From 998b7c5dd7e71bbf0a509678d42cd28cc97df56f Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 26 Jul 2026 09:34:21 +0000 Subject: [PATCH] ci: make image input refreshes deterministic --- .gitea/workflows/refresh-image-locks.yml | 32 +++++++++--------------- bot_bottle/contrib/pi/package-lock.json | 12 ++++----- docs/image-build-inputs.md | 11 ++++---- 3 files changed, 24 insertions(+), 31 deletions(-) diff --git a/.gitea/workflows/refresh-image-locks.yml b/.gitea/workflows/refresh-image-locks.yml index 5402ad30..f45b3cf3 100644 --- a/.gitea/workflows/refresh-image-locks.yml +++ b/.gitea/workflows/refresh-image-locks.yml @@ -16,7 +16,7 @@ on: - '.gitea/workflows/refresh-image-locks.yml' permissions: - code: write + code: read jobs: refresh: @@ -25,9 +25,19 @@ jobs: - name: Checkout uses: actions/checkout@v4 + - name: Use the image Python version + uses: actions/setup-python@v5 + with: + python-version: '3.12.13' + + - name: Use the image Node version + uses: actions/setup-node@v4 + with: + node-version: '22.23.1' + - name: Compile gateway Python lock run: | - python3 -m pip install --break-system-packages pip-tools==7.5.1 + python3 -m pip install pip-tools==7.5.1 python3 -m piptools compile \ --generate-hashes \ --output-file requirements.gateway.lock \ @@ -59,24 +69,6 @@ jobs: sha256sum install.sh > install.sh.sha256 ) - - name: Commit refreshed inputs on feature branches - run: | - if [ "${{ gitea.ref_name }}" = "main" ]; then - exit 0 - fi - git config user.name "Gitea Actions" - git config user.email "actions@noreply.gitea.dideric.is" - git add \ - requirements.gateway.lock \ - bot_bottle/contrib/claude/package-lock.json \ - bot_bottle/contrib/pi/package-lock.json \ - bot_bottle/contrib/codex/install.sh.sha256 - if git diff --cached --quiet; then - exit 0 - fi - git commit -m "build: refresh image input locks" - git push origin "HEAD:${{ gitea.ref_name }}" - - name: Upload refreshed inputs uses: actions/upload-artifact@v3 with: diff --git a/bot_bottle/contrib/pi/package-lock.json b/bot_bottle/contrib/pi/package-lock.json index 69e265ef..75671bbd 100644 --- a/bot_bottle/contrib/pi/package-lock.json +++ b/bot_bottle/contrib/pi/package-lock.json @@ -1047,6 +1047,7 @@ "node_modules/@earendil-works/pi-coding-agent/node_modules/@earendil-works/pi-agent-core": { "version": "0.81.1", "resolved": "https://registry.npmjs.org/@earendil-works/pi-agent-core/-/pi-agent-core-0.81.1.tgz", + "integrity": "sha512-yqbh68CyhqxMov/jUogFJfMqlu2Gd37GAki+tr59YCmAPHfomiCA5ESzusXtpGzABeiZFC/OrRdQ4GwCCOMIHA==", "license": "MIT", "dependencies": { "@earendil-works/pi-ai": "^0.81.1", @@ -1056,12 +1057,12 @@ }, "engines": { "node": ">=22.19.0" - }, - "integrity": "sha512-yqbh68CyhqxMov/jUogFJfMqlu2Gd37GAki+tr59YCmAPHfomiCA5ESzusXtpGzABeiZFC/OrRdQ4GwCCOMIHA==" + } }, "node_modules/@earendil-works/pi-coding-agent/node_modules/@earendil-works/pi-ai": { "version": "0.81.1", "resolved": "https://registry.npmjs.org/@earendil-works/pi-ai/-/pi-ai-0.81.1.tgz", + "integrity": "sha512-hzHE7Z8l5mgJk+ke67Lge0rwS2+wbKJrFKl9o5M1R1rh33+cCT7D1AHz1OAtX5wFs90E1/BTGhyJRTUHaMxGvQ==", "license": "MIT", "dependencies": { "@anthropic-ai/sdk": "0.91.1", @@ -1081,12 +1082,12 @@ }, "engines": { "node": ">=22.19.0" - }, - "integrity": "sha512-hzHE7Z8l5mgJk+ke67Lge0rwS2+wbKJrFKl9o5M1R1rh33+cCT7D1AHz1OAtX5wFs90E1/BTGhyJRTUHaMxGvQ==" + } }, "node_modules/@earendil-works/pi-coding-agent/node_modules/@earendil-works/pi-tui": { "version": "0.81.1", "resolved": "https://registry.npmjs.org/@earendil-works/pi-tui/-/pi-tui-0.81.1.tgz", + "integrity": "sha512-OMEe+Zt8oQYi/rCq3upxsTlIScWL0FPhXwQus34TbQb3EmTx88S7Uzx32JxvQiEeWOw8eDCdJf2PBUBE9r6wIg==", "license": "MIT", "dependencies": { "get-east-asian-width": "1.6.0", @@ -1094,8 +1095,7 @@ }, "engines": { "node": ">=22.19.0" - }, - "integrity": "sha512-OMEe+Zt8oQYi/rCq3upxsTlIScWL0FPhXwQus34TbQb3EmTx88S7Uzx32JxvQiEeWOw8eDCdJf2PBUBE9r6wIg==" + } }, "node_modules/@earendil-works/pi-coding-agent/node_modules/@google/genai": { "version": "1.52.0", diff --git a/docs/image-build-inputs.md b/docs/image-build-inputs.md index 96bcccc4..59efb2fe 100644 --- a/docs/image-build-inputs.md +++ b/docs/image-build-inputs.md @@ -35,11 +35,12 @@ dependency update: versions in the provider's `package.json`, or `CODEX_VERSION` in the Codex Dockerfile. Direct versions must be exact—no ranges, dist-tags, or unversioned package names. -4. Push the feature branch. The `refresh-image-locks` workflow regenerates the - pip/npm locks and Codex installer checksum, then adds a - `build: refresh image input locks` commit to that branch. It can also be run - manually; on `main` it uploads the candidates without committing them. -5. Review the lock diff and let both normal CI and `image-input-builds` pass. +4. Push the feature branch or manually run the `refresh-image-locks` workflow. + It regenerates the four derived files with the image's exact Python and Node + versions and uploads them as the `image-input-locks` artifact. It never + writes to the branch, so a refresh cannot race with developer pushes. +5. Download the artifact, replace the four committed files, review the lock + diff, and let both normal CI and `image-input-builds` pass. The latter checks both base architectures, builds every supported image, exercises the exact local Firecracker base-ID handoff, and runs each provider CLI's version smoke test.