From 7cfd08d4f57a8e008be7815438c28b3d3cc53ccc Mon Sep 17 00:00:00 2001 From: Zhengchao An Date: Fri, 10 Jul 2026 20:51:27 +0800 Subject: [PATCH] ci(mint): restore multi-SDK pipeline on ubuntu-latest + pin mint digest (#4668) The mint multi-SDK compatibility pipeline had exactly one recorded run (28730530597, 2026-07-05), which died at "Enable buildx": the self-hosted sm-standard-4 pod it landed on had no /var/run/docker.sock, so `docker buildx create` failed to connect to the Docker API before any test ran. Same heterogeneous-fleet root cause ci-1 fixed for the weekly s3-tests sweep. - Pin the job to GitHub-hosted ubuntu-latest, which reliably ships a running Docker daemon + buildx + python3. Header note records the diagnosis and the dind-sm-standard-2 tradeoff. - Pin MINT_IMAGE default to the linux/amd64 digest for minio/mint:edge resolved 2026-07-10 (was the rolling :edge tag); workflow_dispatch can still override. Header comment records the refresh command. - Quote shellcheck-flagged vars and drop an unused loop var so actionlint passes with zero findings. - Left report-only (ci-3 adds baseline gating later, per adjudication G4) and a TODO(ci-8) alerting hook on the scheduled job. Refs: rustfs/backlog#1149 (ci-2), rustfs/backlog#1155 --- .github/workflows/mint.yml | 52 ++++++++++++++++++++++++++++++-------- 1 file changed, 41 insertions(+), 11 deletions(-) diff --git a/.github/workflows/mint.yml b/.github/workflows/mint.yml index bd9d6a658..9943fcf20 100644 --- a/.github/workflows/mint.yml +++ b/.github/workflows/mint.yml @@ -26,7 +26,24 @@ # the run red. The job fails only when mint produces no results at all # (infrastructure error). Once a suite passes reliably, tightening this into a # baseline gate (like implemented_tests.txt for s3-tests) is the natural next -# step. +# step. Tightening this into a per-suite baseline gate is tracked as ci-3 +# (backlog#1149) and is intentionally NOT done here. +# +# Runner infrastructure (ci-2, backlog#1149): this job needs a working Docker +# daemon to (a) build the RustFS source image with buildx and (b) run both the +# RustFS server and the mint image. It previously ran on the self-hosted +# `sm-standard-4` label, which is served by heterogeneous runners; its single +# recorded run (28730530597, 2026-07-05) landed on a minimal pod with no +# `/var/run/docker.sock`, so "Enable buildx" died at `docker buildx create` +# ("failed to connect to the docker API at unix:///var/run/docker.sock") before +# any test executed -- the same root cause ci-1 fixed for the weekly s3-tests +# sweep. The fix is to pin to GitHub-hosted `ubuntu-latest`, which reliably +# ships a running Docker daemon + buildx + python3, instead of trusting the +# drifting self-hosted fleet. Tradeoff: the source Rust build is heavier on a +# GitHub-hosted 4-vCPU runner than on a warm self-hosted host, but it stays +# well inside the 120-minute budget and buys deterministic infra. The +# docker-capable self-hosted `dind-sm-standard-2` label was the alternative but +# has fewer cores and reintroduces fleet-state risk for no reliability gain. name: mint @@ -65,9 +82,17 @@ env: MINT_SUITES: ${{ github.event.inputs.suites || '' }} MINT_MODE: ${{ github.event.inputs.mode || 'core' }} - # NOTE: minio/mint:edge is a rolling tag. If sweeps get noisy from upstream - # mint changes, pin this to a digest known to work. - MINT_IMAGE: ${{ github.event.inputs.mint-image || 'minio/mint:edge' }} + # minio/mint:edge is a rolling tag, so an unpinned run is not reproducible and + # can go red purely from an upstream mint change (ci-2, backlog#1149). Pin the + # default to the linux/amd64 digest resolved on 2026-07-10. workflow_dispatch + # can still override via the `mint-image` input (e.g. to test a newer edge). + # Refresh: docker manifest inspect minio/mint:edge --verbose | grep digest + # (or, without a docker daemon:) + # TOKEN=$(curl -s "https://auth.docker.io/token?service=registry.docker.io&scope=repository:minio/mint:pull" | jq -r .token) + # curl -sI -H "Authorization: Bearer $TOKEN" \ + # -H "Accept: application/vnd.docker.distribution.manifest.v2+json" \ + # https://registry-1.docker.io/v2/minio/mint/manifests/edge | grep -i docker-content-digest + MINT_IMAGE: ${{ github.event.inputs.mint-image || 'minio/mint:edge@sha256:08a05e68893c68be2a83b6f79556853ed6aa3c6c9e64c823a00853e4e55d2200' }} concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -79,7 +104,12 @@ defaults: jobs: mint: - runs-on: sm-standard-4 + # GitHub-hosted: reliably provides a running Docker daemon + buildx + + # python3. See the header note (ci-2) for why the self-hosted sm-standard-4 + # label was abandoned (no docker.sock on the pod its only run landed on). + # TODO(ci-8): scheduled-failure alerting (auto-open issue on a red weekly + # run) is added by the ci-8 composite action; do not implement it here. + runs-on: ubuntu-latest timeout-minutes: 120 steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 @@ -90,9 +120,9 @@ jobs: - name: Build RustFS image (source, cached) run: | DOCKER_BUILDKIT=1 docker buildx build --load \ - --platform ${PLATFORM} \ - --cache-from type=gha,scope=${BUILDX_CACHE_SCOPE} \ - --cache-to type=gha,mode=max,scope=${BUILDX_CACHE_SCOPE} \ + --platform "${PLATFORM}" \ + --cache-from "type=gha,scope=${BUILDX_CACHE_SCOPE}" \ + --cache-to "type=gha,mode=max,scope=${BUILDX_CACHE_SCOPE}" \ -t rustfs-ci \ -f Dockerfile.source . @@ -104,15 +134,15 @@ jobs: --network rustfs-net \ -p 9000:9000 \ -e RUSTFS_ADDRESS=0.0.0.0:9000 \ - -e RUSTFS_ACCESS_KEY=${S3_ACCESS_KEY} \ - -e RUSTFS_SECRET_KEY=${S3_SECRET_KEY} \ + -e RUSTFS_ACCESS_KEY="${S3_ACCESS_KEY}" \ + -e RUSTFS_SECRET_KEY="${S3_SECRET_KEY}" \ -e RUSTFS_VOLUMES="/data/rustfs{0...3}" \ -v /tmp/rustfs-mint:/data \ rustfs-ci - name: Wait for RustFS ready run: | - for i in {1..60}; do + for _ in {1..60}; do if curl -sf http://127.0.0.1:9000/health >/dev/null 2>&1; then echo "RustFS is ready" exit 0