Skip to content

feat(packaging): Build connector packages locally and in CI. - #22

Closed
jackluo923 wants to merge 7 commits into
mainfrom
feat/package-artifacts
Closed

jackluo923 wants to merge 7 commits into
mainfrom
feat/package-artifacts

Conversation

@jackluo923

@jackluo923 jackluo923 commented Jul 12, 2026 •

Copy link
Copy Markdown
Member

Description

Add a local and CI packaging pipeline for the CLP Presto connector. The pipeline builds the coordinator JAR and Velox worker plugin once per architecture, stages a shared payload, and emits installable Debian, RPM, and relocatable tar packages for amd64 and arm64.

The change also:

  • Adds a hash-tagged manylinux_2_28 build environment that CI publishes to GHCR and reuses across package builds.
  • Bundles non-system worker dependencies, preserves system ABI dependencies, and configures relative RUNPATHs for the packaged plugin.
  • Adds persistent local Maven, ccache, and FetchContent caches to reduce repeated local package builds to under 30 seconds.
  • Stages host and Java CA trust temporarily for corporate TLS environments without embedding it in images, caches, or packages.
  • Adds a user-facing local wrapper and portable host-side behavior for both Linux and macOS.
  • Uploads each package under its exact generated filename so native architecture and normalized package versions remain visible.

Validation performed

  • The build-packages workflow completed successfully at the current branch tip:
    • Built and published the dependency image for amd64 and arm64.
    • Built packages successfully on both architecture runners.
    • Uploaded one Debian package, RPM, and tarball per architecture using their exact filenames.
  • Tested the generated packages end to end with the latest Presto and Presto Native container images.

The successful workflow currently reports a Node.js 20 deprecation warning for the SHA-pinned actions/upload-artifact v4.6.2 action; GitHub runs it under the Node.js 24 compatibility path.

Checklist

Summary by CodeRabbit

  • New Features
    • Added local packaging support for .deb, .rpm, and .tar.gz connector artefacts for AMD64 and ARM64, with a dedicated build entry point.
    • Added certificate-authority trust support for containerized builds, plus persistent build caching.
    • Updated build tasks to run against installed dependencies with configurable FetchContent base directory.
  • Documentation
    • Added and expanded documentation for building installable packages and the underlying build-cache/CA-trust workflow.
  • Bug Fixes
    • Improved build reliability by reducing stale outputs and tightening package-artifact validation in build workflows.

jackluo923 and others added 3 commits July 12, 2026 13:40
The host-side scripts relied on GNU-only tooling that isn't available on macOS: `stat -c` and `sed -z` in build-env.sh's hash derivation, `cp --remove-destination` when copying finished artifacts, and an unguarded empty-array expansion under `set -o nounset` that only trips on bash 3.2, which is what ships as /bin/bash on macOS. Replace each with a portable equivalent so the script runs the same on both platforms.
@jackluo923 jackluo923 self-assigned this Jul 12, 2026
@jackluo923
jackluo923 requested a review from a team as a code owner July 12, 2026 20:58
@coderabbitai

coderabbitai Bot commented Jul 12, 2026 •

Copy link
Copy Markdown

Review Change Stack

Warning

Review limit reached

@jackluo923, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 45 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: eb358000-8a93-4e26-bf66-08c17156a3c0

📥 Commits

Reviewing files that changed from the base of the PR and between d318572 and 2e28f47.

📒 Files selected for processing (2)
  • tools/build-packages/internal/container/build-artifacts.sh
  • tools/build-packages/package-specs/rpm/clp-plugin-presto-connector.spec
📝 Walkthrough

Walkthrough

The PR adds local and CI packaging for Debian, RPM, and tarball artifacts, with containerized builds, architecture-specific workflows, build caching, CA trust handling, dependency-image hashing, package specifications, and Velox dependency installation wiring.

Changes

Installable package build system

Layer / File(s) Summary
Host environment, cache, and trust infrastructure
.github/workflows/build-dependency-image.yaml, tools/build-packages/internal/{build-cache,ca-trust,host}/*, tools/build-packages/dependency-image/*
Adds deterministic build-environment image helpers, persistent cache setup, host/container CA trust integration, and dependency-image wiring.
Container build and package formats
taskfiles/velox-connector/main.yaml, tools/build-packages/internal/container/*, tools/build-packages/package-specs/*
Builds the Velox and Presto components, bundles required shared libraries, and emits .deb, .rpm, and .tar.gz artifacts.
Local packaging entry point
tools/build-packages/build-packages.sh, tools/build-packages/README.md, README.md
Provides the local packaging command, container orchestration, output copying, and packaging documentation.
CI workflow and repository integration
.github/workflows/build-packages.yaml, .gitignore, .dockerignore, presto-connector/.gitignore
Adds version resolution, multi-architecture package builds, artifact uploads, path filters, and generated-output ignore rules.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Developer
  participant BuildPackages
  participant BuildDependencyImage
  participant BuildArtifacts
  participant ArtifactStore
  Developer->>BuildPackages: invoke local packaging command
  BuildPackages->>BuildDependencyImage: resolve or build hashed dependency image
  BuildPackages->>BuildArtifacts: run containerized artifact build
  BuildArtifacts->>BuildPackages: return deb, rpm, and tar.gz artifacts
  BuildPackages->>Developer: copy artifacts to output directory
  ArtifactStore->>BuildArtifacts: provide CI dependency-image workflow output
  BuildArtifacts->>ArtifactStore: upload architecture-specific artifacts
Loading

Possibly related PRs

Suggested reviewers: junhaoliao, 20001020ycx

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main change: adding local and CI packaging for the connector.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/package-artifacts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/build-packages.yaml:
- Line 100: Update the reusable dependency-image workflow output consumed by the
build workflow so it emits the built platform image or manifest-list digest,
then change the image reference at the existing
needs.build-dependency-image.outputs.image usage to use the immutable `@sha256`:
digest instead of the mutable env-<hash> tag.
- Around line 128-150: Update the three upload steps—“Upload deb package,”
“Upload rpm package,” and “Upload tarball”—to use actions/upload-artifact v6.0.0
with SHA b7c566a772e6b6bfb58ed0dc250532a479d7789f, including updating their
version comments.

