You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "rusackas (via GitHub)" <gi...@apache.org> on 2026/06/09 04:16:53 UTC
[PR] ci: pull CI service images from GHCR mirror (fork-safe) [depends on #40880] [superset]
rusackas opened a new pull request, #40882:
URL: https://github.com/apache/superset/pull/40882
### SUMMARY
Follow-up to #40880. Repoints CI's `services:` containers β `postgres`, `redis`, `mysql`, `presto` β across the **E2E**, **Python-Integration**, and **Presto/Hive** workflows at the GHCR mirror (`ghcr.io/apache/superset/ci/*`) and **removes the `credentials:` blocks**.
Public GHCR images pull **without** Docker Hub's anonymous rate limit **and without any credentials**, so this:
- kills the service-pull flakes on `master` / same-repo PRs (the problem #40875 tried to solve), **and**
- keeps **fork PRs working** β unlike `credentials:` on the service blocks, where a fork's empty secrets resolve to `''` and fail the workflow at parse time (`Unexpected value ''`). See #40880 for the full root-cause writeup.
Net diff: every `image:` flips to its `ghcr.io/apache/superset/ci/...` mirror, each DOCKERHUB `credentials:` block is deleted, and the now-incorrect "falls back to anonymous" comments are removed.
### π« DO NOT MERGE until the GHCR mirror is live
This is a **draft** and intentionally gated on #40880:
1. Merge #40880 (the mirror workflow).
2. Run "Mirror service images to GHCR" once and **confirm `ghcr.io/apache/superset/*` push works** under ASF infra.
3. Set the four mirrored packages (`ci/postgres`, `ci/redis`, `ci/mysql`, `ci/presto`) to **public**.
4. Rebase this PR on `master` and mark ready. (If the #40875 revert #40879 lands first, the credentials-removal hunks simply no-op on rebase, leaving only the image repoint.)
Until the packages exist and are public, **this PR's own CI will be red** (it'll try to pull images that aren't there yet) β that's expected.
### Out of scope
The `bde2020/hive-metastore-postgresql` image is pulled via `docker compose` (not a `services:` block) and is unaffected by this change β a separate, optional follow-up if we want it mirrored too.
### TESTING INSTRUCTIONS
Once the mirror is public and this is rebased, the existing integration/E2E/Presto-Hive suites exercise the pulls. Fork-PR behavior is the key check: a fork PR's jobs should reach the test phase instead of failing at "Set up job".
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration
π€ Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] ci: pull CI service images from GHCR mirror (fork-safe) [depends on #40880] [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #40882:
URL: https://github.com/apache/superset/pull/40882#issuecomment-5364151817
<!-- Bito Reply -->
The comment in `.github/workflows/superset-python-integrationtest.yml` is indeed outdated. Since the images have been migrated to `ghcr.io`, the reference to Docker Hub rate limits and authenticated pulls is no longer applicable. You should remove or update this comment to reflect the new image source.
**.github/workflows/superset-python-integrationtest.yml**
```
mysql:
- image: mysql:8.0
- # Authenticated pulls use our higher Docker Hub rate limit. Empty on
- # fork PRs (secrets unavailable) -> runner falls back to anonymous.
+ image: ghcr.io/apache/superset/ci/mysql:8.0
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] ci: pull CI service images from GHCR mirror (fork-safe) [depends on #40880] [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on PR #40882:
URL: https://github.com/apache/superset/pull/40882#issuecomment-4656137803
Rebased onto master now that the #40875 revert (#40879) has landed. Since the revert already removed the `credentials:` blocks, this PR is now a **pure image repoint** β 14 lines, just `image:` β `ghcr.io/apache/superset/ci/*` across the three workflows. Still gated on #40880 (mirror populated + packages public) before it goes green / un-draft.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] ci: pull CI service images from GHCR mirror (fork-safe) [depends on #40880] [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas merged PR #40882:
URL: https://github.com/apache/superset/pull/40882
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] ci: pull CI service images from GHCR mirror (fork-safe) [depends on #40880] [superset]
Posted by "netlify[bot] (via GitHub)" <gi...@apache.org>.
netlify[bot] commented on PR #40882:
URL: https://github.com/apache/superset/pull/40882#issuecomment-5366934069
### <span aria-hidden="true">β
</span> Deploy Preview for *superset-docs-preview* ready!
| Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">π¨</span> Latest commit | f2efa286236b496b9e9c3650af6d22802194e917 |
|<span aria-hidden="true">π</span> Latest deploy log | https://app.netlify.com/projects/superset-docs-preview/deploys/6a8802eb58dcc60008196903 |
|<span aria-hidden="true">π</span> Deploy Preview | [https://deploy-preview-40882--superset-docs-preview.netlify.app](https://deploy-preview-40882--superset-docs-preview.netlify.app) |
|<span aria-hidden="true">π±</span> Preview on mobile | <details><summary> Toggle QR Code... </summary><br /><br /><br /><br />_Use your smartphone camera to open QR code link._</details> |
|<span aria-hidden="true">π€</span> Make changes | [Run an agent on this branch](https://app.netlify.com/projects/superset-docs-preview/agent-runs#DcpBCoAgEADAv-w5aSsS7Qc9Q9dFhSzRCiL6e97mMC_kcqR8wgLQgS1mp9BMsb8qCx-oiMrljsQiJuO5tuU4b8ezuvakUQpHtrNyRBIR1aClxgm-Hw) |
---
<!-- [superset-docs-preview Preview](https://deploy-preview-40882--superset-docs-preview.netlify.app) -->
_To edit notification comments on pull requests, go to your [Netlify project configuration](https://app.netlify.com/projects/superset-docs-preview/configuration/notifications#deploy-notifications)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] ci: pull CI service images from GHCR mirror (fork-safe) [depends on #40880] [superset]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #40882:
URL: https://github.com/apache/superset/pull/40882#issuecomment-4656195049
## [Codecov](https://app.codecov.io/gh/apache/superset/pull/40882?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 64.13%. Comparing base ([`c58408d`](https://app.codecov.io/gh/apache/superset/commit/c58408d76c43194a7f0de0f613e9615234dd89c4?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`3ddc66e`](https://app.codecov.io/gh/apache/superset/commit/3ddc66e9b1d8a5642b1ab39e16dc3e80dc84757b?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #40882 +/- ##
=======================================
Coverage 64.13% 64.13%
=======================================
Files 2653 2653
Lines 143569 143569
Branches 33126 33126
=======================================
+ Hits 92084 92085 +1
+ Misses 49873 49872 -1
Partials 1612 1612
```
| [Flag](https://app.codecov.io/gh/apache/superset/pull/40882/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Ξ | |
|---|---|---|
| [javascript](https://app.codecov.io/gh/apache/superset/pull/40882/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `67.87% <ΓΈ> (+<0.01%)` | :arrow_up: |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/superset/pull/40882?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] ci: pull CI service images from GHCR mirror (fork-safe) [depends on #40880] [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on code in PR #40882:
URL: https://github.com/apache/superset/pull/40882#discussion_r3828390272
##########
.github/workflows/superset-python-integrationtest.yml:
##########
@@ -53,7 +53,7 @@ jobs:
mysql+mysqldb://superset:superset@127.0.0.1:13306/superset?charset=utf8mb4&binary_prefix=true
services:
mysql:
- image: mysql:8.0
+ image: ghcr.io/apache/superset/ci/mysql:8.0
Review Comment:
Good catch β that comment was left over from before the GHCR migration; it no longer applies since we no longer authenticate against Docker Hub at all. Removed it in f2efa28.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] ci: pull CI service images from GHCR mirror (fork-safe) [depends on #40880] [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #40882:
URL: https://github.com/apache/superset/pull/40882#issuecomment-4656044047
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] ci: pull CI service images from GHCR mirror (fork-safe) [depends on #40880] [superset]
Posted by "sadpandajoe (via GitHub)" <gi...@apache.org>.
sadpandajoe commented on code in PR #40882:
URL: https://github.com/apache/superset/pull/40882#discussion_r3826648718
##########
.github/workflows/superset-python-integrationtest.yml:
##########
@@ -53,7 +53,7 @@ jobs:
mysql+mysqldb://superset:superset@127.0.0.1:13306/superset?charset=utf8mb4&binary_prefix=true
services:
mysql:
- image: mysql:8.0
+ image: ghcr.io/apache/superset/ci/mysql:8.0
Review Comment:
The new GHCR image no longer uses Docker Hub or its credentials, but the following comment still describes an authenticated Docker Hub fallback. That leaves CI debugging guidance falseβcould we remove or update it with this image change?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org