From f5ca8009f904d78481c47c488b693a9d2bb87e13 Mon Sep 17 00:00:00 2001 From: Anton Zelenov Date: Fri, 24 Jul 2026 14:38:37 +0800 Subject: [PATCH] ci: pin backend appVersions in bump-descriptors too (fix manual rebuild) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #1890 added the backend subchart appVersion bump + persistence, but only in publish-chart. On a manual full rebuild (or any run where a connector also changed), bump-descriptors commits the connector bumps and publish-chart is deferred to the re-triggered run via its `committed != 'true'` gate — so the backend bump never ran and only connectors got new versions (observed on run 30071800363). - Extract the per-service appVersion bump into scripts/bump-service-appversions.sh, shared by publish-chart and bump-descriptors so both pin the same set identically. - bump-descriptors now also bumps + stages the backend subchart Chart.yaml files in its (re-triggering) commit. The follow-up push run then rebuilds those backends and publish-chart persists their tags — backends end pinned to an image that exists, connectors keep their bumps. Refs constructorfabric/insight#1583 Signed-off-by: Anton Zelenov --- .github/workflows/build-images.yml | 49 ++++++++++++------- .../scripts/bump-service-appversions.sh | 35 +++++++++++++ 2 files changed, 65 insertions(+), 19 deletions(-) create mode 100755 .github/workflows/scripts/bump-service-appversions.sh diff --git a/.github/workflows/build-images.yml b/.github/workflows/build-images.yml index 08dcaeebd..5dc905cf4 100644 --- a/.github/workflows/build-images.yml +++ b/.github/workflows/build-images.yml @@ -972,6 +972,24 @@ jobs: .github/workflows/scripts/bump-descriptor-version.sh --descriptor "$desc" done + # Pin backend service subchart appVersions here too. This job commits + # WITHOUT [skip ci] and re-triggers the workflow; because publish-chart + # is deferred to that follow-up run (see its `committed != 'true'` + # gate), a backend built alongside a connector — or every backend on a + # manual full rebuild — would otherwise never get pinned: the follow-up + # run doesn't see the backend source as changed. Bumping the subchart + # Chart.yaml here makes the follow-up run rebuild that backend and + # publish-chart persist its tag. Uses the same script as publish-chart. + - name: Bump per-service subchart appVersions (built this run) + env: + BUILD_TAG: ${{ needs.changes.outputs.build_tag }} + FULL_REBUILD: ${{ github.event_name == 'workflow_dispatch' && inputs.frontend_tag == '' }} + ANALYTICS: ${{ needs.changes.outputs.analytics }} + AUTHENTICATOR: ${{ needs.changes.outputs.authenticator }} + GATEWAY: ${{ needs.changes.outputs.gateway }} + IDENTITY: ${{ needs.changes.outputs.identity }} + run: .github/workflows/scripts/bump-service-appversions.sh + - name: Commit descriptor patches (no [skip ci]) id: commit env: @@ -989,6 +1007,13 @@ jobs: | sort -u \ | xargs -r git add + # Stage any backend subchart appVersion bumps from the step above. + # git add of an unchanged file is a harmless no-op. + git add src/backend/services/analytics/helm/Chart.yaml \ + src/backend/services/authenticator/helm/Chart.yaml \ + src/backend/services/gateway/helm/Chart.yaml \ + src/backend/services/identity/helm/Chart.yaml + if git diff --staged --quiet; then echo "no descriptor changes to commit" echo "committed=false" >> "$GITHUB_OUTPUT" @@ -1127,7 +1152,10 @@ jobs: # tag in the published chart still resolves to an image that exists. # A manual full rebuild (workflow_dispatch, no frontend_tag) rebuilds # every service image, so it bumps every service — mirroring the build - # jobs' own `workflow_dispatch && frontend_tag == ''` trigger. + # jobs' own `workflow_dispatch && frontend_tag == ''` trigger. When + # bump-descriptors runs (connectors changed / full rebuild) it does the + # bump instead, in its re-triggering commit; this step is the canonical + # path when no connector changed and bump-descriptors was skipped. - name: Bump per-service subchart appVersions env: BUILD_TAG: ${{ needs.changes.outputs.build_tag }} @@ -1136,24 +1164,7 @@ jobs: AUTHENTICATOR: ${{ needs.changes.outputs.authenticator }} GATEWAY: ${{ needs.changes.outputs.gateway }} IDENTITY: ${{ needs.changes.outputs.identity }} - run: | - set -euo pipefail - if [ "$ANALYTICS" = "true" ] || [ "$FULL_REBUILD" = "true" ]; then - echo "Bumping analytics subchart appVersion → $BUILD_TAG" - yq -i ".appVersion = \"$BUILD_TAG\"" src/backend/services/analytics/helm/Chart.yaml - fi - if [ "$AUTHENTICATOR" = "true" ] || [ "$FULL_REBUILD" = "true" ]; then - echo "Bumping authenticator subchart appVersion → $BUILD_TAG" - yq -i ".appVersion = \"$BUILD_TAG\"" src/backend/services/authenticator/helm/Chart.yaml - fi - if [ "$GATEWAY" = "true" ] || [ "$FULL_REBUILD" = "true" ]; then - echo "Bumping gateway subchart appVersion → $BUILD_TAG" - yq -i ".appVersion = \"$BUILD_TAG\"" src/backend/services/gateway/helm/Chart.yaml - fi - if [ "$IDENTITY" = "true" ] || [ "$FULL_REBUILD" = "true" ]; then - echo "Bumping identity subchart appVersion → $BUILD_TAG" - yq -i ".appVersion = \"$BUILD_TAG\"" src/backend/services/identity/helm/Chart.yaml - fi + run: .github/workflows/scripts/bump-service-appversions.sh # Cross-repo frontend bump. The frontend lives in # constructorfabric/insight-front and builds its own image; on diff --git a/.github/workflows/scripts/bump-service-appversions.sh b/.github/workflows/scripts/bump-service-appversions.sh new file mode 100755 index 000000000..46d058894 --- /dev/null +++ b/.github/workflows/scripts/bump-service-appversions.sh @@ -0,0 +1,35 @@ +#!/usr/bin/env bash +# Bump each backend service subchart's appVersion to $BUILD_TAG when that +# service's image was (re)built this run: its paths-filter flag is 'true', or +# this is a manual full rebuild (FULL_REBUILD=true). +# +# Shared by the bump-descriptors and publish-chart jobs so both pin the exact +# same set of services in the same way. A service that wasn't built is left +# untouched — it keeps its previous appVersion, which still resolves to an +# image that exists. +# +# Env: BUILD_TAG (required), FULL_REBUILD (default false), and one flag per +# service (ANALYTICS/AUTHENTICATOR/GATEWAY/IDENTITY) carrying the paths-filter +# output ('true' when that service changed). +set -euo pipefail + +: "${BUILD_TAG:?BUILD_TAG is required}" +FULL_REBUILD="${FULL_REBUILD:-false}" + +# service-flag-env : subchart Chart.yaml +services=( + "ANALYTICS:src/backend/services/analytics/helm/Chart.yaml" + "AUTHENTICATOR:src/backend/services/authenticator/helm/Chart.yaml" + "GATEWAY:src/backend/services/gateway/helm/Chart.yaml" + "IDENTITY:src/backend/services/identity/helm/Chart.yaml" +) + +for entry in "${services[@]}"; do + flag_name="${entry%%:*}" + chart="${entry#*:}" + flag_val="${!flag_name:-false}" + if [ "$flag_val" = "true" ] || [ "$FULL_REBUILD" = "true" ]; then + echo "Bumping $chart appVersion -> $BUILD_TAG" + yq -i ".appVersion = \"$BUILD_TAG\"" "$chart" + fi +done