mirror of https://github.com/wolfSSL/wolfssl.git
b8d44ecc65
* CI: resolve the ghcr .deb bundle against its own apt index
The bundle was resolved on master right after apt-get update, against the
live archive; consumers resolved against the apt lists frozen into the
runner image days earlier. Any version published in between made
--no-download ask for a .deb the bundle did not carry, and the
all-or-nothing install sent the whole set to the mirror. 25% of PR jobs
took that path, and in 16 of 20 sampled cases the mirror then supplied
zero bytes - the bundle was complete, only the index disagreed.
ci-deps-image now ships a dpkg-scanpackages index in each bundle and
install-apt-deps resolves against only that, as a local file:// repository
with its own lists dir. Producer and consumer agree by construction, so
only a package genuinely absent from the bundle falls back.
Also:
- rebuild the static bundles daily and on a merged package-list change,
instead of weekly
- pq-all gets its own -cross bundle; crossbuild-essential-* were in no
24.04 list, so it fetched 118 MB from the mirror on every run
- ccache-setup installs from the repository install-apt-deps exported,
rather than from debs staged in /var/cache/apt/archives
- check-ci-deps.py fails a PR whose install-apt-deps call names a package
its bundle does not carry, a tag that does not exist, or a tag for the
wrong Ubuntu release; wired into check-source-text
- ci-deps-canary asserts the same contract dynamically after every
rebuild, with require-bundle turning a fallback into an error
- whitebox-smoke used a bare apt-get; it now uses the bundle
* Address review: fail check-ci-deps.py in --matrix/--sets mode
Static contract violations printed ::error but exited 0, so ci-deps-canary
could not fail on them. Those modes also hand stdout to their caller as
data, so findings went to stderr and would have corrupted it.
Route findings to stderr in the two data modes, return non-zero when any
were found, and read --sets output from a file in the canary so the exit
status is not swallowed by process substitution.
* CI: make the .deb bundles reach container jobs
sssd.yml runs in a container, and install-apt-deps skipped the bundle
there for two reasons, both of which left it on the apt mirror - where a
slow archive killed apt-get update twice and failed the job.
1. No docker CLI inside a job container, so the bundle was never pulled.
ghcr-pull.sh pulls it from the registry with curl and tar instead.
2. A bundle is a closure relative to what was already installed where it
was resolved. -full is resolved on the runner, which already has bc and
libcap2, so neither .deb was in it and the all-or-nothing offline
install could never succeed inside the container. ci-deps-image now
takes an `image` per matrix entry and resolves that bundle inside it;
sssd.yml gets its own ubuntu-24.04-sssd bundle, a handful of .debs
rather than 480 MB.
check-ci-deps.py holds the two sides together - a container job must name
a bundle built in its own image, and no other job may name it - and
ci-deps-canary proves each image-tied bundle inside that image after every
rebuild. install-apt-deps also checks the bundle's release against
/etc/os-release, which the static check cannot see for a container job.
Also fix the apt fallback's budget split, which is what actually failed
the job: update was capped at a sixth of an attempt, 50s, well under the
~90s apt's own Acquire retries need to get past a stalled mirror. It is
now half an attempt capped at 90s, taken from the budget still unspent,
so the loop uses the 600s it was given instead of giving up after 105s.
* Address review: record the image the closure was resolved in
bundle-info reported ${ImageOS}/${ImageVersion}, which is the runner's
OS even for a matrix entry whose closure is resolved inside a container.
Report the container image for those entries and keep the runner on its
own line.
|
||
|---|---|---|
| .. | ||
| zephyr-4.x | ||
| check-ci-deps.py | ||
| check-headers.sh | ||
| check-source-text.sh | ||
| check-workflow-health.py | ||
| check-workflows.py | ||
| download-deb-closure.sh | ||
| openssl-ech.sh | ||
| parallel-make-check.py | ||
| set-user-setting.sh | ||
| tls-anvil-test.sh | ||