From 7c35977fcb07a96e792185ea51edf4055ab20eb7 Mon Sep 17 00:00:00 2001 From: rcourtman Date: Wed, 27 May 2026 22:08:15 +0100 Subject: [PATCH] Fix post-publish pipeline failures for v6.0.0-rc.6 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit promote-floating-tags.yml waited on rcourtman/pulse-agent:${TAG} and promoted floating tags for it, but publish-docker.yml never pushes the agent image — Pulse Agent ships as GitHub Release binaries (publish-docker.yml line 199 confirms). The wait timed out after 5 minutes on every release since the pulse-agent push step was removed, leaving floating tags unpromoted. Stripped the vestigial wait block, the agent promote step, and the agent line in the summary. Updated header comments in both files to drop the past-tense reference. install-sh-smoke.yml booted jrei/systemd-debian:12 without --cgroupns=host, so on GHA ubuntu-24.04 (cgroup v2 unified hierarchy) the container's systemd PID 1 exited before mounting the cgroup tree and the container disappeared during readiness polling. Added --cgroupns=host, an explicit /run/lock tmpfs, and dropped --rm so the container persists for diagnostic capture on failure (trap handles cleanup). Added an "is container still running" probe inside the readiness loop and richer diagnostic output on timeout. --- .github/workflows/create-release.yml | 15 ++-- .github/workflows/install-sh-smoke.yml | 19 ++++- .github/workflows/promote-floating-tags.yml | 82 +++++---------------- 3 files changed, 41 insertions(+), 75 deletions(-) diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index 5003cb57d..aea82c65f 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -1117,15 +1117,14 @@ jobs: app_version: ${{ needs.prepare.outputs.version }} # Defensive backup to promote-floating-tags.yml's workflow_run chain off - # publish-docker.yml. The chain works when publish-docker succeeds, but a - # publish-docker failure (rc.3 → rc.5 all failed at the now-removed - # pulse-agent push) silently left latest/major/minor tags unpromoted — - # customers pulling rcourtman/pulse:latest stayed on whatever the previous - # successful release tagged. Calling promote-floating-tags as workflow_call - # after validate_release_assets succeeds (which itself waits for the docker + # publish-docker.yml. The chain works when publish-docker succeeds, but + # when it fails the floating tags don't advance and customers pulling + # rcourtman/pulse:latest stay on whatever the previous successful release + # tagged. Calling promote-floating-tags as workflow_call after + # validate_release_assets succeeds (which itself waits for the docker # image to be pullable) guarantees the floating tags advance. Draft-only - # runs must not promote floating tags because the release is still private - # promotion state. + # runs must not promote floating tags because the release is still in + # private promotion state. promote_floating_tags: needs: - prepare diff --git a/.github/workflows/install-sh-smoke.yml b/.github/workflows/install-sh-smoke.yml index 7b0da17e0..e0149c951 100644 --- a/.github/workflows/install-sh-smoke.yml +++ b/.github/workflows/install-sh-smoke.yml @@ -185,10 +185,17 @@ jobs: # jrei/systemd-debian:12 is a community systemd-in-Docker image used # for Ansible / Molecule testing — small, no Pulse-specific assumptions. - docker run -d --rm \ + # GHA ubuntu-24.04 runners use cgroup v2 unified hierarchy; without + # --cgroupns=host the container gets its own cgroup namespace and + # systemd PID 1 exits before it can mount the cgroup tree, causing + # the container to disappear mid-boot. /run/lock must also be tmpfs + # for systemd-tmpfiles. We drop --rm so a failed boot leaves logs + # behind for diagnosis; the trap removes the container on exit. + docker run -d \ --name "${container_name}" \ --privileged \ - --tmpfs /tmp --tmpfs /run \ + --cgroupns=host \ + --tmpfs /tmp --tmpfs /run --tmpfs /run/lock \ -v /sys/fs/cgroup:/sys/fs/cgroup:rw \ -v "$(pwd)/smoke-workspace:/smoke" \ -p 7655:7655 \ @@ -196,11 +203,19 @@ jobs: echo "Waiting for systemd to be ready inside the container..." for i in $(seq 1 30); do + if ! docker inspect -f '{{.State.Running}}' "${container_name}" 2>/dev/null | grep -q true; then + echo "::error::Container ${container_name} is no longer running." + docker inspect -f 'ExitCode={{.State.ExitCode}} Error={{.State.Error}}' "${container_name}" || true + docker logs "${container_name}" || true + exit 1 + fi if docker exec "${container_name}" systemctl is-system-running --wait 2>/dev/null | grep -qE '^(running|degraded)$'; then break fi if [ "$i" -eq 30 ]; then docker logs "${container_name}" || true + docker exec "${container_name}" systemctl --no-pager status || true + docker