Fix: GitHub CI workflow selects dev when building prod branch (#5428, #6823) #6818

achave11-ucsc · 2025-01-10T23:47:48Z

Connected issues: #5428, #6823

Checklist

Author

PR is a draft
Target branch is develop
Name of PR branch matches issues/<GitHub handle of author>/<issue#>-<slug>
On ZenHub, PR is connected to all issues it (partially) resolves
PR description links to connected issues
PR title matches¹ that of a connected issue _{or comment in PR explains why they're different}
PR title references all connected issues
For each connected issue, there is at least one commit whose title references that issue

¹ when the issue title describes a problem, the corresponding PR
title is Fix: followed by the issue title

Author (partiality)

Added p tag to titles of partial commits
This PR is labeled partial _{or completely resolves all connected issues}
This PR partially resolves each of the connected issues _{or does not have the partial label}

Author (chains)

This PR is blocked by previous PR in the chain _{or is not chained to another PR}
The blocking PR is labeled base _{or this PR is not chained to another PR}
This PR is labeled chained _{or is not chained to another PR}

Author (reindex, API changes)

Added r tag to commit title _{or the changes introduced by this PR will not require reindexing of any deployment}
This PR is labeled reindex:dev _{or the changes introduced by it will not require reindexing of dev}
This PR is labeled reindex:anvildev _{or the changes introduced by it will not require reindexing of anvildev}
This PR is labeled reindex:anvilprod _{or the changes introduced by it will not require reindexing of anvilprod}
This PR is labeled reindex:prod _{or the changes introduced by it will not require reindexing of prod}
This PR is labeled reindex:partial and its description documents the specific reindexing procedure for dev, anvildev, anvilprod and prod _{or requires a full reindex or carries none of the labels reindex:dev, reindex:anvildev, reindex:anvilprod and reindex:prod}
This PR and its connected issues are labeled API _{or this PR does not modify a REST API}
Added a (A) tag to commit title for backwards (in)compatible changes _{or this PR does not modify a REST API}
Updated REST API version number in app.py _{or this PR does not modify a REST API}

Author (upgrading deployments)

Ran make docker_images.json and committed the resulting changes _{or this PR does not modify azul_docker_images, or any other variables referenced in the definition of that variable}
Documented upgrading of deployments in UPGRADING.rst _{or this PR does not require upgrading deployments}
Added u tag to commit title _{or this PR does not require upgrading deployments}
This PR is labeled upgrade _{or does not require upgrading deployments}
This PR is labeled deploy:shared _{or does not modify docker_images.json, and does not require deploying the shared component for any other reason}
This PR is labeled deploy:gitlab _{or does not require deploying the gitlab component}
This PR is labeled deploy:runner _{or does not require deploying the runner image}

Author (hotfixes)

Added F tag to main commit title _{or this PR does not include permanent fix for a temporary hotfix}
Reverted the temporary hotfixes for any connected issues _{or the none of the stable branches (anvilprod and prod) have temporary hotfixes for any of the issues connected to this PR}

Author (before every review)

Rebased PR branch on develop, squashed old fixups
Ran make requirements_update _{or this PR does not modify requirements*.txt, common.mk, Makefile and Dockerfile}
Added R tag to commit title _{or this PR does not modify requirements*.txt}
This PR is labeled reqs _{or does not modify requirements*.txt}
make integration_test passes in personal deployment _{or this PR does not modify functionality that could affect the IT outcome}

Peer reviewer (after approval)

PR is not a draft
Ticket is in Review requested column
PR is awaiting requested review from system administrator
PR is assigned to only the system administrator

System administrator (after approval)

Actually approved the PR
Labeled connected issues as demo or no demo
Commented on connected issues about demo expectations _{or all connected issues are labeled no demo}
Decided if PR can be labeled no sandbox
A comment to this PR details the completed security design review
PR title is appropriate as title of merge commit
N reviews label is accurate
Moved connected issues to Approved column
PR is assigned to only the operator

Operator (before pushing merge the commit)

System administrator

Background migrations for dev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
Background migrations for anvildev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
PR is assigned to only the operator

Operator (before pushing merge the commit)

Operator (chain shortening)

Changed the target branch of the blocked PR to develop _{or this PR is not labeled base}
Removed the chained label from the blocked PR _{or this PR is not labeled base}
Removed the blocking relationship from the blocked PR _{or this PR is not labeled base}
Removed the base label from this PR _{or this PR is not labeled base}

Operator (after pushing the merge commit)

Operator (reindex)

Operator

Propagated the deploy:shared, deploy:gitlab, deploy:runner, API, reindex:partial, reindex:anvilprod and reindex:prod labels to the next promotion PRs _{or this PR carries none of these labels}
Propagated any specific instructions related to the deploy:shared, deploy:gitlab, deploy:runner, API, reindex:partial, reindex:anvilprod and reindex:prod labels, from the description of this PR to that of the next promotion PRs _{or this PR carries none of these labels}
PR is assigned to no one

