From d8fc9892572d78c653a8d686936caafacfdc72d2 Mon Sep 17 00:00:00 2001 From: Michael Sarahan Date: Tue, 8 Sep 2026 19:05:31 -0500 Subject: [PATCH 1/2] Prevent release image bootstrap mismatches --- .github/actions/devcontainer-json/action.sh | 8 ++- .../build-test-and-push-windows-image.yml | 4 +- .github/workflows/release.yml | 17 +++++- .pre-commit-config.yaml | 12 ++++ ci/validate-devcontainer-bases.sh | 57 +++++++++++++++++++ 5 files changed, 94 insertions(+), 4 deletions(-) create mode 100755 ci/validate-devcontainer-bases.sh diff --git a/.github/actions/devcontainer-json/action.sh b/.github/actions/devcontainer-json/action.sh index c769c34c9..b58846d42 100755 --- a/.github/actions/devcontainer-json/action.sh +++ b/.github/actions/devcontainer-json/action.sh @@ -1,13 +1,17 @@ #! /usr/bin/env bash # cd to the repo root -cd "$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )/../../../"; +script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +cd "${script_dir}/../../../" || exit 1 os="${1:-"ubuntu:22.04"}"; features="${2:-"[]"}"; container_env="${3:-"null"}"; -VERSION="$(git describe --abbrev=0 --tags --first-parent | sed 's/[a-zA-Z]//g' | cut -d '.' -f -2)"; +# VERSION is updated before the alpha tag is created during release rollover. +# Use it as the source of truth so a release workflow triggered by that update +# publishes the new image namespace instead of the previous tagged version. +VERSION="$(cut -d '.' -f 1-2 VERSION)"; tag="$(node -p "$(cat < !x.hide).map(({ name = '', version = '', suffix = '' }) => { if (name.includes(':')) { diff --git a/.github/workflows/build-test-and-push-windows-image.yml b/.github/workflows/build-test-and-push-windows-image.yml index 368016d38..895d3eb3d 100644 --- a/.github/workflows/build-test-and-push-windows-image.yml +++ b/.github/workflows/build-test-and-push-windows-image.yml @@ -54,7 +54,9 @@ jobs: repo="$INPUT_REPO"; cl="$(echo "$INPUT_FEATURES" | jq -r '.[1].version')"; cuda="$(echo "$INPUT_FEATURES" | jq -r '.[0].version')"; - version="$(git describe --abbrev=0 --tags --first-parent | sed 's/[a-zA-Z]//g' | cut -d '.' -f -2)"; + # VERSION changes before the alpha tag exists during release rollover. + # Reading it directly keeps producer tags aligned with their consumers. + version="$(cut -d '.' -f 1-2 VERSION)"; base_tag="cuda${cuda}-cl${cl}"; tag_without_os="${version}-${base_tag}"; cat <&2 + exit 1 +fi +short_version="${full_version%.*}" + +expected_tags="$(mktemp)" +trap 'rm -f "${expected_tags}"' EXIT + +# Recreate the visible part of every Linux image name from matrix.yml. Hidden +# features affect image contents but, by design, do not appear in image tags. +yq --yaml-fix-merge-anchor-to-spec -eMo json matrix.yml \ + | jq -r --arg version "${short_version}" ' + .include[] + | select(.os != "windows") + | (.os | gsub(":"; "")) as $os + | .images[] + | (.features + | map( + select(.hide != true) + | (.name | split("/")[-1] | split(":")[0]) + + (.version // "" | tostring) + + (.suffix // "" | tostring) + ) + | (. + [$os]) + | join("-") + ) as $name + # The release publishes both the OS-qualified tag and an OS-free alias. + | [ + $version + "-cpp-" + $name, + $version + "-cpp-" + ($name | sub("-" + $os + "$"; "")) + ] + | .[] + ' \ + | sort -u > "${expected_tags}" + +status=0 +while IFS=$'\t' read -r file base; do + [[ "${base}" == rapidsai/devcontainers:* ]] || continue + tag="${base#rapidsai/devcontainers:}" + if ! grep -Fqx -- "${tag}" "${expected_tags}"; then + echo "${file}: BASE '${base}' is not produced by matrix.yml" >&2 + status=1 + fi +done < <( + find .devcontainer -name devcontainer.json -exec \ + jq -r '[input_filename, (.build.args.BASE // "")] | @tsv' {} + +) + +exit "${status}" From bf4cde398fb5e84f17ca190655025ba92dab70bc Mon Sep 17 00:00:00 2001 From: Michael Sarahan Date: Wed, 9 Sep 2026 19:14:14 -0500 Subject: [PATCH 2/2] split shellcheck into a separate GHA workflow, not pre-commit --- .github/workflows/test.yml | 14 ++++++++++++++ .pre-commit-config.yaml | 5 ----- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 2750c9a68..efee6b342 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -43,6 +43,20 @@ jobs: - name: Run pre-commit run: pip install pre-commit && pre-commit run --all-files + shellcheck: + name: ShellCheck + permissions: + contents: read + runs-on: ubuntu-latest + steps: + - name: Checkout ${{ github.repository }} + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + + - name: Run ShellCheck + run: shellcheck .github/actions/devcontainer-json/action.sh ci/validate-devcontainer-bases.sh + build-all-rapids-repos: if: needs.check-event.outputs.ok == 'true' && github.repository_owner == 'rapidsai' name: Build diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 0f067157c..81ac52152 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -11,8 +11,3 @@ repos: entry: ci/validate-devcontainer-bases.sh language: system pass_filenames: false - - id: shellcheck-release-bootstrap - name: shellcheck release bootstrap scripts - entry: shellcheck - language: system - files: ^(\.github/actions/devcontainer-json/action\.sh|ci/validate-devcontainer-bases\.sh)$