exec "${container_name}" journalctl --no-pager --lines=120 || true echo "::error::systemd did not become ready inside the container" exit 1 fi diff --git a/.github/workflows/promote-floating-tags.yml b/.github/workflows/promote-floating-tags.yml index 40fd2928c..fb7e90073 100644 --- a/.github/workflows/promote-floating-tags.yml +++ b/.github/workflows/promote-floating-tags.yml @@ -1,12 +1,15 @@ name: Promote Floating Tags run-name: Promote Floating Tags ${{ inputs.tag }} +# Promotes floating tags for the Pulse server image after a release. Only +# rcourtman/pulse + ghcr.io//pulse are promoted; the Pulse agent +# ships as GitHub Release binaries (see publish-docker.yml line 199), not +# as a Docker image, so there are no agent floating tags to promote. +# # Triggers: -# - workflow_run: chains off publish-docker.yml completion. Historically the -# primary path, but the chain only fires when publish-docker succeeds — and -# when publish-docker fails (rc.3 → rc.5 all failed at the now-removed -# pulse-agent push step), the floating tags don't promote and customers -# pulling rcourtman/pulse:latest are stuck on whatever the previous tag was. +# - workflow_run: chains off publish-docker.yml completion. Historically +# this was the only path; it remains the default for releases that go +# straight through publish-docker.yml. # - workflow_call: called explicitly from create-release.yml after # validate_release_assets succeeds. Defensive backup so a workflow_run # failure doesn't silently leave latest/major/minor tags unpromoted. @@ -172,43 +175,24 @@ jobs: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - name: Wait for Docker images to be available + - name: Wait for Pulse server image to be available env: TAG: ${{ steps.extract.outputs.tag }} run: | - echo "Waiting for Docker images with tag ${TAG} to be available..." + echo "Waiting for rcourtman/pulse:${TAG} to be available..." MAX_ATTEMPTS=30 ATTEMPT=0 - - # Wait for main pulse image while [ $ATTEMPT -lt $MAX_ATTEMPTS ]; do if docker manifest inspect rcourtman/pulse:${TAG} > /dev/null 2>&1; then echo "Image rcourtman/pulse:${TAG} is available!" - break + exit 0 fi ATTEMPT=$((ATTEMPT + 1)) echo "Attempt $ATTEMPT/$MAX_ATTEMPTS - pulse image not yet available, waiting 10s..." sleep 10 done - - if [ $ATTEMPT -ge $MAX_ATTEMPTS ]; then - echo "Timeout waiting for pulse Docker image" - exit 1 - fi - - # Also wait for unified agent image - ATTEMPT=0 - while [ $ATTEMPT -lt $MAX_ATTEMPTS ]; do - if docker manifest inspect rcourtman/pulse-agent:${TAG} > /dev/null 2>&1; then - echo "Image rcourtman/pulse-agent:${TAG} is available!" - exit 0 - fi - ATTEMPT=$((ATTEMPT + 1)) - echo "Attempt $ATTEMPT/$MAX_ATTEMPTS - agent image not yet available, waiting 10s..." - sleep 10 - done - - echo "Timeout waiting for agent Docker image" + + echo "Timeout waiting for pulse Docker image" exit 1 - name: Promote Pulse server image tags @@ -246,39 +230,6 @@ jobs: ghcr.io/${OWNER}/pulse:${TAG} fi - - name: Promote Pulse agent image tags - env: - TAG: ${{ steps.extract.outputs.tag }} - PRERELEASE: ${{ steps.extract.outputs.prerelease }} - OWNER: ${{ github.repository_owner }} - run: | - set -euo pipefail - VERSION="${TAG#v}" - BASE_VERSION="${VERSION%%-*}" - IFS='.' read -r MAJOR MINOR PATCH <<< "$BASE_VERSION" - MINOR=${MINOR:-0} - MAJOR_MINOR="$MAJOR.$MINOR" - - if [ "$PRERELEASE" = "true" ]; then - docker buildx imagetools create \ - -t rcourtman/pulse-agent:rc \ - rcourtman/pulse-agent:${TAG} - docker buildx imagetools create \ - -t ghcr.io/${OWNER}/pulse-agent:rc \ - ghcr.io/${OWNER}/pulse-agent:${TAG} - else - docker buildx imagetools create \ - -t rcourtman/pulse-agent:latest \ - -t rcourtman/pulse-agent:${MAJOR_MINOR} \ - -t rcourtman/pulse-agent:${MAJOR} \ - rcourtman/pulse-agent:${TAG} - docker buildx imagetools create \ - -t ghcr.io/${OWNER}/pulse-agent:latest \ - -t ghcr.io/${OWNER}/pulse-agent:${MAJOR_MINOR} \ - -t ghcr.io/${OWNER}/pulse-agent:${MAJOR} \ - ghcr.io/${OWNER}/pulse-agent:${TAG} - fi - - name: Promotion summary env: TAG: ${{ steps.extract.outputs.tag }} @@ -288,9 +239,10 @@ jobs: BASE_VERSION="${VERSION%%-*}" IFS='.' read -r MAJOR MINOR PATCH <<< "$BASE_VERSION" MAJOR_MINOR="$MAJOR.${MINOR:-0}" - + if [ "$PRERELEASE" = "true" ]; then - echo "✅ Updated :rc tags to point to ${TAG} for both server and agent images." + echo "✅ Updated :rc tag to point to ${TAG} for the Pulse server image." else - echo "✅ Updated :latest, :${MAJOR_MINOR}, :${MAJOR} tags to point to ${TAG} for both server and agent images." + echo "✅ Updated :latest, :${MAJOR_MINOR}, :${MAJOR} tags to point to ${TAG} for the Pulse server image." fi + echo "Pulse Agent ships as GitHub Release binaries, not a Docker image."