Repository navigation
ci: build once, gate the digest, promote what was tested (RT#1550) - #31
Conversation
build.yml becomes container.yml calling constitution's [email protected]. The gates run against the pushed digest: systemd must reach running, then tests/gate.sh runs the existing smoke tests inside a fresh container of that digest (all pass against the current published image). A cascade image: :latest keeps tracking :main, and promotion dispatches parent-image-updated to the same children as before. Pull requests now build and gate. GHCR is dropped; the repo inherits constitution v1.39.1. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01R7Y1jh5QhdxRuFKyWVev5h
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
|
||
| name: Container | ||
|
|
||
| on: |
There was a problem hiding this comment.
HIGH (Constitution): The workflow has no weekly cron trigger, despite the project requirement that workflows include one for base-image security updates.
Suggestion: Add a weekly schedule trigger to this workflow.
Evidence:
on:
pull_request:
push:
branches: [main]
tags: ["v*"]
repository_dispatch:
types: [parent-image-updated]
workflow_dispatch:
There was a problem hiding this comment.
not a bug: this is a cascade child. The weekly errata rebuild starts at the chain's root, ubi10-core (its schedule, 0 6 * * 1), whose promotion dispatches parent-image-updated down the chain, so this image is rebuilt weekly through its own gates. A cron of its own would rebuild against an un-refreshed parent. The Container Image profile's cascade section covers this, and this workflow had no cron before the PR either.
Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01R7Y1jh5QhdxRuFKyWVev5h
There was a problem hiding this comment.
Gatehouse found no issues.
Reviewed 1 commit since befe98f (incremental).
…550) Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01R7Y1jh5QhdxRuFKyWVev5h
There was a problem hiding this comment.
Gatehouse found no issues.
Reviewed 1 commit since ce39bc0 (incremental).
Summary
Part of RT#1550, the ubi10 chain, following the ubi10-core pilot (ubi10-core#37).
build.ymlbecomescontainer.yml, which calls constitution's[email protected].running. Thentests/gate.shboots the digest under systemd and runs the existingtests/smoke-test.shinside it. Both pass against the currently published image.:latestkeeps tracking:main. The repo is rebuilt onparent-image-updatedand dispatches the same event to its children, as before.Test plan
🤖 Generated with Claude Code
https://claude.ai/code/session_01R7Y1jh5QhdxRuFKyWVev5h