This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch mirror-hardened-images-more-often
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to
refs/heads/mirror-hardened-images-more-often by this push:
new 5b0c442ce75 Run every build-info job on ubuntu-slim
5b0c442ce75 is described below
commit 5b0c442ce7544911e09a0b09f26693d819ab6336
Author: Jarek Potiuk <[email protected]>
AuthorDate: Fri Oct 30 13:57:17 2026 +0100
Run every build-info job on ubuntu-slim
Build-info jobs only install breeze and run selective checks, yet each
took a full public runner, cleaned its workspace with sudo and freed disk
space, none of which a fresh ubuntu-slim container needs.
Generated-by: Claude Opus 5
---
.github/workflows/ci-amd.yml | 10 +++++-----
.github/workflows/ci-arm.yml | 10 +++++-----
.github/workflows/publish-docs-to-s3.yml | 2 +-
.github/workflows/refresh-image-registry-cache.yml | 7 +++----
.github/workflows/release-constraints.yml | 7 +++----
.github/workflows/release_dockerhub_image.yml | 9 +++------
.github/workflows/scheduled-legacy-prod-image-canary.yml | 7 +++----
.github/workflows/update-constraints-on-push-stable.yml | 7 +++----
.github/workflows/update-constraints-on-push.yml | 7 +++----
9 files changed, 29 insertions(+), 37 deletions(-)
diff --git a/.github/workflows/ci-amd.yml b/.github/workflows/ci-amd.yml
index fb88f09e343..8af50f522b8 100644
--- a/.github/workflows/ci-amd.yml
+++ b/.github/workflows/ci-amd.yml
@@ -263,8 +263,9 @@ jobs:
if: >-
needs.gate.outputs.project-ci == 'true' &&
needs.check-run-needed.outputs.run-needed == 'true'
- # At build-info stage we do not yet have outputs so we need to hard-code
the runs-on to public runners
- runs-on: ["ubuntu-22.04"]
+ # At build-info stage we do not yet have outputs so the runs-on is
hard-coded. ubuntu-slim is enough:
+ # it only installs breeze and runs selective checks, which need neither
docker nor freeing disk space.
+ runs-on: ["ubuntu-slim"]
outputs:
all-python-versions-list-as-string: >-
${{ steps.selective-checks.outputs.all-python-versions-list-as-string
}}
@@ -378,9 +379,6 @@ jobs:
upgrade-to-newer-dependencies: ${{
steps.selective-checks.outputs.upgrade-to-newer-dependencies }}
is-uv-lock-update: ${{ steps.selective-checks.outputs.is-uv-lock-update
}}
steps:
- - name: "Cleanup repo"
- shell: bash
- run: sudo rm -rf ${GITHUB_WORKSPACE}/*
- name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
with:
@@ -403,6 +401,8 @@ jobs:
|| echo "::warning::Could not fetch ${PUSH_BASE_COMMIT}, all tests
will run"
- name: "Install Breeze"
uses: ./.github/actions/breeze
+ with:
+ free-space: "false"
id: breeze
- name: "Save github context to file"
# The github context can be very large for PRs that touch many files
(e.g. Dependabot
diff --git a/.github/workflows/ci-arm.yml b/.github/workflows/ci-arm.yml
index 7b88dea02a8..09b0967b490 100644
--- a/.github/workflows/ci-arm.yml
+++ b/.github/workflows/ci-arm.yml
@@ -144,8 +144,9 @@ jobs:
name: "Build info"
needs: [check-run-needed]
if: needs.check-run-needed.outputs.run-needed == 'true'
- # At build-info stage we do not yet have outputs so we need to hard-code
the runs-on to public runners
- runs-on: ["ubuntu-22.04"]
+ # At build-info stage we do not yet have outputs so the runs-on is
hard-coded. ubuntu-slim is enough:
+ # it only installs breeze and runs selective checks, which need neither
docker nor freeing disk space.
