ci: move remaining workflows off the persistent self-hosted runner - #3268
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (3)
📝 WalkthroughWalkthroughThis PR changes CI workflow runner selection across backport, pull-requests, tags, and update-releasenotes workflows, and updates the flux-shard-operator build to use a shared cache helper. The tags release workflow also adds Flux CLI setup and OCIR login for build cache access. ChangesCI Workflow Runner Migration
Flux Shard Operator Build Cache
Estimated code review effort: 2 (Simple) | ~12 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request finalizes the decommissioning of the persistent self-hosted runner by migrating all remaining CI jobs to ephemeral or GitHub-hosted infrastructure. The changes ensure that release builds maintain performance through registry-based cache warm-starts and clean up legacy routing logic in pull request workflows. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
There was a problem hiding this comment.
Code Review
This pull request refactors the Makefile for the flux-shard-operator package by replacing the hardcoded Docker buildx caching arguments (--cache-from and --cache-to) with a call to the reusable cache-args helper function. There are no review comments, and I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
flux-shard-operator was the last image built with the pre-#2937 cache pattern: --cache-from a :latest tag that PR builds no longer publish and --cache-to type=inline, which never caches multistage builder layers. Use the shared cache-args macro so it reads (and, on main, writes) the same mode=max :buildcache ref in CACHE_REGISTRY as every other image. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io>
Finishes the runner decommission tracked in #2937. PR builds, the main cache warmer, nightly, promote-rc and pull-requests-release already run on the ephemeral pool; this moves the stragglers so no workflow depends on the persistent runner anymore: - tags.yaml prepare-release: large ephemeral shape (same as the cache warmer), flux CLI bootstrap, and read-only OCIR access so release builds warm-start from the shared mode=max build cache while still pushing images to GHCR. Without the cache wiring every tag build on an ephemeral runner would be 100% cold. - tags.yaml generate-changelog / update-website-docs, backport.yaml, update-releasenotes.yaml: GitHub-hosted runners — these jobs only need git and the GitHub API, no docker or repo toolchain. - pull-requests.yaml: the debug label no longer reroutes jobs to the self-hosted runner (that path would queue forever once the runner is gone). The label keeps gating the SSH breakpoint on e2e failure, which works from ephemeral runners too. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io>
a6b669e to
814a47f
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/tags.yaml:
- Around line 142-149: The “Set up build toolchain” step can silently succeed
when the flux installer download fails because the piped command in the workflow
does not fail fast. Update the shell invocation in this step to enable pipe
failure handling so errors from curl propagate and the job stops immediately,
and keep the existing idempotent flux check intact. If you touch this block,
reference the “Set up build toolchain” step and the command-v- flux / curl |
sudo bash logic to ensure the fix is applied in the right place.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 06e937b5-5764-444c-8de2-788a9be66dcf
📒 Files selected for processing (5)
.github/workflows/backport.yaml.github/workflows/pull-requests.yaml.github/workflows/tags.yaml.github/workflows/update-releasenotes.yamlpackages/system/flux-shard-operator/Makefile
| # Ephemeral runners lack the flux CLI the installer's image-packages step | ||
| # shells out to; install if absent (idempotent). | ||
| - name: Set up build toolchain | ||
| if: steps.check_release.outputs.release_exists == 'false' | ||
| run: | | ||
| command -v flux >/dev/null \ | ||
| || curl -fsSL https://fluxcd.io/install.sh | sudo bash | ||
|
|
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
Failed flux install can pass silently. The pipeline lacks set -o pipefail, so if curl -fsSL errors (e.g. 404/5xx on the installer), bash receives empty stdin and exits 0. The step succeeds, but flux is not installed and the failure surfaces later as a cryptic make build error instead of failing fast here.
🛡️ Proposed fix
- name: Set up build toolchain
if: steps.check_release.outputs.release_exists == 'false'
run: |
- command -v flux >/dev/null \
- || curl -fsSL https://fluxcd.io/install.sh | sudo bash
+ set -euo pipefail
+ command -v flux >/dev/null \
+ || curl -fsSL https://fluxcd.io/install.sh | sudo bashSeparately, curl … | sudo bash pulls an unpinned installer at build time; if reproducibility/supply-chain hardening matters for release builds, consider pinning a flux version or vendoring the installer.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # Ephemeral runners lack the flux CLI the installer's image-packages step | |
| # shells out to; install if absent (idempotent). | |
| - name: Set up build toolchain | |
| if: steps.check_release.outputs.release_exists == 'false' | |
| run: | | |
| command -v flux >/dev/null \ | |
| || curl -fsSL https://fluxcd.io/install.sh | sudo bash | |
| # Ephemeral runners lack the flux CLI the installer's image-packages step | |
| # shells out to; install if absent (idempotent). | |
| - name: Set up build toolchain | |
| if: steps.check_release.outputs.release_exists == 'false' | |
| run: | | |
| set -euo pipefail | |
| command -v flux >/dev/null \ | |
| || curl -fsSL https://fluxcd.io/install.sh | sudo bash |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/tags.yaml around lines 142 - 149, The “Set up build
toolchain” step can silently succeed when the flux installer download fails
because the piped command in the workflow does not fail fast. Update the shell
invocation in this step to enable pipe failure handling so errors from curl
propagate and the job stops immediately, and keep the existing idempotent flux
check intact. If you touch this block, reference the “Set up build toolchain”
step and the command-v- flux / curl | sudo bash logic to ensure the fix is
applied in the right place.
What this PR does
Completes the last step of #2937 — no workflow depends on the persistent self-hosted runner anymore, so it can be decommissioned. PR builds, the main cache warmer, nightly, promote-rc, and pull-requests-release already run on the ephemeral pool; this PR moves the stragglers:
tags.yaml/prepare-releasemoves to the large ephemeral shape (same as the main cache warmer). Release builds now warm-start from the sharedmode=maxbuild cache in OCIR (written bybuild-main.yamlon every push to main) while still pushing images to GHCR. Cache manifests are registry-portable, and a missing cache ref degrades harmlessly into a cold build. Without this wiring, every tag build on an ephemeral runner would start 100% cold — the persistent runner used to warm-start from local buildkit state.tags.yaml/generate-changelogandupdate-website-docs,backport.yaml,update-releasenotes.yamlmove to GitHub-hosted runners: these jobs only need git and the GitHub API, no docker or repo toolchain.pull-requests.yaml: thedebuglabel no longer reroutes jobs to the self-hosted runner — that path would queue forever once the runner is gone. The label still gates the SSH breakpoint on e2e failure, which works from ephemeral runners (the breakpoint connects out to the rendezvous server).flux-shard-operatorwas the last image built with the stale inline/:latestcache pattern (always cold since refactor(build): standardize image tagging to fix concurrent PR push conflicts #2711); it now uses the sharedcache-argsregistry cache like every other image.Operational notes for the actual decommission:
BREAKPOINT_ENDPOINT) is separate infrastructure — if it happens to live on the same host as the runner, it needs a new home before the host is retired.tags.yamlnow uses theOCIR_USER/OCIR_TOKENsecrets on tag events (already used there bynightly.yamlandrelease-e2ebefore it).Screenshots
Not applicable — CI-only change.
Release note
Summary by CodeRabbit