You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
feat: follow the decdn and sponsord release lines, not one release - #160
The roles and the chart now pin the decdn/decdn and decdn/sponsord release line (0.1) instead of one release, so an upstream patch release reaches deployments without a release of the collections or the chart. An exact X.Y.Z still pins one release.
Roles (decdn_node, sponsord, sponsord_onramp)
decdn_node_version, sponsord_version and sponsord_onramp_version default to "0.1". Every release-mode run resolves the line through tasks/resolve-release.yml, which is copied into all three roles; make test-scripts keeps the copies identical. The resolver picks the highest vX.Y.N in GitHub's release list that is not a draft or a prerelease and has a SHA256SUMS.asc. The list only chooses the tag: the download is GPG-verified as before, and the install stamp and the exact --version backstop hold the resolved version. Check mode reads the list too, so make check shows the upgrade a run would make.
Outages: if the list can't be read (GitHub down, or the 60-requests-an-hour unauthenticated limit), a host already on a release of the line keeps it with a warning. A host with no release of the line fails. A rate limit (403/429) is not retried.
The pins must be quoted strings matching X.Y or X.Y.Z[-pre]. v0.1, 0.1.x and an unquoted 0.1 are refused.
The onramp's installer pin (sponsord_onramp_decdn_release) defaults to the line v0.1. The role reads that release's SHA256SUMS from where the installers fetch it and verifies it against a vendored copy of decdn's KEYS (roles/sponsord_onramp/files/decdn-release-KEYS.asc, kept identical to decdn_node's). It then serves the release's digest. An exact tag still takes the operator's digest, and preflight refuses a tag without a digest or a line with one.
The onramp reuses sponsord's resolution of the same line on the host, so a release published between the two plays can't put the two binaries on different releases.
Chart
appVersion: "0.1": the default image tag is the floating line tag upstream promotes. A new decdn-node.pullPolicy helper picks Always for a line tag and IfNotPresent for an exact tag or a digest; an explicit image.pullPolicy wins. scripts/fetch-decdn-cli.sh resolves the line, so CI's helm job (now with the job token) validates against the line's newest decdn.
Compose, bumps and drift
Compose stays pinned by digest; it names the line's newest release.
bump_decdn.py (new synced and kind subcommands) and open-decdn-bump.sh now tell two cases apart:
A patch: repo-only. It moves the Compose digests and the onramp env pin, the chart's example digest, the exact-pin examples and the generated mirrors. It flags a mirror change, which would need a release.
A new line: it also moves the role defaults, appVersion and AGENTS.md.
upstream-drift resolves each line the way the roles do, checks the exact copies and mirrors against that release, and flags only a new line.
sync-network-profiles.py defaults --ref to the checkout's newest tag in the line.
Testing
Lints:make test-scripts, lint, lint-ansible (production), lint-compose, lint-cloud-init, and lint-helm with DECDN_CLI fetched by resolving 0.1 → 0.1.0 against the real release.
Molecule:cloud-init, cloud-init-publisher, sponsord-install, sponsord-onramp, validation, validation-sponsord, default and sponsord all pass. The test mirror now serves a GitHub-shaped releases.json, and these cases are new:
line 0.7 → 0.7.10, skipping a newer prerelease, a draft and a release without .asc, and 0.7.10 vs 0.7.2 ordered numerically;
the list unreachable: 0.7.10 is kept, and a line with nothing installed fails;
sponsord's line 0.3 → 0.3.4;
the onramp serves v0.0.5 with the mirror's SHA256SUMS digest;
malformed pins are refused.
Not run locally:make galaxy-check (galaxy-importer isn't installed here). Both collections build and carry the new files.
Trade-offs
Each release-mode deploy makes a GitHub API call per pin: up to 4 per publisher host. A large fleet behind one address should pin exact versions or serve the list from a mirror (the *_release_index variables). With Always, a Kubernetes pod can't start while ghcr.io is unreachable, even with the image cached. Both are documented in the role and chart READMEs.
After merging, release decdn.node, decdn.publisher and the chart (RELEASING.md): from then on, 0.1.x patches need only the repo-only bump PR.
decdn_node_version, sponsord_version and sponsord_onramp_version default to a
release line ("0.1"), and every run installs its newest finished vX.Y.N
(tasks/resolve-release.yml, copied into all three roles): the highest release
in GitHub's release list that is not a draft or a prerelease and has a
SHA256SUMS.asc. The list only chooses the tag; the download is verified as
before, and the stamp and the --version backstop hold the resolved version. An
exact "X.Y.Z" still pins one release, with no lookup.
The onramp's installer pin follows decdn's line too (v0.1): the role reads the
resolved release's SHA256SUMS from where the installers fetch it, verifies it
against a vendored copy of decdn's KEYS and serves its digest. A tag still
takes the operator's digest.
The chart's appVersion is the line and its default image tag the line's
floating tag, pulled Always (decdn-node.pullPolicy); fetch-decdn-cli.sh
resolves the line for CI's config validation.