+ runs-on: ["ubuntu-slim"]
outputs:
all-python-versions-list-as-string: >-
${{ steps.selective-checks.outputs.all-python-versions-list-as-string
}}
@@ -259,9 +260,6 @@ jobs:
upgrade-to-newer-dependencies: ${{
steps.selective-checks.outputs.upgrade-to-newer-dependencies }}
is-uv-lock-update: ${{ steps.selective-checks.outputs.is-uv-lock-update
}}
steps:
- - name: "Cleanup repo"
- shell: bash
- run: sudo rm -rf ${GITHUB_WORKSPACE}/*
- name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
with:
@@ -284,6 +282,8 @@ jobs:
|| echo "::warning::Could not fetch ${PUSH_BASE_COMMIT}, all tests
will run"
- name: "Install Breeze"
uses: ./.github/actions/breeze
+ with:
+ free-space: "false"
id: breeze
- name: "Save github context to file"
# The github context can be very large for PRs that touch many files
(e.g. Dependabot
diff --git a/.github/workflows/publish-docs-to-s3.yml
b/.github/workflows/publish-docs-to-s3.yml
index 4deb0b9132b..8cc9f6829fd 100644
--- a/.github/workflows/publish-docs-to-s3.yml
+++ b/.github/workflows/publish-docs-to-s3.yml
@@ -75,7 +75,7 @@ jobs:
build-info:
timeout-minutes: 10
name: "Build Info"
- runs-on: ["ubuntu-24.04"]
+ runs-on: ["ubuntu-slim"]
env:
VERBOSE: true
REF: ${{ inputs.ref }}
diff --git a/.github/workflows/refresh-image-registry-cache.yml
b/.github/workflows/refresh-image-registry-cache.yml
index e133222cf2d..2eb1821f474 100644
--- a/.github/workflows/refresh-image-registry-cache.yml
+++ b/.github/workflows/refresh-image-registry-cache.yml
@@ -65,7 +65,7 @@ jobs:
build-info:
name: "Build info"
# No outputs yet at this stage, so the runner has to be hard-coded to a
public one.
- runs-on: ["ubuntu-22.04"]
+ runs-on: ["ubuntu-slim"]
outputs:
default-branch: ${{ steps.selective-checks.outputs.default-branch }}
default-constraints-branch: ${{
steps.selective-checks.outputs.default-constraints-branch }}
@@ -75,15 +75,14 @@ jobs:
python-versions: ${{ steps.selective-checks.outputs.python-versions }}
use-uv: ${{ steps.selective-checks.outputs.force-pip == 'true' &&
'false' || 'true' }}
steps:
- - name: "Cleanup repo"
- shell: bash
- run: sudo rm -rf ${GITHUB_WORKSPACE}/*
- name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
with:
persist-credentials: false
- name: "Install Breeze"
uses: ./.github/actions/breeze
+ with:
+ free-space: "false"
- name: Selective checks
id: selective-checks
env:
diff --git a/.github/workflows/release-constraints.yml
b/.github/workflows/release-constraints.yml
index f1f1437c58f..cceb80cd5ee 100644
--- a/.github/workflows/release-constraints.yml
+++ b/.github/workflows/release-constraints.yml
@@ -52,7 +52,7 @@ jobs:
build-info:
timeout-minutes: 10
name: "Build info"
- runs-on: ["ubuntu-22.04"]
+ runs-on: ["ubuntu-slim"]
if: contains(fromJSON('[
"ashb",
"eladkal",
@@ -74,9 +74,6 @@ jobs:
target-branch: ${{ steps.stage.outputs.target-branch }}
allow-pre-releases: ${{ steps.stage.outputs.allow-pre-releases }}
steps:
- - name: "Cleanup repo"
- shell: bash
- run: sudo rm -rf ${GITHUB_WORKSPACE}/*
- name: "Checkout ${{ inputs.ref }}"
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
with:
@@ -85,6 +82,8 @@ jobs:
persist-credentials: false
- name: "Install Breeze"
uses: ./.github/actions/breeze
+ with:
+ free-space: "false"
id: breeze
- name: "Save github context to file"
# See ci-amd.yml for the full rationale: avoids ARG_MAX on big PRs by
writing the
diff --git a/.github/workflows/release_dockerhub_image.yml
b/.github/workflows/release_dockerhub_image.yml
index fb81f83d8ac..dad4ac52f7e 100644
--- a/.github/workflows/release_dockerhub_image.yml
+++ b/.github/workflows/release_dockerhub_image.yml
@@ -44,7 +44,7 @@ jobs:
build-info:
timeout-minutes: 10
name: "Build Info"
- runs-on: ["ubuntu-24.04"]
+ runs-on: ["ubuntu-slim"]
outputs:
pythonVersions: ${{
steps.determine-python-versions.outputs.python-versions }}
platformMatrix: ${{ steps.determine-matrix.outputs.platformMatrix }}
@@ -81,17 +81,14 @@ jobs:
echo "Airflow version: '${AIRFLOW_VERSION}'"
echo "AMD only: '${AMD_ONLY}'"
echo "Limit python versions: '${LIMIT_PYTHON_VERSIONS}'"
- - name: "Cleanup repo"
- shell: bash
- run: >
