Repository navigation
[ci] Fixing dep rpm packages for forked upload - #5066
Conversation
ScottTodd
left a comment
ScottTodd
left a comment
There was a problem hiding this comment.
Oh. That would do it... Thanks.
Please wait for CI to complete on this. I have some doubts about the "Install Python requirements" and "Install System requirements" steps working in the container 😅
|
Oops, CI didn't run on this. Need to edit TheRock/build_tools/github_actions/configure_ci_path_filters.py Lines 165 to 179 in d41dc84 (or you can trigger the workflow directly to skip past the rest of the CI jobs) |
| outputs: | ||
| package_install_url: ${{ steps.upload-packages.outputs.package_repository_url }} | ||
| container: | ||
| image: ghcr.io/rocm/therock_build_manylinux_x86_64@sha256:702a5133851e6d1daf1207d2c9fbb01c2667914a5b6dc5a01faeb3ce66ea6421 |
There was a problem hiding this comment.
Current job needs to be run on Ubuntu. Ubuntu2404/Ubuntu2204
There was a problem hiding this comment.
Ah. Then this job might need to set the AWS_SHARED_CREDENTIALS_FILE env var per https://github.com/ROCm/TheRock/blob/main/docs/development/s3_buckets.md#authentication ... though I would expect the credential file on the runners to already be used by default without that 🤔
There was a problem hiding this comment.
ah it isn't as it's only used to docker volume mounts, i'll fix
| "test_rocm_wheels.yml", | ||
| "test_sanity_check.yml", | ||
| "test_component.yml", | ||
| "build_native*packages.yml", |
There was a problem hiding this comment.
Oops, CI didn't run on this.
Thanks for the fix here. I also just sent #5089 for a general solution
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds `&& outputs.X != ''` to install tests, wheel tests, and PyTorch builds in ci_linux.yml, ci_windows.yml, multi_arch_ci_linux.yml, and multi_arch_ci_windows.yml so these jobs cleanly skip when the upstream upload produces no URL, rather than running and failing during the install step. Defensive on the consumer side only; the upstream auth gap that produces empty URLs on fork PRs is being addressed separately in ROCm#5066.
Mount /runner/config from the dind sidecar into the job container at /home/awsconfig/ so that AWS credentials are accessible for forked repos where OIDC auth is not available. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add ubuntu:24.04 container with volume mount for AWS credentials - Update AWS credentials path to /home/awsconfig/credentials.ini - Use apt-get instead of sudo apt (running inside container) - Remove debug credentials step Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
github.workspace resolves to host path (/home/runner/_work/...) but inside the container the workspace is mounted at /__w/. Using relative paths ensures both build and upload steps use consistent paths. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
it works yay! sorry it took a while - will fix build pytorch wheels next after this PR |
| container: | ||
| image: ubuntu:24.04 | ||
| options: -v /runner/config:/home/awsconfig/ | ||
| outputs: | ||
| package_repository_url: ${{ steps.upload-packages.outputs.package_repository_url }} | ||
| env: | ||
| AWS_SHARED_CREDENTIALS_FILE: /home/awsconfig/credentials.ini |
There was a problem hiding this comment.
Why do we need to run in a container and inject this credentials file if the credentials are already on the host?
I don't mind running these in an explicit container (looks like it just takes ~2 seconds to init: https://github.com/ROCm/TheRock/actions/runs/25897755289/job/76127352092?pr=5066)... I'm just curious why this is needed at all, as we might miss it for other workflows in the future.
There was a problem hiding this comment.
yeah so i thought it mounted to file path normally, but it is actually not accessible with regular directories and must be mounted via a -v option. i didn't want to adjust the config in the runner setup and we should run in containers anyway!
This reverts commit fc4e6be. Starting from that commit, the `Configure AWS Credentials` steps in the native Linux packages build jobs (deb and rpm) fail with ``` Error: Could not assume role with OIDC: Not authorized to perform sts:AssumeRoleWithWebIdentit ``` due to assuming a non-existing role `*:role/therock-` (missing release type): https://github.com/ROCm/TheRock/actions/runs/25931650380/job/76257228730
Noticied that RPM and DEB packages fail to upload: https://github.com/ROCm/TheRock/actions/runs/25237692770/job/74244690857?pr=4998 due to the build image not correctly configured (or even used!).
This change uses a proper docker image as well as proper credentials for forked repos