From dc6e7ab89056aeeee59de5fd96152d6f6bb3979a Mon Sep 17 00:00:00 2001 From: copilotcoder Date: Fri, 29 May 2026 10:13:33 -0400 Subject: [PATCH] fix(ci): pass immutable base hash to main build --- .gitea/workflows/cicd-start.yaml | 4 ++++ .gitea/workflows/docker-build-base.yaml | 16 ++++++++++++++-- .gitea/workflows/docker-build-main.yaml | 20 +++++++++++++++++--- 3 files changed, 35 insertions(+), 5 deletions(-) diff --git a/.gitea/workflows/cicd-start.yaml b/.gitea/workflows/cicd-start.yaml index bb637fc..a298372 100644 --- a/.gitea/workflows/cicd-start.yaml +++ b/.gitea/workflows/cicd-start.yaml @@ -26,6 +26,7 @@ jobs: outputs: base_needed: ${{ steps.base-decision.outputs.base_needed }} head_sha: ${{ steps.base-decision.outputs.head_sha }} + base_hash: ${{ steps.base-decision.outputs.base_hash }} steps: - name: Audit trigger context @@ -125,6 +126,7 @@ jobs: echo "Base ref: ${BASE_REF_HASH}" echo "head_sha=${GITHUB_SHA}" >> "$GITHUB_OUTPUT" + echo "base_hash=${BASE_HASH}" >> "$GITHUB_OUTPUT" for i in 1 2 3; do echo "Base availability check ${i}/3 for ${BASE_REF_HASH}" @@ -162,6 +164,7 @@ jobs: DISPATCH_TOKEN: ${{ secrets.ACTIONS_TRIGGER_TOKEN || secrets.PACKAGE_ACCESS_TOKEN }} BASE_NEEDED: ${{ steps.base-decision.outputs.base_needed }} HEAD_SHA: ${{ steps.base-decision.outputs.head_sha }} + BASE_HASH: ${{ steps.base-decision.outputs.base_hash }} REPO_FULL: ${{ github.repository }} HEAD_REF: ${{ github.head_ref }} REF_NAME: ${{ github.ref_name }} @@ -188,6 +191,7 @@ jobs: "ref": "${TARGET_REF}", "inputs": { "head_sha": "${HEAD_SHA}", + "base_hash": "${BASE_HASH}", "source_workflow": "CICD Start", "base_needed": "${BASE_NEEDED}" } diff --git a/.gitea/workflows/docker-build-base.yaml b/.gitea/workflows/docker-build-base.yaml index 3708f51..57ae55d 100644 --- a/.gitea/workflows/docker-build-base.yaml +++ b/.gitea/workflows/docker-build-base.yaml @@ -170,12 +170,22 @@ jobs: name: Build and Publish CICD Base Image runs-on: ubuntu-act-8gb needs: registry-preflight + outputs: + base_hash: ${{ steps.base-state.outputs.base_hash }} + head_sha: ${{ steps.meta.outputs.head_sha }} steps: + - name: Resolve head SHA + id: meta + env: + HEAD_SHA: ${{ github.event.inputs.head_sha || github.sha }} + run: | + echo "head_sha=${HEAD_SHA}" >> "$GITHUB_OUTPUT" + - name: Minimal checkout for base inputs env: SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }} - GITHUB_SHA: ${{ github.event.inputs.head_sha || github.sha }} + GITHUB_SHA: ${{ steps.meta.outputs.head_sha }} run: | umask 077 trap 'rm -f ~/.ssh/id_rsa' EXIT @@ -341,7 +351,8 @@ jobs: - name: Dispatch main build workflow env: DISPATCH_TOKEN: ${{ secrets.ACTIONS_TRIGGER_TOKEN || secrets.PACKAGE_ACCESS_TOKEN }} - HEAD_SHA: ${{ github.event.inputs.head_sha || github.sha }} + HEAD_SHA: ${{ needs.publish-base.outputs.head_sha }} + BASE_HASH: ${{ needs.publish-base.outputs.base_hash }} REPO_FULL: ${{ github.repository }} HEAD_REF: ${{ github.head_ref }} REF_NAME: ${{ github.ref_name }} @@ -367,6 +378,7 @@ jobs: "ref": "${TARGET_REF}", "inputs": { "head_sha": "${HEAD_SHA}", + "base_hash": "${BASE_HASH}", "source_workflow": "CICD Base Image", "base_needed": "true" } diff --git a/.gitea/workflows/docker-build-main.yaml b/.gitea/workflows/docker-build-main.yaml index b2828df..2408167 100644 --- a/.gitea/workflows/docker-build-main.yaml +++ b/.gitea/workflows/docker-build-main.yaml @@ -6,6 +6,9 @@ on: head_sha: description: Commit SHA to process required: false + base_hash: + description: Immutable base hash to use for CICD base image + required: false source_workflow: description: Upstream workflow name required: false @@ -39,6 +42,7 @@ jobs: SOURCE_WORKFLOW: ${{ github.event.inputs.source_workflow || 'manual' }} BASE_NEEDED: ${{ github.event.inputs.base_needed || 'false' }} HEAD_SHA: ${{ github.event.inputs.head_sha || github.sha }} + BASE_HASH_INPUT: ${{ github.event.inputs.base_hash || '' }} REF: ${{ github.ref }} REF_NAME: ${{ github.ref_name }} HEAD_REF: ${{ github.head_ref }} @@ -48,6 +52,7 @@ jobs: echo "source_workflow=${SOURCE_WORKFLOW}" echo "base_needed=${BASE_NEEDED}" echo "head_sha=${HEAD_SHA}" + echo "base_hash_input=${BASE_HASH_INPUT}" echo "ref=${REF}" echo "ref_name=${REF_NAME}" echo "head_ref=${HEAD_REF}" @@ -92,6 +97,7 @@ jobs: REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.actor }} SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }} HEAD_SHA: ${{ steps.meta.outputs.head_sha }} + BASE_HASH_INPUT: ${{ github.event.inputs.base_hash || '' }} run: | set -e umask 077 @@ -103,7 +109,14 @@ jobs: echo "${PACKAGE_ACCESS_TOKEN}" | docker login "http://${GITEA_REGISTRY}" -u "${REGISTRY_USER}" --password-stdin - BASE_HASH=$(./scripts/compute-cicd-base-hash.sh) + if [ -n "${BASE_HASH_INPUT}" ]; then + BASE_HASH="${BASE_HASH_INPUT}" + echo "Using provided immutable base hash from upstream workflow dispatch: ${BASE_HASH}" + else + BASE_HASH=$(./scripts/compute-cicd-base-hash.sh) + echo "No base_hash input provided; computed base hash locally: ${BASE_HASH}" + fi + BASE_IMAGE="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd-base:${BASE_HASH}" verify_base_image() { @@ -117,11 +130,12 @@ jobs: return 1 } - max_attempts=220 - sleep_seconds=30 + max_attempts=12 + sleep_seconds=10 for i in $(seq 1 "${max_attempts}"); do echo "Base availability check ${i}/${max_attempts}..." if verify_base_image; then + echo "✓ Base image available and hash matched: ${BASE_IMAGE}" break fi