- sudo rm -rf ${GITHUB_WORKSPACE}/*
-
- name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
with:
persist-credentials: false
- name: "Install Breeze"
uses: ./.github/actions/breeze
+ with:
+ free-space: "false"
- name: "Save github context to file"
# See ci-amd.yml for the full rationale: avoids ARG_MAX on big PRs by
writing the
# github context to a file, and the single-quoted heredoc makes the
zizmor
diff --git a/.github/workflows/scheduled-legacy-prod-image-canary.yml
b/.github/workflows/scheduled-legacy-prod-image-canary.yml
index 1f069498daa..db8b8a154eb 100644
--- a/.github/workflows/scheduled-legacy-prod-image-canary.yml
+++ b/.github/workflows/scheduled-legacy-prod-image-canary.yml
@@ -36,7 +36,7 @@ concurrency:
jobs:
build-info:
name: "Build info"
- runs-on: ["ubuntu-22.04"]
+ runs-on: ["ubuntu-slim"]
if: github.repository == 'apache/airflow' || github.event_name ==
'workflow_dispatch'
timeout-minutes: 15
outputs:
@@ -72,9 +72,6 @@ jobs:
run-ui-e2e-tests: ${{ steps.selective-checks.outputs.run-ui-e2e-tests }}
use-uv: ${{ steps.selective-checks.outputs.force-pip == 'true' &&
'false' || 'true' }}
steps:
- - name: "Cleanup repo"
- shell: bash
- run: sudo rm -rf ${GITHUB_WORKSPACE}/*
- name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
with:
@@ -82,6 +79,8 @@ jobs:
persist-credentials: false
- name: "Install Breeze"
uses: ./.github/actions/breeze
+ with:
+ free-space: "false"
- name: "Save github context to file"
# Same as in ci-amd.yml: a scheduled or dispatched run has no
attacker-controlled context, and
# the single-quoted heredoc disables every shell expansion of the JSON
anyway.
diff --git a/.github/workflows/update-constraints-on-push-stable.yml
b/.github/workflows/update-constraints-on-push-stable.yml
index 47379a8933d..b4904dbed54 100644
--- a/.github/workflows/update-constraints-on-push-stable.yml
+++ b/.github/workflows/update-constraints-on-push-stable.yml
@@ -35,7 +35,7 @@ env:
jobs:
build-info:
name: "Build info"
- runs-on: ["ubuntu-22.04"]
+ runs-on: ["ubuntu-slim"]
outputs:
default-branch: ${{ steps.selective-checks.outputs.default-branch }}
default-constraints-branch: ${{
steps.selective-checks.outputs.default-constraints-branch }}
@@ -43,9 +43,6 @@ jobs:
python-versions: ${{ steps.selective-checks.outputs.python-versions }}
python-versions-list-as-string: ${{
steps.selective-checks.outputs.python-versions-list-as-string }}
steps:
- - name: "Cleanup repo"
- shell: bash
- run: sudo rm -rf ${GITHUB_WORKSPACE}/*
- name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
with:
@@ -58,6 +55,8 @@ jobs:
persist-credentials: false
- name: "Install Breeze"
uses: ./.github/actions/breeze
+ with:
+ free-space: "false"
id: breeze
- name: "Save github context to file"
# See ci-amd.yml for the full rationale: avoids ARG_MAX on big PRs by
writing the
diff --git a/.github/workflows/update-constraints-on-push.yml
b/.github/workflows/update-constraints-on-push.yml
index 4ffe806242f..6dbce8cbac4 100644
--- a/.github/workflows/update-constraints-on-push.yml
+++ b/.github/workflows/update-constraints-on-push.yml
@@ -73,7 +73,7 @@ env:
jobs:
build-info:
name: "Build info"
- runs-on: ["ubuntu-22.04"]
+ runs-on: ["ubuntu-slim"]
# Automatic uv.lock-push runs are unrestricted; manual (workflow_dispatch)
# runs are limited to release managers (same allowlist as the prod image
# release workflow) because they push to the protected constraints-*
branches.
@@ -101,9 +101,6 @@ jobs:
python-versions-list-as-string: ${{
steps.selective-checks.outputs.python-versions-list-as-string }}
constraints-baseline-sha: ${{ steps.constraints-baseline.outputs.sha }}
steps:
- - name: "Cleanup repo"
- shell: bash
- run: sudo rm -rf ${GITHUB_WORKSPACE}/*
- name: "Checkout ${{ inputs.ref || github.ref }} ( ${{ inputs.ref ||
github.sha }} )"
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
with:
@@ -112,6 +109,8 @@ jobs:
persist-credentials: false
- name: "Install Breeze"
uses: ./.github/actions/breeze
+ with:
+ free-space: "false"
id: breeze
- name: "Save github context to file"
# See ci-amd.yml for the full rationale: avoids ARG_MAX on big PRs by
writing the
