Repository navigation
Automate the harness refresh pipeline - #197
Merged
Merged
Conversation
Three pieces, replacing remember-to-run-it + manual dispatch: 1. harness-refresh workflow (daily cron): build-runner.sh --update --dry-run; if any pin moved, rewrite pins (--pins-only, new flag: resolve + rewrite without building) on the rolling bot/harness-refresh branch and open/update one PR carrying the version table and a qualification checklist. Merging stays the deliberate act - adapters record the harness versions they observe and docs record what each catalog was qualified against. 2. runner-image on PRs touching runner/**: builds both architectures without publishing, so a refresh PR is image-tested before merge. Fork PRs skip (read-only token cannot push digests). Publish job gated to non-PR events. 3. dev republished on every push to main (was: manual dispatch) - a refresh merge publishes mechanically; failed verify still fails closed before dev moves. Tag pushes publish vX.Y.Z + latest exactly as before. Bot-authored PRs don't trigger PR workflows (GitHub recursion rule); set a REFRESH_PAT secret for PR-time image CI on bot PRs - without it the publish verify gate is the backstop. Runner-image guide records the pipeline.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the process gaps today's manual refresh exposed. Three pieces:
harness-refresh(daily cron, 21:17 UTC) — runsbuild-runner.sh --update --dry-run; if any pin moved, rewrites pins via the new--pins-onlyflag and opens ONE rolling PR (bot/harness-refresh) with the version table + qualification checklist. No automerge: merging stays the deliberate act. Cadence: daily (per call — amp alone releases near-daily, so the PR body is what stays quiet).runner-imageon PRs touchingrunner/**— builds both architectures without publishing; refresh PRs are image-tested before merge. Fork PRs skip (read-only token can't push digests). Publish job gated to non-PR events.:devrepublished on every push tomain(was: manual dispatch) — auto-publish on merge as decided. Failed verify still fails closed beforedevmoves. Tag pushes →vX.Y.Z+latest, exactly as before.Notes:
build-runner.sh --pins-onlyflag: resolve + rewrite without building (the bot has no docker; CI is the builder). Respects--dry-run; errors without--update.pull_requestworkflows (GitHub's recursion rule). Set aREFRESH_PATsecret if you want PR-time image CI on bot PRs; without it the publish-time verify gate is the backstop.ubuntu-latest→26.04 migration: deliberately not addressed; the image is built insidedebian:bookwormcontainers, so the runner OS doesn't enter the artifact.This PR itself exercises piece 2 — it touches
scripts/build-runner.sh, so the runner-image build-only jobs appear on it.