feat(release): end-of-run fleet inventory report (completeness + freshness)#233
Open
elronbandel wants to merge 4 commits into
Open
feat(release): end-of-run fleet inventory report (completeness + freshness)#233elronbandel wants to merge 4 commits into
elronbandel wants to merge 4 commits into
Conversation
…hness) The release reported only per-leaf size/build-time, so stale, missing, or failed images stayed invisible — a published-but-stale combo could hide behind green stages (v0.1.0's combos were ~all 06-18/06-19 and nothing flagged it; it was found by hand in GHCR). Add a step to the report job that cross-checks the registry against the run: - every container package bucketed (base/leaf/per-task/combo/standalone) and split built-this-run vs older (push-time vs run start) -> step summary + a durable fleet-inventory.tsv artifact; - failed jobs bucketed by stage; - ::warning annotations for consumable layers (base/combo/standalone) that did not refresh this run. Adds actions:read so the report job can read this run's job results. Signed-off-by: Elron Bandel <elron.bandel@ibm.com>
… + failures) Signed-off-by: Elron Bandel <elron.bandel@ibm.com>
…rge) Signed-off-by: Elron Bandel <elron.bandel@ibm.com>
… GITHUB_TOKEN fallback GITHUB_TOKEN can't list org packages (confirmed in CI: total=0; the failure summary + freshness window DO work on it). Use a GHCR_READ_TOKEN secret (a read:packages PAT) for the org-packages listing call only, falling back to GITHUB_TOKEN when unset — inventory then shows 'unavailable', never failing the release. Drops the temporary debug line. Signed-off-by: Elron Bandel <elron.bandel@ibm.com>
This was referenced Jun 28, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds an end-of-run fleet inventory report to the release workflow's
reportjob. Every release now writes, to the run summary + a durablefleet-inventory.tsvartifact:<details>.::warningannotations for consumable layers (base/combo/standalone) that did NOT refresh this run.Why
The release's only report was per-leaf size/build-time. Nothing surfaced which images were stale, missing, or failed — so v0.1.0 shipped with ~6,400 stale combo/standalone images (06-18/06-19, pre-otel/gosu fix) and the only way to learn that was inspecting GHCR by hand. This makes "did the release publish a complete, fresh fleet?" answerable at a glance.
Sample (rendered locally against run 27940336791)
Failures: 73 — combos 42 · per-task 28 · leaf 2 · compose 1 (matches the run's actual failures exactly).
Verified
actionlintclean (shellchecks therun:script).GITHUB_TOKEN(withpackages: read, already granted viapackages: write) can list org packages — handled gracefully (empty → "inventory unavailable", never fails the release). Confirmed on the first release run after merge.Adds
actions: readso the report job can read this run's job results (the existing build-time column uses the same API).