 1.87+) that surfaces as ld.lld @@ -34,8 +36,19 @@ RUN \ zig version # Install cargo-binstall RUN curl --retry 5 -fL --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash -# Install cargo-chef & sccache & cargo-zigbuild -RUN cargo binstall --no-confirm cargo-chef sccache cargo-zigbuild +# Install cargo-chef & sccache & cargo-zigbuild. Versions are pinned so that an +# upstream release without prebuilt binaries for this platform cannot silently +# turn this into a from-source build, and the `compile` strategy is disabled +# because that fallback needs an OpenSSL toolchain this image does not carry: +# it burns minutes and then fails. A transient GitHub fetch failure is retried. +RUN \ + for attempt in 1 2 3; do \ + cargo binstall --no-confirm --disable-strategies compile \ + cargo-chef@0.1.78 sccache@0.17.0 cargo-zigbuild@0.23.2 && break; \ + echo "cargo binstall attempt ${attempt} failed, retrying"; \ + sleep $((attempt * 15)); \ + done && \ + command -v cargo-chef && command -v sccache && command -v cargo-zigbuild # ***************** # Planner