From 5e99e89e5b928b2864d4973d16cc30a2f69666cb Mon Sep 17 00:00:00 2001 From: bameda Date: Tue, 22 Sep 2026 14:08:14 +0000 Subject: [PATCH] :bug: Pin build-docker to the commit build-bundle actually bundled MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit _DEVELOP and _STAGING chain build-bundle.yml -> build-docker.yml, both invoked with gh_ref as a branch name. Each reusable workflow re-resolves that branch with its own checkout, at its own time. build-docker's checkout happens minutes after build-bundle's, after new commits can have landed on the branch, so it can compute a different sha than the one build-bundle actually bundled and uploaded to S3. The Prepare job then requests a key that was never uploaded: fatal error: An error occurred (404) when calling the HeadObject operation: Key "penpot-sha-.zip" does not exist Expose build-bundle.yml's resolved sha as a workflow_call output and thread it through _DEVELOP, _STAGING and _ADHOC as build-docker.yml's new optional sha input, which pins its checkout instead of re-resolving gh_ref. gh_ref keeps naming the branch tag to move. _TAG is unaffected: it builds from a pushed git tag, which cannot move the way a branch can, so build-bundle and build-docker already agree on one commit there. Signed-off-by: David Barragán Merino --- .github/workflows/build-adhoc.yml | 5 +++++ .github/workflows/build-bundle.yml | 9 +++++++++ .github/workflows/build-develop.yml | 5 +++++ .github/workflows/build-docker.yml | 15 +++++++++++++-- .github/workflows/build-staging.yml | 5 +++++ 5 files changed, 37 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-adhoc.yml b/.github/workflows/build-adhoc.yml index 327c449fc4..a85065ad74 100644 --- a/.github/workflows/build-adhoc.yml +++ b/.github/workflows/build-adhoc.yml @@ -34,6 +34,11 @@ jobs: secrets: inherit with: gh_ref: ${{ inputs.gh_ref }} + # Pin the exact commit build-bundle already resolved and uploaded to + # S3, instead of letting build-docker re-resolve gh_ref on its own + # checkout minutes later, which can land on a newer commit than the + # one actually bundled if gh_ref names a branch that moved meanwhile. + sha: ${{ needs.build-bundle.outputs.sha }} force: ${{ inputs.force }} build-docker-admin-console: diff --git a/.github/workflows/build-bundle.yml b/.github/workflows/build-bundle.yml index 5a956cca28..64683a902c 100644 --- a/.github/workflows/build-bundle.yml +++ b/.github/workflows/build-bundle.yml @@ -26,6 +26,15 @@ on: type: boolean required: false default: false + outputs: + sha: + description: >- + The exact commit this run resolved gh_ref to and bundled. Callers + that also trigger build-docker.yml should pass it through as that + workflow's `sha` input, so both pipelines agree on one commit + instead of each re-resolving gh_ref independently at a different + time. + value: ${{ jobs.check.outputs.sha }} # Literal group name: under `workflow_call`, `github.workflow` resolves to the # caller's workflow, which put this workflow and the other reusable one called diff --git a/.github/workflows/build-develop.yml b/.github/workflows/build-develop.yml index 7346450831..d947cb1741 100644 --- a/.github/workflows/build-develop.yml +++ b/.github/workflows/build-develop.yml @@ -32,6 +32,11 @@ jobs: secrets: inherit with: gh_ref: "develop" + # Pin the exact commit build-bundle already resolved and uploaded to + # S3, instead of letting build-docker re-resolve "develop" on its own + # checkout minutes later, which can land on a newer commit than the + # one actually bundled. + sha: ${{ needs.build-bundle.outputs.sha }} force: ${{ inputs.force || false }} build-docker-admin-console: diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml index a97b163439..c55d437c5f 100644 --- a/.github/workflows/build-docker.yml +++ b/.github/workflows/build-docker.yml @@ -20,6 +20,17 @@ on: type: string required: true default: 'develop' + sha: + description: >- + Exact commit to check out and build, e.g. from build-bundle.yml's + `sha` output. gh_ref is still used to resolve the checkout when + this is empty, and always names the branch tag to move — passing + both avoids the checkout re-resolving gh_ref on its own, possibly + to a newer commit than the one build-bundle.yml already bundled + and uploaded to S3 under its own resolved sha. + type: string + required: false + default: '' force: description: 'Rebuild and overwrite even if this sha is already promoted' type: boolean @@ -60,7 +71,7 @@ jobs: uses: actions/checkout@v6 with: fetch-depth: 0 - ref: ${{ inputs.gh_ref }} + ref: ${{ inputs.sha != '' && inputs.sha || inputs.gh_ref }} - name: Extract some useful variables id: vars @@ -148,7 +159,7 @@ jobs: - name: Checkout code uses: actions/checkout@v6 with: - ref: ${{ inputs.gh_ref }} + ref: ${{ inputs.sha != '' && inputs.sha || inputs.gh_ref }} - name: Login to Docker Registry uses: docker/login-action@v4 diff --git a/.github/workflows/build-staging.yml b/.github/workflows/build-staging.yml index c2e3dad823..a14f4e3714 100644 --- a/.github/workflows/build-staging.yml +++ b/.github/workflows/build-staging.yml @@ -32,6 +32,11 @@ jobs: secrets: inherit with: gh_ref: "staging" + # Pin the exact commit build-bundle already resolved and uploaded to + # S3, instead of letting build-docker re-resolve "staging" on its own + # checkout minutes later, which can land on a newer commit than the + # one actually bundled. + sha: ${{ needs.build-bundle.outputs.sha }} force: ${{ inputs.force || false }} build-docker-admin-console: