Reuse compatible main images in pull request tests - #73095
Draft
jason810496 wants to merge 7 commits into
Draft
Conversation
Shared CI environments must fail when their locked dependencies cannot be installed, so consumers never reuse a silently re-resolved environment.
Application-only changes should not repeat dependency installation. Separate metadata inputs retain resolver checks while current wheels replace application files.
CI needs a stable compatibility and provenance contract before it can safely reuse an image produced by another workflow run.
A cross-run artifact download that degrades to a crawl instead of failing outright previously had no circuit breaker: nothing aborted it, and the consumer would just wait far longer than a fresh build would have taken. Measure the average transfer rate after the first 30 seconds and abandon the download in favor of building locally once it falls under 50 MB/s, the rate below which finishing the transfer is expected to cost more time than it saves.
A retained publisher gives CI a trusted source of compatible environments and dependency caches. Publication must finish successfully and preserve artifacts across retries before consumers can rely on them.
1 task
Comment on lines
+65
to
+76
| - name: Fingerprint and resolve | ||
| id: resolve | ||
| shell: bash | ||
| env: | ||
| IMAGE_KIND: ${{ inputs.kind }} | ||
| IMAGE_PYTHON: ${{ inputs.python }} | ||
| IMAGE_PLATFORM: ${{ inputs.platform }} | ||
| IMAGE_BASE: ${{ inputs.base-image }} | ||
| IMAGE_CONSTRAINTS_FILE: ${{ inputs.constraints-file }} | ||
| IMAGE_PUBLISH: ${{ inputs.publish }} | ||
| IMAGE_REUSE_DISABLED: ${{ inputs.disabled }} | ||
| run: ./scripts/ci/resolve_main_image.sh |
Comment on lines
+167
to
+169
| - name: "Install Breeze" | ||
| uses: ./.github/actions/breeze | ||
| - name: "Resolve compatible main CI image" |
Comment on lines
+169
to
+188
| - name: "Resolve compatible main CI image" | ||
| id: main-image | ||
| if: inputs.use-selected-image || inputs.publish-main-image | ||
| uses: ./.github/actions/resolve_main_image | ||
| with: | ||
| kind: ci | ||
| publish: ${{ inputs.publish-main-image }} | ||
| python: ${{ matrix.python-version }} | ||
| platform: ${{ inputs.platform }} | ||
| disabled: >- | ||
| ${{ | ||
| !inputs.use-selected-image || !inputs.reuse-main-image || inputs.publish-main-image || | ||
| inputs.push-image == 'true' || | ||
| inputs.upgrade-to-newer-dependencies != 'false' || inputs.docker-cache == 'disabled' || | ||
| inputs.branch != 'main' || inputs.constraints-branch != 'constraints-main' || | ||
| inputs.install-mysql-client-type != 'mariadb' || inputs.debian-version != 'bookworm' || | ||
| inputs.use-uv != 'true' || secrets.CONSTRAINTS_GITHUB_REPOSITORY != '' || | ||
| inputs.image-stash-ref != '' || inputs.seed-cache-from-stashed-image == 'true' | ||
| }} | ||
| - name: "Publish selected CI image reference" |
Installing Breeze before freeing disk space left the venv's Python symlinked into the runner's hosted toolcache, which the disk-space script then deletes outright — every later step that shells out to python3 failed with "No such file or directory" once the space was freed. Restore the original ordering so cleanup runs first.
Source-only changes should not rebuild compatible environments. Consumers must still run the current checkout and identify a fallback by its workflow run so reuse cannot substitute stale PR code.
jason810496
force-pushed
the
ci/image-reuse/05-consumers
branch
from
September 13, 2026 16:18
318e3fc to
bc35d1d
Compare
Comment on lines
+167
to
+170
| - name: "Install Breeze" | ||
| uses: ./.github/actions/breeze | ||
| - name: "Resolve compatible main CI image" | ||
| id: main-image |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part 5/5 of the CI image reuse series.
Why
Avoid rebuilding compatible images while testing the current PR checkout.
How
Enable eligible PR lookups, restore selections through a dedicated script, and build a current-run fallback on misses — including when the selected image's own download is too slow to be worth finishing. Preserve full builds for canaries and dependency upgrades.
Series impact (audit draft)
Sept 6–12, 2026 UTC PR census and CI timing:
The purpose is to avoid rebuilding the CI image when a PR doesn't change package dependencies — currently, even a PR that only touches the API server or the UI still triggers a full CI image rebuild on every push — and real hit rate and end-to-end PR latency remain unmeasured pending a pilot.
restore_selected_image.shinherits automatically), it falls back to a regular image build — today's existing behavior — instead of waiting out a degraded transfer.Was generative AI tooling used to co-author this PR?
Generated-by: Codex (GPT-6)