In `@tools/build-packages/internal/host/build-env.sh`:
- Around line 70-85: Update derive_build_env_hash to use portable command
fallbacks for null-delimited sorting, symlink resolution, and SHA-256 hashing:
select gsort or sort, greadlink or readlink, and sha256sum or shasum -a 256
based on available commands. Preserve the existing hashing output and file-mode
handling across macOS and GNU/Linux.

In `@tools/build-packages/package-specs/rpm/clp-plugin-presto-connector.spec`:
- Around line 37-43: Update the %files manifest in the RPM spec to explicitly
own the package root directory /opt/clp-plugin-presto-connector, in addition to
the existing presto_jar_dir and velox_so_dir entries. Preserve all current file
and subdirectory ownership entries so package removal also cleans up the empty
root directory.

In `@tools/build-packages/README.md`:
- Around line 88-93: Update the tarball installation example in the README so
the copy command targeting /opt explicitly uses sudo or otherwise states that
root access is required. Keep the extraction command unchanged.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 92b7579b-caee-4c31-82e2-d813e1161334

📥 Commits

Reviewing files that changed from the base of the PR and between 68dd2a0 and deb20ca.

📒 Files selected for processing (26)
  • .dockerignore
  • .github/workflows/build-dependency-image.yaml
  • .github/workflows/build-packages.yaml
  • .gitignore
  • README.md
  • presto-connector/.gitignore
  • taskfiles/velox-connector/main.yaml
  • tools/build-packages/README.md
  • tools/build-packages/build-dependency-image.sh
  • tools/build-packages/build-packages.sh
  • tools/build-packages/dependency-image/Dockerfile
  • tools/build-packages/dependency-image/use-host-ca.sh
  • tools/build-packages/dependency-image/utils.sh
  • tools/build-packages/internal/build-cache/README.md
  • tools/build-packages/internal/build-cache/container.sh
  • tools/build-packages/internal/build-cache/host.sh
  • tools/build-packages/internal/ca-trust/README.md
  • tools/build-packages/internal/ca-trust/container.sh
  • tools/build-packages/internal/ca-trust/generators/java-pkcs12/CreateJavaTrustStore.java
  • tools/build-packages/internal/ca-trust/generators/java-pkcs12/README.md
  • tools/build-packages/internal/ca-trust/generators/java-pkcs12/generate.sh
  • tools/build-packages/internal/ca-trust/host.sh
  • tools/build-packages/internal/container/build-artifacts.sh
  • tools/build-packages/internal/host/build-env.sh
  • tools/build-packages/package-specs/deb/clp-plugin-presto-connector.control.in
  • tools/build-packages/package-specs/rpm/clp-plugin-presto-connector.spec
💤 Files with no reviewable changes (2)
  • tools/build-packages/dependency-image/use-host-ca.sh
  • tools/build-packages/dependency-image/utils.sh

Comment thread .github/workflows/build-packages.yaml
Comment thread .github/workflows/build-packages.yaml
Comment thread tools/build-packages/internal/host/build-env.sh
Comment thread tools/build-packages/README.md Outdated
v6 only bumps the action's runtime from Node 20 to Node 24, which doesn't affect the GitHub-hosted runners this workflow uses; inputs and outputs are unchanged from v4.6.2.
Older macOS releases don't ship sha256sum by default, only shasum -a 256, which produces byte-identical output so the derived hash still matches what CI computes with sha256sum on Linux.
The example copied straight into /opt/clp-plugin-presto-connector/, which needs root and doesn't distinguish coordinator from worker hosts. Document it as a placeholder plugin directory and role instead.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tools/build-packages/README.md`:
- Line 92: Update the coordinator/worker installation instructions in the README
to provide separate, directly executable shell commands for each role. Replace
the invalid “<coordinator|worker>” syntax and angle-bracket path placeholder
with the appropriate concrete source names and a normal placeholder path that
users can substitute safely.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: e5d75958-4b2d-469e-a0c3-32d23cab5dd2

📥 Commits

Reviewing files that changed from the base of the PR and between deb20ca and d318572.

📒 Files selected for processing (3)
  • .github/workflows/build-packages.yaml
  • tools/build-packages/README.md
  • tools/build-packages/internal/host/build-env.sh

Comment thread tools/build-packages/README.md
Verified by install/remove in a container: /opt/clp-plugin-presto-connector was left behind as an empty directory after rpm -e, since rpm only tracks paths declared with %dir. Add a plugin_root macro alongside the existing presto_jar_dir/velox_so_dir ones instead of hardcoding the path, since both remain independently overridable via env.
@jackluo923

Copy link
Copy Markdown
Member Author

Split this PR into multiple smaller PR

@jackluo923 jackluo923 closed this Jul 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant