[rhoai-2.25] chore(ci): RPM lock renewal workflow + CI triage docs for rhoai-2.25 - #2643
Conversation
Backport a manual-only rpms-lock-renewal Action for rhoai-2.25 (separate from pylock), and document that hermetic dnf NEVR conflicts usually mean stale Hermeto RPM pins that should be relocked via that workflow. Co-authored-by: Cursor <cursoragent@cursor.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughChangesCI failure triage
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
CI status [antigravity]Run: Build Notebooks (push) #30527929024 — 2/2 complete · 2 skipped Workflow completed with skipped jobs. |
Important difference from
|
Codeserver is the only Hermeto RPM consumer on this branch and runs on public UBI, unlike main's RHDS path that may still require subscription secrets. Co-authored-by: Cursor <cursoragent@cursor.com>
CI status [antigravity]Run: Build Notebooks (pr) #30527933835 — 3/3 complete · 1 passed · 2 cancelled Failures so far
Likely root causes
Suggested next steps
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/rpms-lock-renewal.yaml:
- Around line 85-93: Update the “Configure registry auth from pull-secret” step
to copy pull-secret.json only when it is successfully unlocked or passes JSON
validation; otherwise leave Podman auth unchanged and continue with the public
UBI repositories path. Replace the existence-only condition while preserving the
existing destination and fallback message.
In `@docs/ci-failure-triage.md`:
- Around line 57-63: Update the “Local equivalent” example to cover both
lockfile locations renewed by the workflow, including the
prefetch-input/rhds/rpms.in.yaml input; alternatively, clearly label the
existing command as codeserver-only.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 0483467a-3df0-4dfb-96d9-70bfd3da379a
📒 Files selected for processing (3)
.github/workflows/rpms-lock-renewal.yamlAgents.mddocs/ci-failure-triage.md
Avoid copying a git-crypt ciphertext blob into Podman auth.json when GIT_CRYPT_KEY is absent on the public-UBI rhoai-2.25 path. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Addressed the CodeRabbit finding: |
CI status [antigravity]Run: Build Notebooks (pr) #30528028508 — 3/3 complete · 1 passed · 1 failed · 1 cancelled Failures so far
Likely root causes
Suggested next steps
|
CI status [antigravity]Run: Build Notebooks (pr) #30528411559 — 3/3 complete · 1 passed · 2 failed Failures so far
Likely root causes
Suggested next steps
|
ide-developer
left a comment
ide-developer
left a comment
There was a problem hiding this comment.
Looks good — clean separation of RPM lock renewal from pylock/piplock, solid docs.
Workflow (.github/workflows/rpms-lock-renewal.yaml)
- Checkout pin (
actions/checkout@…v7.0.1) and login-action pin match the existingpiplock-renewalworkflow — consistent. - Good security hygiene:
persist-credentials: false+ PAT push, secrets viaenv:not string interpolation,::add-mask::for subscription creds. permissions: {}at workflow level + scoped per-job is the recommended pattern.- The
RPM_INPUTSarray handles both the top-levelprefetch-input/${VARIANT}/rpms.in.yaml(exists onmainbut not onrhoai-2.25) and the codeserver path — the[[ ! -f … ]]skip logic is correct. - Nit: the
if: github.event_name == 'workflow_dispatch'guard on the job is redundant sinceworkflow_dispatchis the only trigger. Harmless but could be dropped for cleanliness.
Docs (docs/ci-failure-triage.md)
- Well-structured symptom → cause → fix pattern. The explanation of why hermetic
dnfNEVR conflicts happen (locked pins vs floating base image) is clear and actionable. - The "other failure classes" table is a nice bonus for common issues.
Agents.md additions
- Cross-references in three relevant spots (CI section, build failures, getting help). Good discoverability.
LGTM.
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: ide-developer The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
jiridanek
changed the title
|
Follow-up for the |
2 participants
Summary
.github/workflows/rpms-lock-renewal.yaml(manualworkflow_dispatchonly) so RHDS RPM locks can be refreshed without combining with pylock /piplock-renewal.variant=rhds,branch=rhoai-2.25; subscription/git-crypt are optional (public UBI path on this branch).dnfNEVR conflicts (cannot install both … @System) as stale Hermeto pins vs newer base image, with fix = run this Action.Agents.mdat that triage doc.Companion lock refresh: #2642
Test plan
variant=rhds,branch=rhoai-2.25(after merge) opens/updates an RPM-only PRAgents.mdresolveMade with Cursor
Summary by CodeRabbit