Compose stays pinned by digest. bump_decdn.py and open-decdn-bump.sh now tell
a patch release (repo-only: Compose, the example digests and pins, the
mirrors) from a new line, and upstream-drift checks the exact copies against
each line's newest release and flags only a new line.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- fetch-decdn-cli.sh sends GITHUB_TOKEN to GitHub's API only, never to a
DECDN_RELEASE_INDEX override; a loopback index in make test-scripts asserts
no Authorization header arrives.
- The onramp records the decdn release it serves on both paths, exact pins
included, so a later release-line lookup that cannot read GitHub falls back
to the release actually served, never an older one. The record path is a
role var (vars/main/decdn-release.yml); sponsord-onramp and
cloud-init-publisher assert it.
- The release-version failure messages of sponsord and sponsord_onramp (and
decdn_node's wording) describe both accepted forms, quoting and the index.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Mirror instructions omit the release-index override
ansible/roles/sponsord_onramp/README.md:30
This now says a line is resolved through sponsord_onramp_release_index, but the mirror instruction names only sponsord_onramp_release_base. Standalone users following it still contact GitHub to resolve the line and can fail before reaching the mirrored downloads; document that both variables must point at the mirror.
Document required release-index overrides for offline mirrors
cloud-init/README.md:213
For a release-line deployment, overriding these download bases alone does not make the documented mirror self-contained: sponsord_release_index still defaults to GitHub (and the installers' decdn line separately uses sponsord_onramp_decdn_release_index). Name the required index overrides so an offline or rate-limited cloud-init host can actually resolve from its mirror.
Mirror example omits the release-list endpoint override
cloud-init/user-data-publisher.yaml:112
The default is now a release line, but the mirror example below overrides only the download base. Resolution still calls the default GitHub sponsord_release_index, so an offline or rate-limited cloud-init deployment configured from this example fails before using its mirror. Add the mirrored release-list endpoint too.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The roles and the chart now pin the decdn/decdn and decdn/sponsord release line (
0.1) instead of one release, so an upstream patch release reaches deployments without a release of the collections or the chart. An exactX.Y.Zstill pins one release.Roles (
decdn_node,sponsord,sponsord_onramp)decdn_node_version,sponsord_versionandsponsord_onramp_versiondefault to"0.1". Every release-mode run resolves the line throughtasks/resolve-release.yml, which is copied into all three roles;make test-scriptskeeps the copies identical. The resolver picks the highestvX.Y.Nin GitHub's release list that is not a draft or a prerelease and has aSHA256SUMS.asc. The list only chooses the tag: the download is GPG-verified as before, and the install stamp and the exact--versionbackstop hold the resolved version. Check mode reads the list too, somake checkshows the upgrade a run would make.X.YorX.Y.Z[-pre].v0.1,0.1.xand an unquoted0.1are refused.sponsord_onramp_decdn_release) defaults to the linev0.1. The role reads that release'sSHA256SUMSfrom where the installers fetch it and verifies it against a vendored copy of decdn's KEYS (roles/sponsord_onramp/files/decdn-release-KEYS.asc, kept identical to decdn_node's). It then serves the release's digest. An exact tag still takes the operator's digest, and preflight refuses a tag without a digest or a line with one.Chart
appVersion: "0.1": the default image tag is the floating line tag upstream promotes. A newdecdn-node.pullPolicyhelper picksAlwaysfor a line tag andIfNotPresentfor an exact tag or a digest; an explicitimage.pullPolicywins.scripts/fetch-decdn-cli.shresolves the line, so CI's helm job (now with the job token) validates against the line's newestdecdn.Compose, bumps and drift
bump_decdn.py(newsyncedandkindsubcommands) andopen-decdn-bump.shnow tell two cases apart:appVersionand AGENTS.md.upstream-driftresolves each line the way the roles do, checks the exact copies and mirrors against that release, and flags only a new line.sync-network-profiles.pydefaults--refto the checkout's newest tag in the line.Testing
make test-scripts,lint,lint-ansible(production),lint-compose,lint-cloud-init, andlint-helmwithDECDN_CLIfetched by resolving0.1→0.1.0against the real release.cloud-init,cloud-init-publisher,sponsord-install,sponsord-onramp,validation,validation-sponsord,defaultandsponsordall pass. The test mirror now serves a GitHub-shapedreleases.json, and these cases are new:0.7→ 0.7.10, skipping a newer prerelease, a draft and a release without.asc, and 0.7.10 vs 0.7.2 ordered numerically;0.3→ 0.3.4;v0.0.5with the mirror'sSHA256SUMSdigest;make galaxy-check(galaxy-importer isn't installed here). Both collections build and carry the new files.Trade-offs
Each release-mode deploy makes a GitHub API call per pin: up to 4 per publisher host. A large fleet behind one address should pin exact versions or serve the list from a mirror (the
*_release_indexvariables). WithAlways, a Kubernetes pod can't start while ghcr.io is unreachable, even with the image cached. Both are documented in the role and chart READMEs.After merging, release
decdn.node,decdn.publisherand the chart (RELEASING.md): from then on,0.1.xpatches need only the repo-only bump PR.🤖 Generated with Claude Code