mirror of
https://github.com/pgadmin-org/pgadmin4.git
synced 2026-11-03 12:49:23 -06:00
Dave Page
6f322ea160
Ten fixes from a review pass with fresh eyes. The ones that mattered: rebuild-yum-repo.sh signed repomd.xml with no -u, so it used whatever the keyring's default key resolved to. That is the packaging key today only because there is one secret key in it. A repository whose metadata is signed by the wrong key is one every client with gpgcheck=1 rejects, produced by a run that exits 0. The snapshot publish gate required only deb and rpm, whilst its comment justified exactly one exception. A failed docs, tarball or wheel job published a snapshot missing those files, and a failed repo-rpm job was worse: install-repo-readme.py then fails after the packages are uploaded and signed, leaving half a snapshot on the download server. The location input was interpolated into shell on the runner holding both publishing keys. It now travels through the environment, and is validated against the shape of a datestamp before anything downstream sees it, so a bad one fails in five seconds rather than after an hour of building. Make.bat tested %ERRORLEVEL% inside a parenthesised block, where it is expanded at parse time, so a failed Authenticode signature on pgAdmin4.exe was undetectable; the handler was PAUSE, which on a headless signing host either returns at once or blocks until the job times out. Both sites now fail the build. A called workflow inherits the caller's ref, so once this is on master an ordinary push would have shared a concurrency group with the nightly snapshot's builds and cancelled them. And PULL_KEY named a file that does not exist on the download server, which would have failed the first release promotion. The rest: if-no-files-found on every build artefact, so a build that produces nothing fails rather than silently shipping a snapshot without it; pinned syft and helm installers, which were piping a default branch into a shell as root in the container that builds signed packages; the Helm chart no longer built and discarded; and the comments that had stopped describing the code. The self-test grows from 56 cases to 70, covering the verbs that delete things, arguments that look like options, and the SSH_ORIGINAL_COMMAND entry point rather than only the dry-run path.
97 lines
2.9 KiB
YAML
97 lines
2.9 KiB
YAML
name: Check documentation builds
|
|
|
|
on:
|
|
# Callable from snapshot.yml, so that what gets published is the
|
|
# same build that runs on every push rather than a second
|
|
# definition of it that can drift.
|
|
workflow_call:
|
|
|
|
push:
|
|
branches: [ "master" ]
|
|
paths:
|
|
- 'docs/**'
|
|
- 'web/version.py'
|
|
- 'web/branding.py'
|
|
- 'requirements.txt'
|
|
- 'Makefile'
|
|
- 'web/config.py'
|
|
- 'tools/setup-python-env.sh'
|
|
- '.github/workflows/check-doc-builds.yml'
|
|
pull_request:
|
|
branches: [ "master" ]
|
|
paths:
|
|
- 'docs/**'
|
|
- 'web/version.py'
|
|
- 'web/branding.py'
|
|
- 'requirements.txt'
|
|
- 'Makefile'
|
|
- 'web/config.py'
|
|
- 'tools/setup-python-env.sh'
|
|
- '.github/workflows/check-doc-builds.yml'
|
|
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
# The workflow's own name, spelled out rather than taken from
|
|
# github.workflow, because in a reusable workflow that expression is
|
|
# the CALLER's name. Every workflow Snapshot calls would otherwise
|
|
# share one group and, with cancel-in-progress, cancel each other.
|
|
# github.event_name is in the key because a called workflow inherits the
|
|
# caller's ref: once this is on master, the nightly Snapshot's deb build
|
|
# and an ordinary push's deb build would otherwise share a group and,
|
|
# with cancel-in-progress, kill each other. A push landing mid-nightly
|
|
# would cancel the snapshot's build and skip the publish entirely.
|
|
group: 'check-doc-builds @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }} @ ${{ github.event_name }}'
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
build-docs:
|
|
runs-on: ubuntu-22.04
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Install platform dependencies
|
|
run: |
|
|
sudo apt update
|
|
sudo apt install -y libpq-dev libffi-dev libssl-dev libkrb5-dev zlib1g-dev latexmk texlive-latex-recommended tex-gyre texlive-latex-extra
|
|
|
|
- name: Install Python dependencies
|
|
run: make install-python
|
|
|
|
- name: Check the HTML build
|
|
run: |
|
|
. venv/bin/activate
|
|
make docs
|
|
|
|
- name: Archive HTML
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: pgadmin4-html-build-output
|
|
if-no-files-found: error
|
|
path: docs/en_US/_build/html/*
|
|
|
|
- name: Check the ePub build
|
|
run: |
|
|
. venv/bin/activate
|
|
make docs-epub
|
|
|
|
- name: Archive ePub
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: pgadmin4-epub-build-output
|
|
if-no-files-found: error
|
|
path: docs/en_US/_build/epub/pgAdmin4.epub
|
|
|
|
- name: Check the PDF build
|
|
run: |
|
|
. venv/bin/activate
|
|
make docs-pdf
|
|
|
|
- name: Archive PDF
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: pgadmin4-pdf-build-output
|
|
if-no-files-found: error
|
|
path: docs/en_US/_build/latex/pgadmin4.pdf
|