mirror of
https://github.com/hanzoai/ci.git
synced 2026-10-27 09:19:34 +00:00
zeekayandHanzo Dev
dae0b86c62
A branch build published `sha-<short7>` and nothing else, so an image only earned a semver when a human remembered to cut a git tag. That is why 14 of the fleet's 117 universe pins name a commit instead of a release — not drift, just the only tag CI ever offered them. bin/imgver is that number, derived and never typed, monotonic against two floors: the repo's own manifest (package.json / Cargo.toml / VERSION / pyproject.toml, or an explicit `version:`) and the highest semver already at the registry for that image. max + a patch, so one tag can never come to cover two digests — deriving from the manifest alone re-publishes the same number until someone edits the file, and a node on imagePullPolicy: IfNotPresent never picks up the second one. universe's images.yml learned that rule on iam-secret-sync; this is that rule, for every repo. It is a SCRIPT, not inline shell, because the fleet has two build front doors: this reusable, and the hand-rolled .hanzo/workflows/deploy.yml that 11 repos carry instead of importing it. Both need the identical number, and written twice it would be right twice and then wrong once. .github/actions/imgver is the composite action those 11 call; build.yml calls the same script. Also: the semver tag is proven resolvable before the run goes green (buildx can exit 0 while the manifest is not yet servable, and a pin onto a phantom tag is an ImagePullBackOff), and the run summary prints tag and digest TOGETHER — universe pins repo:tag@digest and the kubelet honours the digest, so a new tag beside an old digest reports the new version while serving the old bytes. 22 cases in bin/imgver_test.sh, wired into hanzo.yml's test gate so it runs. Both build.yml copies (.github/ for GitHub, .hanzo/ for the forge) stay byte-identical. Co-authored-by: Hanzo Dev <[email protected]>
61 lines
3.2 KiB
Bash
Executable File
61 lines
3.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Tests for bin/imgver. Runs offline: no GH_PAT means no registry read, so the
|
|
# published floor is injected through IMGVER_PUBLISHED and every case is
|
|
# deterministic. Run: bash bin/imgver_test.sh
|
|
set -uo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
IMGVER="$PWD/bin/imgver"
|
|
tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT
|
|
fail=0
|
|
|
|
run() { # run <declared-env> <published> <ctx>
|
|
IMGVER_VERSION="$1" IMGVER_PUBLISHED="$2" GH_PAT= GITHUB_TOKEN= \
|
|
bash "$IMGVER" ghcr.io/hanzoai/test "$3" 2>/dev/null
|
|
}
|
|
t() { # t <name> <declared> <published> <ctx> <want>
|
|
got=$(run "$2" "$3" "$4"); rc=$?
|
|
[ $rc -ne 0 ] && got="ERROR"
|
|
if [ "$got" = "$5" ]; then printf 'ok %-52s -> %s\n' "$1" "$got"
|
|
else printf 'FAIL %-52s -> %s (want %s)\n' "$1" "$got" "$5"; fail=1; fi
|
|
}
|
|
|
|
# --- the derivation ---------------------------------------------------------
|
|
t "registry ahead: next patch, monotonic" 1.2.3 1.2.7 "$tmp" 1.2.8
|
|
t "human bumped the minor: honour it verbatim" 1.3.0 1.2.8 "$tmp" 1.3.0
|
|
t "same number published: never 2 digests/name" 1.2.3 1.2.3 "$tmp" 1.2.4
|
|
t "no manifest version: registry carries it" "" 1.2.7 "$tmp" 1.2.8
|
|
t "nothing published: seed at declared" 1.2.3 "" "$tmp" 1.2.3
|
|
t "major bump honoured" 2.0.0 1.9.9 "$tmp" 2.0.0
|
|
t "sort -V not lexical (1.2.10 > 1.2.9)" 1.2.9 1.2.10 "$tmp" 1.2.11
|
|
t "cloud's real series" 1.801.341 1.801.341 "$tmp" 1.801.342
|
|
t "stale manifest cannot drag series backwards" 0.0.1 0.9.0 "$tmp" 0.9.1
|
|
t "no version anywhere: fail loud, never sha" "" "" "$tmp" ERROR
|
|
t "leading v stripped" v1.4.0 "" "$tmp" 1.4.0
|
|
t "0.0.0 workspace stub is not a version" 0.0.0 1.1.1 "$tmp" 1.1.2
|
|
t "non-semver declared is ignored" "1.2" 2.0.0 "$tmp" 2.0.1
|
|
|
|
# --- manifest discovery ------------------------------------------------------
|
|
m() { rm -rf "$tmp"/m; mkdir -p "$tmp"/m; }
|
|
m; echo '{"version":"3.4.5"}' > "$tmp/m/package.json"
|
|
t "package.json" "" "" "$tmp/m" 3.4.5
|
|
m; printf '[package]\nname="x"\nversion = "6.7.8"\n' > "$tmp/m/Cargo.toml"
|
|
t "Cargo.toml [package]" "" "" "$tmp/m" 6.7.8
|
|
m; printf '[workspace.package]\nversion = "1.45.2"\n' > "$tmp/m/Cargo.toml"
|
|
t "Cargo.toml [workspace.package] (index's shape)" "" "" "$tmp/m" 1.45.2
|
|
m; echo "9.9.9" > "$tmp/m/VERSION"
|
|
t "VERSION file" "" "" "$tmp/m" 9.9.9
|
|
m; printf '[project]\nversion = "2.3.4"\n' > "$tmp/m/pyproject.toml"
|
|
t "pyproject.toml" "" "" "$tmp/m" 2.3.4
|
|
m; echo '{"name":"x"}' > "$tmp/m/package.json"
|
|
t "package.json with no version key -> ERROR" "" "" "$tmp/m" ERROR
|
|
m; echo '{"version":"0.0.0"}' > "$tmp/m/package.json"
|
|
t "workspace stub package.json -> ERROR" "" "" "$tmp/m" ERROR
|
|
m; echo '{"version":"1.0.0"}' > "$tmp/m/package.json"
|
|
t "IMGVER_VERSION overrides the manifest" 5.5.5 "" "$tmp/m" 5.5.5
|
|
m; echo '{"version":"1.0.0"}' > "$tmp/m/package.json"
|
|
t "resolver expression <file>:<command>" "package.json:echo 7.7.7" "" "$tmp/m" 7.7.7
|
|
|
|
echo
|
|
[ $fail -eq 0 ] && echo "imgver: all cases pass" || echo "imgver: FAILURES"
|
|
exit $fail
|