Shorthand for review comments

L line is too long
W line wrapping is wrong
Q bad quotes
F other formatting problem

codecov · 2025-01-11T07:35:30Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 85.53%. Comparing base (1b21893) to head (034764d).
Report is 7 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #6818      +/-   ##
===========================================
+ Coverage    85.52%   85.53%   +0.01%     
===========================================
  Files          147      147              
  Lines        21140    21157      +17     
===========================================
+ Hits         18079    18096      +17     
  Misses        3061     3061

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

coveralls · 2025-01-11T07:36:49Z

coverage: 85.549% (+0.01%) from 85.537%
when pulling 034764d on issues/achave11-ucsc/5428-check-branch-script
into 1b21893 on develop.

nadove-ucsc · 2025-01-14T21:32:00Z

scripts/check_branch.py

-        deployments = config.shared_deployments_for_branch(branch)
-        if deployments is None or deployment not in deployments:
-            raise BranchDeploymentMismatch(branch, deployment, deployments)
+@dataclass(kw_only=True)


I presume the use of dataclass instead of attrs is because this script needs to be run in an environment where we haven't installed our requirements yet?

It was, but since we are now installing the requirements prior (at least during the script's usage in GH Actions), it should be OK to use attrs. I suspect this pattern can be expected elsewhere where this script runs.

nadove-ucsc · 2025-01-14T21:43:27Z

.github/workflows/ci.yml

          make virtualenv
          source .venv/bin/activate
          make requirements
+          deployment=$(PYTHONPATH=src python scripts/check_branch.py --print)


Wouldn't this still work without setting PYTHONPATH here, since it's already been set by the call to source environment?

Suggested change

deployment=$(PYTHONPATH=src python scripts/check_branch.py --print)

deployment=$(python scripts/check_branch.py --print)

Yup, it does. Good catch.

nadove-ucsc · 2025-01-14T21:43:51Z

scripts/check_branch.py

-            raise BranchDeploymentMismatch(branch, deployment, deployments)
+@dataclass(kw_only=True)
+class BranchContext:
+    name: Optional[str]


Suggested change

name: Optional[str]

name: str | None

etc

nadove-ucsc · 2025-01-14T22:28:28Z

scripts/check_branch.py

        if deployment is None:
            sys.exit(1)
        else:
            print(deployment)
    else:
        check_branch(branch, config.deployment_stage)
+        allowed_deployments = config.shared_deployments_for_branch(branch)
+        if deployment == 'prod':


These checks seem at least partially redundant with the call to check_branch on line #117. If deployment == 'prod' and branch != 'prod', won't we have already raised an exception? I suspect there's a clearer way to express this logic.

It is redundant, as you point out. I may have been overthinking the solution.

scripts/check_branch.py

achave11-ucsc · 2025-01-15T18:56:30Z

@nadove-ucsc, I've cleaned up a bit the commit structure and preserved the fixup sites from the last review.

hannes-ucsc

Please discuss commit history with me during PL.

hannes-ucsc · 2025-02-06T19:11:14Z

Security design review

)

…5428)

github-actions bot added the orange [process] Done by the Azul team label Jan 10, 2025

achave11-ucsc force-pushed the issues/achave11-ucsc/5428-check-branch-script branch from 2385b7a to de3e8b6 Compare January 11, 2025 07:13

achave11-ucsc assigned nadove-ucsc and unassigned nadove-ucsc Jan 11, 2025

achave11-ucsc force-pushed the issues/achave11-ucsc/5428-check-branch-script branch 11 times, most recently from 2a8d8be to f11efc6 Compare January 13, 2025 23:03

achave11-ucsc assigned nadove-ucsc Jan 13, 2025

nadove-ucsc requested changes Jan 14, 2025

View reviewed changes

nadove-ucsc removed their assignment Jan 14, 2025

achave11-ucsc force-pushed the issues/achave11-ucsc/5428-check-branch-script branch 2 times, most recently from 9b284ad to f83c00e Compare January 15, 2025 00:38

github-advanced-security bot found potential problems Jan 15, 2025

View reviewed changes

scripts/check_branch.py Fixed Show fixed Hide fixed

achave11-ucsc force-pushed the issues/achave11-ucsc/5428-check-branch-script branch from 9b284ad to 834f0e5 Compare January 15, 2025 00:50

achave11-ucsc requested a review from nadove-ucsc January 15, 2025 06:28

achave11-ucsc assigned nadove-ucsc and unassigned nadove-ucsc Jan 15, 2025

achave11-ucsc force-pushed the issues/achave11-ucsc/5428-check-branch-script branch 2 times, most recently from 0b9a55d to 9357280 Compare January 15, 2025 18:49

achave11-ucsc assigned hannes-ucsc Jan 31, 2025

hannes-ucsc requested changes Feb 4, 2025

View reviewed changes

hannes-ucsc removed their assignment Feb 4, 2025

achave11-ucsc force-pushed the issues/achave11-ucsc/5428-check-branch-script branch 2 times, most recently from fb51b97 to cdc2014 Compare February 4, 2025 23:19

achave11-ucsc requested a review from hannes-ucsc February 5, 2025 03:27

achave11-ucsc assigned hannes-ucsc Feb 5, 2025

hannes-ucsc previously approved these changes Feb 6, 2025

View reviewed changes

hannes-ucsc assigned achave11-ucsc and unassigned hannes-ucsc Feb 6, 2025

achave11-ucsc and others added 5 commits February 6, 2025 12:48

Eliminate old-fashioned type annotations in check_branch.py script

d7e56f3

[R] Fix: Dockerfile should source environment for global defaults (#6823

04527db

)

[1/3] Fix: GitHub CI workflow selects dev when building prod branch (#…

5f66afa

…5428)

[2/3] Fix: GitHub CI workflow selects dev when building prod branch (#…

86aef9f

…5428)

[3/3] Fix: GitHub CI workflow selects dev when building prod branch (#…

ef43bb1

…5428)

achave11-ucsc added the sandbox [process] Resolution is being verified in sandbox deployment label Feb 6, 2025

achave11-ucsc force-pushed the issues/achave11-ucsc/5428-check-branch-script branch from 517bce4 to ef43bb1 Compare February 6, 2025 21:25

[R] Ran make requirements_update

034764d

achave11-ucsc dismissed hannes-ucsc’s stale review via 034764d February 6, 2025 21:56

achave11-ucsc requested a review from hannes-ucsc February 6, 2025 23:25

achave11-ucsc assigned hannes-ucsc and unassigned achave11-ucsc Feb 6, 2025

hannes-ucsc approved these changes Feb 6, 2025

View reviewed changes

hannes-ucsc assigned achave11-ucsc and unassigned hannes-ucsc Feb 6, 2025

achave11-ucsc added the reqs [process] PR includes commit requiring ``make requirements`` label Feb 6, 2025

achave11-ucsc merged commit 64b1419 into develop Feb 6, 2025
11 checks passed

achave11-ucsc removed their assignment Feb 7, 2025

hannes-ucsc mentioned this pull request Feb 19, 2025

check_branch.py fails on chained PRs #6906

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix: GitHub CI workflow selects dev when building prod branch (#5428, #6823) #6818

Fix: GitHub CI workflow selects dev when building prod branch (#5428, #6823) #6818

achave11-ucsc commented Jan 10, 2025 •

edited

Loading

codecov bot commented Jan 11, 2025 •

edited

Loading

coveralls commented Jan 11, 2025 •

edited

Loading

nadove-ucsc Jan 14, 2025

achave11-ucsc Jan 15, 2025

nadove-ucsc Jan 14, 2025

achave11-ucsc Jan 15, 2025

nadove-ucsc Jan 14, 2025

nadove-ucsc Jan 14, 2025

achave11-ucsc Jan 15, 2025

achave11-ucsc commented Jan 15, 2025

hannes-ucsc left a comment

hannes-ucsc commented Feb 6, 2025

	deployment=$(PYTHONPATH=src python scripts/check_branch.py --print)
	deployment=$(python scripts/check_branch.py --print)

Fix: GitHub CI workflow selects dev when building prod branch (#5428, #6823) #6818

Fix: GitHub CI workflow selects dev when building prod branch (#5428, #6823) #6818

Conversation

achave11-ucsc commented Jan 10, 2025 • edited Loading

Checklist

Author

Author (partiality)

Author (chains)

Author (reindex, API changes)

Author (upgrading deployments)

Author (hotfixes)

Author (before every review)

Peer reviewer (after approval)

System administrator (after approval)

Operator (before pushing merge the commit)

System administrator

Operator (before pushing merge the commit)

Operator (chain shortening)

Operator (after pushing the merge commit)

Operator (reindex)

Operator

Shorthand for review comments

codecov bot commented Jan 11, 2025 • edited Loading

Codecov Report

coveralls commented Jan 11, 2025 • edited Loading

nadove-ucsc Jan 14, 2025

Choose a reason for hiding this comment

achave11-ucsc Jan 15, 2025

Choose a reason for hiding this comment

nadove-ucsc Jan 14, 2025

Choose a reason for hiding this comment

achave11-ucsc Jan 15, 2025

Choose a reason for hiding this comment

nadove-ucsc Jan 14, 2025

Choose a reason for hiding this comment

nadove-ucsc Jan 14, 2025

Choose a reason for hiding this comment

achave11-ucsc Jan 15, 2025

Choose a reason for hiding this comment

achave11-ucsc commented Jan 15, 2025

hannes-ucsc left a comment

Choose a reason for hiding this comment

hannes-ucsc commented Feb 6, 2025

Security design review

achave11-ucsc commented Jan 10, 2025 •

edited

Loading

codecov bot commented Jan 11, 2025 •

edited

Loading

coveralls commented Jan 11, 2025 •

edited

Loading