From 238f9e6c6cad0e086eb06c19f1a6a303fbb30fdc Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Sun, 20 Sep 2026 15:43:27 +0200 Subject: [PATCH] ci: pin the noble-dependent runners, and attest the SBOM without the wrapper Distilled from #2109 by Rares Popa. Two slices only; the rest of that PR is either frontend work the UI rebuild makes redundant, or a gating change that needs re-siting first. 1. Three jobs move from ubuntu-latest to ubuntu-24.04 _lint.yml `lint` and `lint-mem`, and _test.yml `test-diag`, each install a toolchain from an apt.llvm.org repo whose name contains the release: deb http://apt.llvm.org/noble/ llvm-toolchain-noble-20 main deb http://apt.llvm.org/noble/ llvm-toolchain-noble-21 main noble IS 24.04. So these jobs already depend on a specific release while asking for whatever ubuntu-latest happens to mean that morning. The day GitHub advances ubuntu-latest, all three break at once, on a schedule nobody here chose, and the failure surfaces as an apt error far from its cause. Pinning the runner to the release the repo line already names costs nothing and removes the trapdoor. 2. actions/attest-sbom -> actions/attest attest-sbom is deprecated. Its remaining behaviour is to print "::warning::actions/attest-sbom has been deprecated" and forward to actions/attest with NODE_OPTIONS set, passing sbom-path through unchanged. Calling attest directly yields the same attestation minus the wrapper. Verified rather than assumed, because this sits on the release path: 59d89421af93a897026c735860bf21b6eb4f7b26 is exactly tag v4.1.0 of actions/attest, and sbom-path is a real input on that action at that SHA. The step keeps no continue-on-error, so a failed SBOM attestation still fails the release. That is the intended behaviour and the comment now says so: an unattested SBOM is worse than an absent one, because the artifact ships looking complete. Deliberately NOT taken from #2109, each for its own reason: - the actionlint job, as sited. _lint.yml is consumed by pr.yml, dry-run.yml and release.yml, pr.yml gates its whole test stage on `if lint succeeded`, and release.yml gates build on needs.lint.result == 'success'. A job there is merge-blocking and release-blocking with no branch-protection edit to make it visible, and this one curls a tarball from github.com releases with no cache and no fallback. actionlint is worth having; not on that path, and not before it has been run against current main. - the test-package-wrappers node matrix. It reruns the Go and PyPI suites a second time per OS to vary a Node version only the npm leg reads. - everything frontend: the test-frontend job, .node-version, and the dependabot graph-ui block. The UI is being rebuilt from the ground up, so gating on the current one buys coverage of a surface that is going away. Co-authored-by: Rares Popa <2606875+rarepops@users.noreply.github.com> Signed-off-by: Martin Vogel --- .github/workflows/_lint.yml | 9 +++++++-- .github/workflows/_test.yml | 4 +++- .github/workflows/release.yml | 14 +++++++++++++- 3 files changed, 23 insertions(+), 4 deletions(-) diff --git a/.github/workflows/_lint.yml b/.github/workflows/_lint.yml index d5be0c717..367c1dd58 100644 --- a/.github/workflows/_lint.yml +++ b/.github/workflows/_lint.yml @@ -10,7 +10,11 @@ permissions: jobs: lint: - runs-on: ubuntu-latest + # Pinned, not ubuntu-latest: the LLVM install below adds an + # apt.llvm.org llvm-toolchain-NOBLE repo, which is 24.04 by name. When + # GitHub moves ubuntu-latest to the next LTS this job breaks on a day + # nobody chose. Pin the runner to the release the repo line already names. + runs-on: ubuntu-24.04 # 15 min proved too tight on a slow runner day and a timed-out lint reads # as "cancelled", which the release graph must treat as a hard stop; keep # a bound, but one only a genuine hang can hit (normal runtime ~5 min). @@ -60,7 +64,8 @@ jobs: # provability (never suppressed — the NOLINT ban applies here too). # Vendored-tree diagnostics are path-filtered, mirroring .cppcheck. lint-mem: - runs-on: ubuntu-latest + # Pinned for the same reason as `lint`: llvm-toolchain-noble-21 below. + runs-on: ubuntu-24.04 timeout-minutes: 60 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/.github/workflows/_test.yml b/.github/workflows/_test.yml index 7ccd56bf5..61ab9d0e0 100644 --- a/.github/workflows/_test.yml +++ b/.github/workflows/_test.yml @@ -245,7 +245,9 @@ jobs: # parallel suite — catches what an older compiler-rt can miss. Same # canonical scripts/test.sh wave as every other leg. test-diag: - runs-on: ubuntu-latest + # Pinned for the same reason as the lint jobs: the pinned diagnostic + # toolchain below installs from llvm-toolchain-noble-21. + runs-on: ubuntu-24.04 timeout-minutes: 120 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c0e796364..84e55a97c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -236,8 +236,20 @@ jobs: - name: Generate SBOM run: python3 scripts/ci/generate-sbom.py "${{ inputs.version }}" + # actions/attest-sbom is deprecated. What it does now is emit + # "::warning::actions/attest-sbom has been deprecated" and forward to + # actions/attest with NODE_OPTIONS set, passing sbom-path straight + # through. Calling attest directly produces the same attestation without + # the wrapper, and sbom-path is a first-class input there (verified + # against the action definition at this exact SHA, which is tag v4.1.0). + # + # This step deliberately carries no continue-on-error: a release must + # fail if its SBOM cannot be attested. An unattested SBOM is worse than + # an absent one, because the artifact still ships looking complete. - name: Attest SBOM - uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0 + uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0 + env: + NODE_OPTIONS: '--max-http-header-size=32768' with: subject-path: '*.tar.gz' sbom-path: 'sbom.json'