gha: use ghcr registry instead of local registry for staging - #122
Conversation
Once we create the oci archive, the digest of the image changes. Therefore, it doesn't match with the digest reported by bootc and set it to the disk image, and the bootc-operator CI is failing in pulling the correct image. In order to preserve the digest, we push a temporary image per PR which will be moved to the final image once the PR is merged and the CI succeeds. Unfortunately, we cannot rely on the local registry since isn't shared across multiple stages. The local registry will be used only on fork because we don't have write access to the ghcr registry. Bink doesn't require to pull the node image by digest, so running the integration tests from the oci-archive is fine. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>
91e68fb to
7ad0152
Compare
|
/cc @Johan-Liebert1 |
Johan-Liebert1
left a comment
Johan-Liebert1
left a comment
There was a problem hiding this comment.
This still wouldn't work, I think. Since the bcvk command still installs the image in containers-storage. We'd want to pass --image-to-install <registry_image> to bcvk to-disk command
| ALL=$(curl -s https://endoflife.date/api/kubernetes.json | \ | ||
| jq -c '[.[] | select(.eol > (now | strftime("%Y-%m-%d"))) | .cycle][:3]') | ||
| NON_DEFAULT=$(echo "$ALL" | jq -c --arg default "$DEFAULT" 'map(select(. != $default))') | ||
| BRANCH_TAG=$(echo "${{ github.head_ref || github.ref_name }}" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9._-]+/-/g') |
There was a problem hiding this comment.
A comment about what this is trying to do would be nice
|
The local registry fixed the digest mistmatch, for ostree at least. I have tested the previous run with the registry only and the digest matched with the one in the label. The problem now is that the digest changes when we transform it in an archive. Do you mean for the composefs only or ostree as well? |
|
Correct me if I'm wrong here. The final bcvk command currently looks like bcvk to-disk -K \
--karg 'console=tty0' \
--karg 'console=ttyS0,115200n8' \
--karg 'console=hvc0' \
--filesystem ext4 \
--format qcow2 \
--memory ${MEMORY} \
--disk-size ${DISK_SIZE} \
--log-dir journal,console=${LOG_DIR} \
${BCVK_EXTRA_ARGS} \
ghcr.io/... \
/output/disk.qcow2which would just use the ghcr image in containers storage as the install target which would again produce the uncompressed manifest digest. That is the reason I added |
|
I think, but need to test it, once we remove the image built locally we will only have the image with the remote digest. It was the previous behavior at least, before I refactored the integration tests to run after the images node build which broke the CI. |
|
We can give it a try and see. Unfortunately, those changes are hard to test before merging |
2 participants
Once we create the oci archive, the digest of the image changes.
Therefore, it doesn't match with the digest reported by bootc and set it
to the disk image, and the bootc-operator CI is failing in pulling the
correct image.
In order to preserve the digest, we push a temporary image per PR which
will be moved to the final image once the PR is merged and the CI
succeeds.
Unfortunately, we cannot rely on the local registry since isn't shared
across multiple stages. The local registry will be used only on fork
because we don't have write access to the ghcr registry.
Bink doesn't require to pull the node image by digest, so running the
integration tests from the oci-archive is fine.