Conditionally publish deb packages #9496
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
wadells
requested review from
klizhentas,
webvictim,
tcsc,
russjones and
zmb3
wadells
commented
Dec 20, 2021
zmb3
reviewed
Dec 27, 2021
michaelmcallister
approved these changes
Jan 6, 2022
wadells
force-pushed
the
walt/deb
branch
2 times, most recently
from
656f08f to
a9c1337
Compare
This script can be used to determine if a tag is the highest semver version of Teleport ever released. This is useful for conditional build steps that should only run for the most current release (e.g. updating 'latest' references). (cherry picked from commit 7390509)
We've seen two debug / prerelease builds slip through to public package repositories. This script should help prevent that from happening again.
This patch makes a couple changes:
1. deb archives are not published to apt if they're not the latest
release ever
2. both rpm and deb archives are no longer published to yum / apt if
they contain any pre-release indicator or build metadata
3. nothing is published if the commit isn't tagged.
Contributes to #8166
|
@russjones @zmb3: Could I get another review for this please? I'd love to get this in. |
As requested by Zac and Russell.
The logic in these two scripts is quite similar, and it will be easier to maintain a single script instead of two. This save us ~100 sloc too.
russjones
approved these changes
Jan 14, 2022
zmb3
reviewed
Jan 14, 2022
zmb3
reviewed
Jan 14, 2022
zmb3
reviewed
Jan 14, 2022
Co-authored-by: Zac Bergquist <[email protected]>
wadells
changed the title
https://deb.releases.teleport.dev/ stable main
wadells
added a commit
that referenced
this pull request
Jan 14, 2022
This patch makes a couple changes:
1. deb archives are not published to apt if they're not the latest
release ever
2. both rpm and deb archives are no longer published to yum / apt if
they contain any pre-release indicator or build metadata
3. nothing is published if the commit isn't tagged.
Contributes to #8166
(cherry picked from commit 8540533)
wadells
added a commit
that referenced
this pull request
Jan 20, 2022
This patch makes a couple changes:
1. deb archives are not published to apt if they're not the latest
release ever
2. both rpm and deb archives are no longer published to yum / apt if
they contain any pre-release indicator or build metadata
3. nothing is published if the commit isn't tagged.
Contributes to #8166
(cherry picked from commit 8540533)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This is the last interim fix for our deb repos. Specifically, I make the following changes:
v6.2.14-debug.4that's slipped into the repos before.DRONE_TAG, but now the failure is quicker, explicit, and has a hopefully helpful error message.Once this merged to master and 8.0, we won't have to worry about 8.0+ causing
https://deb.releases.teleport.dev/ stable mainany future releases (e.g.8.1or9.0).Needs backporting to v8.0, but no further because we have a simpler strategy in 7.0 (#9237), 6.2 (#9238), and 5.0 (#9239). 4.4 and prior predate apt (and are very out of support).
Contributes to #8166.
Testing Done
Updated testing:
Because the changed pipeline actually publishes stuff, I wasn't able to test the code in-situ. Instead, I wrote a minimal test harness (see this change), and tried with the following tags:
v0.0.0,v8.8.8,v9.0.0.-dev.1. You can find the builds here:v0.0.0, rpm faux published, but no deb)v8.8.8, everything faux published)v9.0.0-dev.1both rpm and deb skipped)After completing the testing, I cut and paste the steps into the production pipeline, and updated comments. I also deleted all the bogus tags I used for testing.
Notes
Many thanks to @russjones for prototyping the version checker in #9236
I considered that we may see ip based rate limiting / throttling from GitHub, as we don't use an authenticate API client. However, I think this is unlikely because release jobs are relatively infrequent, typically zero up to 3 in a day (if they need to be retried for some reason).