Nothing Special   »   [go: up one dir, main page]

Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

allow to sign apt debians #16370

Open
wants to merge 13 commits into
base: compatible
Choose a base branch
from
Open

Conversation

dkijania
Copy link
Member
@dkijania dkijania commented Nov 19, 2024

Another PR ss part of grand debian repo improvment plan:

notion.so/o1labs/Enterprise-debian-repository-118e79b1f91080cc98cddb337347413a

In order to leverage security of our debian repository we should allow to sign our packages. This PR introduces optional sign operation when uploading debians to debian repo. Currently it is disabled, not to break current process

@dkijania dkijania changed the base branch from master to compatible November 20, 2024 08:49
@dkijania
Copy link
Member Author

!ci-build-me

@dkijania
Copy link
Member Author

!ci-nightly-me

@coveralls
Copy link

Coverage Status

coverage: 61.792% (-0.001%) from 61.793%
when pulling 1f93250 on dkijania/sign_apt_debians
into ec43a6b on compatible.

@dkijania
Copy link
Member Author

!ci-build-me

@dkijania
Copy link
Member Author

!ci-nightly-me

@dkijania dkijania marked this pull request as ready for review November 27, 2024 11:32
@dkijania dkijania requested review from a team as code owners November 27, 2024 11:32
@dkijania
Copy link
Member Author

Nightly are failing due to develop conflict. When this will be resolved nightly will reach teardown phase and I can prove that publishing is still working good

@SanabriaRusso
Copy link
Collaborator

I think this is a good opportunity to take a moment to figure out a way to test this kind of PRs i.e., those involving the publishing of container images and Debians, or Post Tear Down, in general.

As these are moved to the "Tear Down" phase, which is not started unless ALL previous Jobs pass; CI does not really perform a test of the involved code if there are conflicts with develop or master.

At this moment, we would only be able to test ANY change to the publishing phase "after the fact" i.e., merging.

I want to call attention to this and maybe discuss a path for testing "Post Tear Down" Jobs. What do you think? @dkijania

@dkijania
Copy link
Member Author

@SanabriaRusso Good point.From one side, merges checks are really useful as they help us distribute effort of merging compatible/develop to master way before we need it. From other side they are a bit painful as we need to create separate PR and molest reviews for approvals.
If PR is conflicted than it means it won't be merged therefore we don't really need debian and dockers produced by this CI job. We are saving some resources 😄 If we need to generate debian/docker from our branch for any reason we can use command: !ci-docker-me and !ci-debian-me which will ran separate pipeline which will produce some artifacts (https://buildkite.com/o-1-labs-2/mina-build-docker) - it is still not perfect (as we need to do some research in order to acquire builds).
So one approach would be to leave it as it is and just accept that some PR (especially CI related) can suffer (I'm ok with that)
Another approach would be to separate merges as another CI stage at the beginning (currently we have 3 - quick-tests/long-tests/teardown) and allow failures from merges stage (which will mark pipeline as red anyhow).

In this particular PR is tested my code on another pipeline which was tear down only. I modified my code so it always wanted to publish already built debians from nightly. Once it was ok. I ran nightly. I agree that it is not really fun testing such pr but they are not very frequent.

However, moving merges into separate group and work more on more tailored pipeline IMHO is a good direction alone

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants