Files
computer-playbook/cli/meta/ci/dev_runtime.py
kevinveenbirkenbachandClaude Opus 5 66be8f6a0a test(lint): refuse a Debian codename in an image tag
A codename carries no ordering, so 'bookworm' and 'trixie' are two opaque
strings and no updater can tell that one supersedes the other. A pin that
names its Debian release that way is frozen on that release for as long as
it stands, and the freeze is invisible because the tag keeps resolving.
Numeric tags are comparable and stay inside the freshness pipeline, so the
rule is worth holding for the whole repository rather than fixing case by
case.

The check reads two shapes, because a codename reaches the tree in two
spellings. A 'name:tag' reference is recognised by the absence of a space
after the colon, which is what separates 'debian:bookworm' from the YAML
'image: python' and covers Dockerfile FROM lines and heredocs without a
second parser. A 'version:' value is read as a key, because '3.11-bookworm'
carries no colon at all.

False positives are kept out by two independent gates: a word-boundary
prefilter, so 'residual' and 'inside' are not read as 'sid', and a split of
the tag on '-', '.' and '_' that requires a whole component to be a
codename. That is what lets 'cache buster', '.stretched-link',
'fa-bullseye' and a tags list containing 'stretch' through. Every codename
occurrence in the repository was checked against the matcher by hand, and
the check was negative-controlled in both shapes, including an untracked
file.

Four references had to move for the rule to hold. meta/distros.yml takes
'debian:13' rather than '13.6': at depth 1 the updater can raise it across
a major, while depth 2 pins it inside the 13.x line forever. The whole
'make install' path was run in a debian:13 container to back that: all
twenty-four Depends and Recommends resolve on trixie, the docker repository
bootstrap derives the right suite and installs docker-ce-cli, and the
package builds and installs.

The workspace DiD probe moves to 'debian:13-slim'. An earlier version of
this change carried a suppression claiming the probe had to follow the
suite the apt proxy mirrors. That was wrong twice over: it cited a function
that has nothing to do with the probe, and the coupling does not exist,
because the cache frontend rewrites by path prefix and the suite never
enters a routing decision. Replaying the probe verbatim against
debian:13-slim fetches all three trixie suites through the
bookworm-configured proxies, so the suppression is gone rather than
reworded.

The rule ships with an escape hatch and no uses of it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-09-17 17:03:53 +02:00

121 lines
3.7 KiB
Python

"""Answer the development-runtime matrix questions from the distro SPOT.
Exists so workflow steps can ask for the matrix, and for the distro behind a
matrix entry, without embedding a python one-liner per question.
python3 -m cli.meta.ci.dev_runtime images
python3 -m cli.meta.ci.dev_runtime distro --image fedora:latest
python3 -m cli.meta.ci.dev_runtime matrix --mode rotate --run 42
"""
from __future__ import annotations
import argparse
import json
import sys
from utils.distros import (
FILE_META_DISTROS,
dev_runtime_images,
distro_of_dev_runtime_image,
)
from utils.symbol_glossary import to_emoji
TRACKS = ("compose", "swarm")
def image_label(image: str) -> str:
"""Shorten a dev-runtime image to its last two registry segments.
``quay.io/centos/centos:latest`` becomes ``centos:latest``; a two-segment
image such as ``debian:13`` is returned unchanged.
Args:
image: full image reference.
Returns:
The last two segments, joined by the separator that preceded the last.
"""
head, sep, tail = image.rpartition(":")
if not sep:
head, sep, tail = image.rpartition("/")
if not sep:
return image
return f"{head.rpartition('/')[2]}{sep}{tail}"
def workspace_matrix(images: list[str], mode: str, run: int) -> list[dict[str, str]]:
"""Assign exactly one workspace track to every dev-runtime image.
Args:
images: dev-runtime images, in SPOT order.
mode: ``compose`` or ``swarm`` to pin every image to that track,
``rotate`` to split the images across both.
run: run number; its parity flips a rotated split, so two consecutive
runs cover both tracks on every image.
Returns:
One ``{"image", "track", "icon", "label"}`` entry per image.
"""
tracks = (
[mode] * len(images)
if mode in TRACKS
else [TRACKS[(index + run) % len(TRACKS)] for index in range(len(images))]
)
return [
{
"image": image,
"track": track,
"icon": to_emoji(track),
"label": image_label(image),
}
for image, track in zip(images, tracks, strict=True)
]
def main(argv: list[str] | None = None) -> int:
parser = argparse.ArgumentParser(description=__doc__)
commands = parser.add_subparsers(dest="command", required=True)
commands.add_parser("images", help="Print the matrix images as a JSON array.")
distro = commands.add_parser(
"distro", help="Print the distro a matrix image belongs to."
)
distro.add_argument(
"--image", required=True, help="Matrix image, e.g. fedora:latest."
)
matrix = commands.add_parser(
"matrix", help="Print {image, track} pairs for the workspace matrix."
)
matrix.add_argument(
"--mode",
required=True,
choices=(*TRACKS, "rotate"),
help="Pin every image to one track, or rotate the split by run parity.",
)
matrix.add_argument(
"--run", required=True, type=int, help="Run number; its parity flips a rotate."
)
args = parser.parse_args(argv)
if args.command in ("images", "matrix"):
images = list(dev_runtime_images())
if not images:
print(
f"{FILE_META_DISTROS} declares no dev runtime image; "
"an empty matrix would skip every workspace job silently",
file=sys.stderr,
)
return 1
if args.command == "images":
print(json.dumps(images))
else:
print(json.dumps(workspace_matrix(images, args.mode, args.run)))
return 0
print(distro_of_dev_runtime_image(args.image))
return 0
if __name__ == "__main__":
sys.exit(main())