Reuse compatible main images in pull request tests - #73095
Draft
jason810496 wants to merge 8 commits into
Draft
Conversation
Shared CI environments must fail when their locked dependencies cannot be installed, so consumers never reuse a silently re-resolved environment.
Application-only changes should not repeat dependency installation. Separate metadata inputs retain resolver checks while current wheels replace application files.
CI needs a stable compatibility and provenance contract before it can safely reuse an image produced by another workflow run.
A cross-run artifact download that degrades to a crawl instead of failing outright previously had no circuit breaker: nothing aborted it, and the consumer would just wait far longer than a fresh build would have taken. Measure the average transfer rate after the first 30 seconds and abandon the download in favor of building locally once it falls under 50 MB/s, the rate below which finishing the transfer is expected to cost more time than it saves.
A retained publisher gives CI a trusted source of compatible environments and dependency caches. Publication must finish successfully and preserve artifacts across retries before consumers can rely on them.
1 task
Installing Breeze before freeing disk space left the venv's Python symlinked into the runner's hosted toolcache, which the disk-space script then deletes outright — every later step that shells out to python3 failed with "No such file or directory" once the space was freed. Restore the original ordering so cleanup runs first.
jason810496
force-pushed
the
ci/image-reuse/05-consumers
branch
from
September 13, 2026 16:18
318e3fc to
bc35d1d
Compare
…plied ref The publish job's checkout step accepted an inputs.checkout-ref that is also used, in other unrelated callers, for maintainer-triggered reruns against an arbitrary ref. CodeQL flags that shared checkout as a cache poisoning risk because the publisher path uploads an artifact every PR build trusts and reuses without rebuilding. Pin it to the triggering commit whenever a publish run is in progress so the ref this path builds from can never be attacker-influenced.
Source-only changes should not rebuild compatible environments. Consumers must still run the current checkout and identify a fallback by its workflow run so reuse cannot substitute stale PR code.
jason810496
force-pushed
the
ci/image-reuse/05-consumers
branch
from
September 14, 2026 03:01
bc35d1d to
8604bac
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part 5/5 of the CI image reuse series.
Why
Avoid rebuilding compatible images while testing the current PR checkout.
How
Enable eligible PR lookups, restore selections through a dedicated script, and build a current-run fallback on misses — including when the selected image's own download is too slow to be worth finishing. Preserve full builds for canaries and dependency upgrades.
Series impact (audit draft)
Sept 6–12, 2026 UTC PR census and CI timing:
The purpose is to avoid rebuilding the CI image when a PR doesn't change package dependencies — currently, even a PR that only touches the API server or the UI still triggers a full CI image rebuild on every push — and real hit rate and end-to-end PR latency remain unmeasured pending a pilot.
restore_selected_image.shinherits automatically), it falls back to a regular image build — today's existing behavior — instead of waiting out a degraded transfer.Was generative AI tooling used to co-author this PR?
Generated-by: Codex (GPT-6)