You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@magpie.apache.org by po...@apache.org on 2026/10/23 16:05:13 UTC
(magpie-site) branch main updated: Only build and deploy on push to main (#241)
This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/magpie-site.git
The following commit(s) were added to refs/heads/main by this push:
new 966a9a1 Only build and deploy on push to main (#241)
966a9a1 is described below
commit 966a9a12b193b26c870fe9b46ff18cdad7043407
Author: Jarek Potiuk <ja...@potiuk.com>
AuthorDate: Fri Oct 23 18:05:07 2026 +0200
Only build and deploy on push to main (#241)
* Only build and deploy on push to main, skip lint and browser tests
Lint and the browser suites already gate the pull request; rerunning them
after merge only delays the deploy.
Generated-by: Claude Opus 5
* Run the ASF allowlist check on pull requests only
Generated-by: Claude Opus 5
* Keep the build gated on browser shards that time out
A shard that hits its timeout ends cancelled, not failed, so !failure()
let build run, and pass, on a PR whose browser tests had not finished.
Gate on the needs' results instead.
Generated-by: Claude Opus 5
* Refresh the Playwright apt cache on main, weekly and on every push
Pushes to main no longer run the browser suites, and a pull request
cannot restore another PR's cache, so nothing would save the apt cache
on main any more. A small workflow now does, on every push and weekly.
The key carries the ISO week so the weekly run saves a fresh entry with
that week's Ubuntu updates, and autoclean drops superseded packages.
The install steps move into a composite action both workflows share.
Generated-by: Claude Opus 5
* Build and deploy main weekly so synced docs stay current
The site's docs pages are synced from apache/magpie at build time, so
without a push here the published copy goes stale. The scheduled run
builds and deploys like a push, without lint or the browser suites.
Generated-by: Claude Opus 5
* Run the full gate in the weekly build of main
The weekly run now runs lint and the browser suites too, so main is
tested against the latest synced docs and dependencies. Its browser
suites save that week's apt cache, so the cache workflow no longer
needs a schedule of its own.
Generated-by: Claude Opus 5
* Cancel the build in progress when a newer commit arrives
Generated-by: Claude Opus 5
* Save the Playwright apt cache from one ubuntu-latest job, weekly
The cache job ran on ubuntu-slim, so the slow mirror it exists to avoid
could time it out at the 15-minute cap. It now runs on ubuntu-latest in
the plain ubuntu:24.04 image ubuntu-slim is built from, since the
ubuntu-latest image already has most of the packages and apt would not
download them. It is the only job that saves the cache, weekly ahead of
the scheduled build and on pushes; the shards only restore it. It also
runs on pull requests that change what it runs.
Generated-by: Claude Opus 5
* Tie the Playwright apt cache to ubuntu-slim's Ubuntu release
ubuntu-slim is not published as an image, so a job on an ubuntu-slim
runner now reports which Ubuntu release it is, and the cache job fails
unless its container is that release. The cache key carries the release
too, so packages are only restored onto the release they were built for.
Generated-by: Claude Opus 5
* Save the Playwright apt cache on the weekly schedule only
One weekly job is the cache's only writer, so the lockfile hash no
longer belongs in the key: it only caused misses until the next weekly
save. The key is now the Ubuntu release and the ISO week. The job can
still be run by hand to seed a missing cache.
Generated-by: Claude Opus 5
---
.github/actions/playwright-chromium/action.yml | 68 +++++++++++++++++++++
.github/workflows/asf-allowlist-check.yml | 3 -
.github/workflows/browser-tests.yml | 18 +-----
.github/workflows/build.yml | 21 ++++++-
.github/workflows/playwright-cache.yml | 85 ++++++++++++++++++++++++++
5 files changed, 173 insertions(+), 22 deletions(-)
diff --git a/.github/actions/playwright-chromium/action.yml b/.github/actions/playwright-chromium/action.yml
new file mode 100644
index 0000000..d3e2080
--- /dev/null
+++ b/.github/actions/playwright-chromium/action.yml
@@ -0,0 +1,68 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+---
+# Installs Chromium and its system packages for Playwright, after `npm ci`.
+# The browser suites only restore the apt cache; playwright-cache.yml saves it.
