Gate smoke build on test-release (back-port from PlexCleaner port) - #413
Merged
Conversation
Back-port from the PlexCleaner two-phase port (ptr727/PlexCleaner#723): the smoke build builds Docker images, so it shouldn't be spent when the test job is already failing. smoke-build now needs [changes, test-release] so a failed test leaves it skipped and the aggregator blocks on the test failure directly. Matches the sibling repos' PR workflows. Audited the other discoveries from that port; NxWitness already has them (github-release GitCommitId checkout + dispatch-refresh, gha cache ignore-error, no push trigger on the publisher, explicit ref: main on the docker-readme task). The one remaining gap — build-main feeds the versioned release from a moving ref: main — is NOT safely fixable by pinning to GitCommitId here, because build-docker-task overloads inputs.ref as the image-matrix branch selector (.Branch == $ref); a SHA would match no rows. Decoupling ref (checkout/version) from branch (matrix selector) is a maintainer-owned refactor, noted in the PR for follow-up.
There was a problem hiding this comment.
Pull request overview
This PR updates the pull request CI workflow to avoid running the Docker image smoke build when the release test job has already failed, aligning NxWitness’ PR pipeline behavior with the audited two-phase CI/CD pattern used in related repos.
Changes:
- Make
smoke-builddepend ontest-release(needs: [changes, test-release]) so smoke builds don’t run iftest-releasefails. - Add inline documentation explaining the gating rationale and the expected effect on the aggregator job behavior.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Back-port from the PlexCleaner two-phase CI/CD port (ptr727/PlexCleaner#723), where this repo's patterns were audited for the same issues.
Applied
smoke-buildontest-release(needs: [changes, test-release]). The smoke build builds Docker images, so it shouldn't be spent when the test job is already failing; a failedtest-releasenow leaves smoke-build skipped and the aggregator blocks on the test failure directly. Brings NxWitness in line with the sibling repos' PR workflows.Audited — already present in NxWitness (no change needed)
github-releasechecks out NBGVGitCommitIdand allowsworkflow_dispatchthrough the skip-if-exists gate (Skip duplicate GitHub release and pin tag to built commit SHA #408/Clarify release-skip log message for workflow_dispatch #412).cache-toalready usesignore-error=true(gha cache).publish-release.ymlhas nopushtrigger, so the no-op-push concurrency/badge issues don't arise.publish-docker-readme-taskis called with an explicitref: main, so it renders the README from the right branch.Noted for maintainer follow-up (NOT changed here)
build-mainfeeds the versioned release from a movingref: mainwhileget-versionresolves the release version separately — the same race fixed in PlexCleaner/ProjectTemplate by pinning leaf builds toGitCommitId. That pin is not safe to apply here:build-docker-taskoverloadsinputs.refas the image-matrix branch selector (select(.Branch == $ref)), so passing a SHA would match no rows. A proper fix decouplesref(checkout/version) frombranch(matrix selector) — a small refactor better owned by the maintainer. (Low practical risk: requires a commit landing onmainmid-publish.)All workflows pass
actionlint. Handed to the maintainer for merge.