villebro commented on code in PR #44250:
URL: https://github.com/apache/superset/pull/44250#discussion_r4053647862
##########
.github/workflows/docker.yml:
##########
@@ -162,15 +226,27 @@ jobs:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
BUILD_PRESET: ${{ matrix.build_preset }}
run: |
- # Single platform builds in pull_request context to speed things up
- if [ "$GITHUB_EVENT_NAME" = "push" ]; then
+ set -euo pipefail
+ BUILD_CONTEXT="$GITHUB_EVENT_NAME"
+ BUILD_CONTEXT_REF=""
+ PUBLISH_DOCKER_CACHE=""
+
+ if [ "$GITHUB_EVENT_NAME" = "push" ] && [ "$GITHUB_REF" =
"refs/heads/master" ]; then
PLATFORM_ARG="--platform linux/arm64 --platform linux/amd64"
- # can only --load images in single-platform builds
PUSH_OR_LOAD="--push"
Review Comment:
Correct — the lock serializes the matrix but does not order what enters it,
and queue arrival order was doing work it cannot actually guarantee.
Fixed in cf214febd7 with a tip guard rather than ordering assumptions. New
`scripts/docker-publish-guard.sh` takes the event, ref, building SHA and branch
tip and emits `PUBLISH=true|false`: master pushes publish only while their
commit is still the tip, everything else (release branches, PRs) passes through
untouched since those builds are `--load` and move no mutable tag. A superseded
run skips instead of republishing, and every later step in `docker-build` is
gated on the result, because a skipped build leaves no `$IMAGE_TAG` for the
pull/scan/smoke-test steps to act on. `git ls-remote` runs only for master
pushes, needs no credentials on a public repo, and retries three times; an
unresolvable tip fails closed rather than publishing from a possibly stale
commit.
The delayed-A/fast-B case you asked for is now in the always-on
`docker-command-check`, next to the existing `assert_build_plan` calls:
```
assert_publish_guard push refs/heads/master aaaa111 aaaa111 true
assert_publish_guard push refs/heads/master aaaa111 bbbb222 false #
delayed A after fast B
assert_publish_guard push refs/heads/7.0 aaaa111 bbbb222 true
assert_publish_guard pull_request refs/pull/44250/merge aaaa111 bbbb222 true
```
One residual worth naming: a run that *is* the tip when it enters the lock
can still be overtaken during its ~40 minute build. Because the lock is
serialized per branch and preset, the later push publishes after it and the
final tag state is correct — only a transient window shows the older digest.
Closing that entirely means splitting build and push into separate phases,
which I would rather not fold into this PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