+name: "Playwright Chromium"
+description: "Install Playwright's Chromium with its apt packages kept in the Actions cache"
+inputs:
+ save:
+ description: "Save the apt cache after the install when the key was not an exact hit"
+ default: "false"
+runs:
+ using: composite
+ steps:
+ # Playwright's system packages (mostly fonts, ~28 MB) come from the Ubuntu
+ # mirror, which some runners reach at ~40 kB/s: the install then takes
+ # 10-13 of a job's 15 minutes and the shard times out. Keep the downloaded
+ # .debs in the Actions cache so apt installs them locally; on a miss it
+ # fetches only what the cache lacks. The runner image's docker-clean hook
+ # would delete them after the install.
+ #
+ # An exact key hit is never saved again, so the key carries the ISO week:
+ # each weekly save stores that week's Ubuntu updates, and autoclean drops
+ # the .debs those updates superseded. The key also carries the Ubuntu
+ # release the job runs on, so packages are only ever restored onto the
+ # release they were built for. A container job runs as root without sudo.
+ - name: Keep apt's downloads for the cache
+ id: apt-cache
+ shell: bash
+ run: |
+ sudo=$(command -v sudo || true)
+ mkdir -p "${HOME}/apt-cache/partial"
+ ${sudo} rm -f /etc/apt/apt.conf.d/docker-clean
+ echo "Dir::Cache::Archives \"${HOME}/apt-cache\";" | ${sudo} tee /etc/apt/apt.conf.d/99playwright-cache
+ . /etc/os-release
+ echo "os=${ID}-${VERSION_ID}" >> "${GITHUB_OUTPUT}"
+ echo "week=$(date -u +%G-W%V)" >> "${GITHUB_OUTPUT}"
+ - id: restore
+ uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+ with:
+ path: ~/apt-cache/*.deb
+ key: playwright-apt-${{ steps.apt-cache.outputs.os }}-${{ steps.apt-cache.outputs.week }}
+ restore-keys: playwright-apt-${{ steps.apt-cache.outputs.os }}-
+ - shell: bash
+ run: |
+ sudo=$(command -v sudo || true)
+ npx playwright install --with-deps chromium
+ ${sudo} apt-get autoclean
+ - if: inputs.save == 'true' && steps.restore.outputs.cache-hit != 'true'
+ uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+ with:
+ path: ~/apt-cache/*.deb
+ key: ${{ steps.restore.outputs.cache-primary-key }}
diff --git a/.github/workflows/asf-allowlist-check.yml b/.github/workflows/asf-allowlist-check.yml
index 2d81dcf..7fd3586 100644
--- a/.github/workflows/asf-allowlist-check.yml
+++ b/.github/workflows/asf-allowlist-check.yml
@@ -20,9 +20,6 @@ name: "ASF Allowlist Check"
"on":
pull_request:
paths: [".github/**"]
- push:
- branches: [main]
- paths: [".github/**"]
permissions:
contents: read
jobs:
diff --git a/.github/workflows/browser-tests.yml b/.github/workflows/browser-tests.yml
index 745f70a..853085e 100644
--- a/.github/workflows/browser-tests.yml
+++ b/.github/workflows/browser-tests.yml
@@ -47,23 +47,7 @@ jobs:
node-version: "22"
cache: npm
- run: npm ci
- # Playwright's system packages (mostly fonts, ~28 MB) come from the Ubuntu
- # mirror, which some runners reach at ~40 kB/s: the install then takes
- # 10-13 of the job's 15 minutes and the shard times out. Keep the
- # downloaded .debs in the Actions cache so apt installs them locally; on
- # a miss it fetches only what the cache lacks. The runner image's
- # docker-clean hook would delete them after the install.
- - name: Keep apt's downloads for the cache
- run: |
- mkdir -p "${HOME}/apt-cache/partial"
- sudo rm -f /etc/apt/apt.conf.d/docker-clean
- echo "Dir::Cache::Archives \"${HOME}/apt-cache\";" | sudo tee /etc/apt/apt.conf.d/99playwright-cache
- - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
- with:
- path: ~/apt-cache/*.deb
- key: playwright-apt-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
- restore-keys: playwright-apt-${{ runner.os }}-
- - run: npx playwright install --with-deps chromium
+ - uses: $/.github/actions/playwright-chromium
- run: npm run sync-docs
- name: Run the suite
env:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f8aa186..ffde5ca 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -5,14 +5,20 @@ on:
branches: [main]
pull_request:
branches: [main]
+ # Weekly, so the published site picks up docs changed in apache/magpie
+ # even when nothing here is pushed, and the full gate runs against main.
