Publish verified main images for reuse in CI - #73094
Draft
jason810496 wants to merge 6 commits into
Draft
Conversation
Shared CI environments must fail when their locked dependencies cannot be installed, so consumers never reuse a silently re-resolved environment.
Application-only changes should not repeat dependency installation. Separate metadata inputs retain resolver checks while current wheels replace application files.
CI needs a stable compatibility and provenance contract before it can safely reuse an image produced by another workflow run.
A cross-run artifact download that degrades to a crawl instead of failing outright previously had no circuit breaker: nothing aborted it, and the consumer would just wait far longer than a fresh build would have taken. Measure the average transfer rate after the first 30 seconds and abandon the download in favor of building locally once it falls under 50 MB/s, the rate below which finishing the transfer is expected to cost more time than it saves.
A retained publisher gives CI a trusted source of compatible environments and dependency caches. Publication must finish successfully and preserve artifacts across retries before consumers can rely on them.
This was referenced Sep 13, 2026
Comment on lines
+65
to
+76
| - name: Fingerprint and resolve | ||
| id: resolve | ||
| shell: bash | ||
| env: | ||
| IMAGE_KIND: ${{ inputs.kind }} | ||
| IMAGE_PYTHON: ${{ inputs.python }} | ||
| IMAGE_PLATFORM: ${{ inputs.platform }} | ||
| IMAGE_BASE: ${{ inputs.base-image }} | ||
| IMAGE_CONSTRAINTS_FILE: ${{ inputs.constraints-file }} | ||
| IMAGE_PUBLISH: ${{ inputs.publish }} | ||
| IMAGE_REUSE_DISABLED: ${{ inputs.disabled }} | ||
| run: ./scripts/ci/resolve_main_image.sh |
Comment on lines
+159
to
+161
| - name: "Install Breeze" | ||
| uses: ./.github/actions/breeze | ||
| - name: "Resolve compatible main CI image" |
Installing Breeze before freeing disk space left the venv's Python symlinked into the runner's hosted toolcache, which the disk-space script then deletes outright — every later step that shells out to python3 failed with "No such file or directory" once the space was freed. Restore the original ordering so cleanup runs first.
Comment on lines
+159
to
+162
| - name: "Install Breeze" | ||
| uses: ./.github/actions/breeze | ||
| - name: "Resolve compatible main CI image" | ||
| id: main-image |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part 4/5 of the CI image reuse series.
Why
Provide verified main images before enabling reuse in PR tests.
How
Publish CI images, production images, and dependency layers on both architectures; keep publication opt-in and shared artifacts immutable across retries.
Series impact (audit draft)
Sept 6–12, 2026 UTC PR census and CI timing:
The purpose is to avoid rebuilding the CI image when a PR doesn't change package dependencies — currently, even a PR that only touches the API server or the UI still triggers a full CI image rebuild on every push — and real hit rate and end-to-end PR latency remain unmeasured pending a pilot.
Was generative AI tooling used to co-author this PR?
Generated-by: Codex (GPT-6)