ci: auto-pin active ePHPm image tags to the latest published release - #8
Open
luthermonson wants to merge 1 commit into
Open
luthermonson wants to merge 1 commit into
luthermonson wants to merge 1 commit into
Conversation
Add a scheduled workflow that keeps the lab's ACTIVE ePHPm pins tracking the newest published ephpm/ephpm version, opening a PR when one appears, without ever touching the historical suites. - .github/ephpm-active-pins.txt: deterministic manifest enumerating exactly the active files + shell variables (IMG, CURRENT_IMAGE). Anything not listed is never modified. - .github/scripts/bump-ephpm-pin.sh: standalone bump script with --dry-run, --version X.Y.Z and --print-version. Latest is resolved from Docker Hub (newest semver with both -php8.4 and -php8.5 variants) — not GitHub Releases, which the dind CI bug makes unreliable. Idempotent. Preserves each pin's -php<minor> suffix and byte-exact line endings (perl). Skips any line containing HISTORICAL_IMAGE or the marker `ephpm-pin:historical`. - .github/workflows/pin-ephpm.yml: schedule (daily 06:17 UTC) + workflow_dispatch + repository_dispatch(ephpm-released); opens/updates a PR via peter-evans/create-pull-request pinned by SHA (v7.0.11). Review, not auto-merge. - .github/AUTO-PIN.md: how it works + the optional repository_dispatch immediacy add-on (needs a lab-write token in ephpm/ephpm; the poll covers it with zero extra auth).
|
ePHPm Preview — deployed (health check pending)
Preview updates automatically on each push to this PR. |
|
ePHPm Preview — deployed (health check pending)
Preview updates automatically on each push to this PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a scheduled GitHub Actions workflow that keeps the lab's active ePHPm image pins tracking the latest published
ephpm/ephpmversion, opening a PR when a newer version appears — without ever touching the historical suites. All rules are deterministic; no per-run judgement.The moving parts
.github/ephpm-active-pins.txtIMG,CURRENT_IMAGE) are active. Anything not listed is never modified..github/scripts/bump-ephpm-pin.sh--dry-run,--version X.Y.Z,--print-version. Idempotent. Preserves each pin's-php<minor>suffix and byte-exact line endings (perl). Skips any line containingHISTORICAL_IMAGEor the markerephpm-pin:historical..github/workflows/pin-ephpm.ymlschedule(daily 06:17 UTC) +workflow_dispatch(optionalversion) +repository_dispatch(types: [ephpm-released]). Uses the built-inGITHUB_TOKEN(runs in-repo)..github/AUTO-PIN.mdrepository_dispatchimmediacy add-on."Latest" comes from Docker Hub, not GitHub Releases
The dind CI bug means images can publish without a Release, so Releases are unreliable. "Latest" = the newest semver tag on Docker Hub for which both
-php8.4and-php8.5variants exist (k8s pins are php8.4; the DB cluster suite is php8.5).Active (bumped) vs historical (never touched)
Active: the 12 k8s image pins in
k8s/*.yaml(php8.4);IMGindb/bench-cluster.shandCURRENT_IMAGEinscripts/run-db-bench.sh(php8.5); "current pin" prose inREADME.md,RUNTIMES-BENCH.md,k8s/OPCACHE-CLUSTER.md.Never touched: pre-v0.7.0 rusqlite/sqld scripts (
db/bench-{engines,proxy,bridge,wordpress-bridge,admission}.sh,db/probe-*.sh);scripts/run-db-bench.sh'sHISTORICAL_IMAGE(protected two ways — not the named var, plus theHISTORICAL_IMAGEskip guard); recorded-result markdown (DB-BENCH.md,docs/*,scale/reports/*);rr/Dockerfile.Verification (deterministic proofs)
Idempotence —
bump-ephpm-pin.sh --dry-runat the current state:Correct scoping —
--dry-run --version 0.99.9bumps exactly 12 files (12 k8s image pins + both clusterIMG/CURRENT_IMAGE+ current-pin prose), and a real run confirmed viagit diffthatHISTORICAL_IMAGEstaysv0.6.3-php8.5, README's historicalv0.6.3prose is intact, and the pre-v0.7.0 scripts,.mdrecords, andrr/Dockerfileare untouched.actionlinton the workflow: clean.bash -non the script: clean.Review, not auto-merge
Opens a PR for review rather than auto-merging — the active/historical distinction and bench-pin changes deserve a glance.
AUTO-PIN.mddocuments how to enable auto-merge later.peter-evans/create-pull-requestis pinned by commit SHA (22a9089= v7.0.11) for supply-chain hygiene.Optional immediacy add-on
Wiring
ephpm/ephpm's release to send arepository_dispatch(needs a lab-write token secret over there) would pin instantly; the scheduled poll already covers it with zero extra auth. That change is not made here.