+ schedule:
+ - cron: "41 3 * * 1"
workflow_dispatch:
permissions:
contents: read
+# A newer push supersedes the run in progress: only the latest commit's build
+# is worth deploying, and the deploy's force-push of "publish" is atomic.
concurrency:
group: build-${{ github.ref }}
- cancel-in-progress: false
+ cancel-in-progress: true
env:
# Ship the published site (built from main) with the review overlay: one
@@ -22,7 +28,11 @@ env:
MAIN_REVIEW_OVERLAY: "true"
jobs:
+ # Lint and the browser suites gate pull requests and the weekly run; a push
+ # to main has already passed them on its PR, so it only builds and deploys.
+ # playwright-cache.yml keeps the browser suites' apt cache fresh.
lint:
+ if: github.event_name != 'push'
runs-on: ubuntu-slim
timeout-minutes: 10
env:
@@ -67,12 +77,17 @@ jobs:
# rather than after lint: they are the longest part of the run, and `build`
# still waits for both.
browser:
+ if: github.event_name != 'push'
permissions:
contents: read
uses: $/.github/workflows/browser-tests.yml
build:
needs: [lint, browser]
+ # Run when lint and browser passed, or were skipped on a push. A shard that
+ # hits its timeout ends "cancelled", not "failure", so !failure() alone
+ # would let the build through.
+ if: ${{ !cancelled() && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') }}
runs-on: ubuntu-slim
timeout-minutes: 10
permissions:
@@ -170,7 +185,9 @@ jobs:
deploy:
needs: build
- if: github.ref == 'refs/heads/main'
+ # The skipped lint and browser jobs upstream of build would otherwise skip
+ # this job too.
+ if: ${{ !cancelled() && needs.build.result == 'success' && github.ref == 'refs/heads/main' }}
runs-on: ubuntu-slim
timeout-minutes: 10
permissions:
diff --git a/.github/workflows/playwright-cache.yml b/.github/workflows/playwright-cache.yml
new file mode 100644
index 0000000..4116204
--- /dev/null
+++ b/.github/workflows/playwright-cache.yml
@@ -0,0 +1,85 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+---
+# The only job that saves the browser suites' Playwright apt cache; the
+# shards just restore it. Weekly on main, ahead of build.yml's scheduled run,
+# it saves that week's entry with the latest Ubuntu updates; a pull request can
+# restore caches saved on main. Run it by hand to seed a missing cache.
+#
+# It runs on ubuntu-latest, which has no 15-minute cap, so a slow mirror only
+# slows it down, inside the plain Ubuntu image that ubuntu-slim is built FROM:
+# the ubuntu-latest image has most of these packages installed already, so apt
+# there would not download, and the cache would not hold, what the shards
+# need. ubuntu-slim is not published as an image, so slim-release asks an
+# ubuntu-slim runner which Ubuntu release it is, and the cache job fails unless
+# its container is that release: when GitHub moves ubuntu-slim to a new one,
+# update `container` below.
+name: "Playwright cache"
+"on":
+ schedule:
+ - cron: "17 3 * * 1"
+ workflow_dispatch:
+
+permissions:
+ contents: read
+
+concurrency:
+ group: playwright-cache
+ cancel-in-progress: true
+
+jobs:
+ slim-release:
+ runs-on: ubuntu-slim
+ timeout-minutes: 5
+ outputs:
+ image: ${{ steps.release.outputs.image }}
+ steps:
+ - id: release
+ run: |
+ . /etc/os-release
+ echo "ubuntu-slim ${ImageVersion:-unknown} is ${PRETTY_NAME}"
+ echo "image=${ID}:${VERSION_ID}" >> "${GITHUB_OUTPUT}"
+
+ playwright-cache:
+ needs: slim-release
+ runs-on: ubuntu-latest
+ container: ubuntu:24.04
+ timeout-minutes: 45
+ env:
+ DEBIAN_FRONTEND: noninteractive
+ steps:
+ - name: Check the container is ubuntu-slim's release
+ env:
+ SLIM: ${{ needs.slim-release.outputs.image }}
+ run: |
+ . /etc/os-release
+ if [ "${ID}:${VERSION_ID}" != "${SLIM}" ]; then
+ echo "::error::ubuntu-slim is now ${SLIM}, but this job runs in ${ID}:${VERSION_ID}; set its container to ${SLIM}"
+ exit 1
+ fi
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ persist-credentials: false
+ - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+ with:
+ node-version: "22"
+ cache: npm
+ - run: npm ci
+ - uses: $/.github/actions/playwright-chromium
+ with:
+ save: "true"