ci(reconcile): auto-rewrite derived files when versions.yaml changes - #31
Merged
Conversation
Editing omni/versions.yaml to a version that needs no new build (re-pin,
rollback, canary tweak) used to leave oci-lab's machine classes and cluster
template stale: only the talos-images build rewrote them, and it does not run
when nothing needs to be built.
On a push to main touching omni/versions.yaml this workflow runs
check-version-drift.py --write and commits the derived-file fix.
The installer_built() guard keeps the two writers from racing:
* Already-built target -> --write succeeds, derived files committed here.
* Not-yet-built target -> the guard refuses, the job fails with a clear
'build first' message, and the operator runs the talos-images build as
before; that build ships the installer and rewrites derived files (4.2).
So pin-then-build stays the release model for genuinely new versions, while
re-pins become fully automatic.
Verified in a throwaway worktree: v1.13.6 re-pin rewrote both machine classes
(rc 0, clean diff); v9.9.9 unbuilt refused (rc 1, derived files untouched).
The paths filter means the reconcile commit (no versions.yaml change) cannot
re-trigger the workflow.
syscod3
added a commit
that referenced
this pull request
Aug 8, 2026
…31) Editing omni/versions.yaml to a version that needs no new build (re-pin, rollback, canary tweak) used to leave oci-lab's machine classes and cluster template stale: only the talos-images build rewrote them, and it does not run when nothing needs to be built. On a push to main touching omni/versions.yaml this workflow runs check-version-drift.py --write and commits the derived-file fix. The installer_built() guard keeps the two writers from racing: * Already-built target -> --write succeeds, derived files committed here. * Not-yet-built target -> the guard refuses, the job fails with a clear 'build first' message, and the operator runs the talos-images build as before; that build ships the installer and rewrites derived files (4.2). So pin-then-build stays the release model for genuinely new versions, while re-pins become fully automatic. Verified in a throwaway worktree: v1.13.6 re-pin rewrote both machine classes (rc 0, clean diff); v9.9.9 unbuilt refused (rc 1, derived files untouched). The paths filter means the reconcile commit (no versions.yaml change) cannot re-trigger the workflow.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Closes the 4.1b gap in the Talos upgrade pipeline: editing
omni/versions.yamlto an already-built version (rollback, re-pin, canary tweak) used to leave oci-lab's derived files stale, because only the talos-images build rewrites them and it does not run when nothing needs building.Adds
.github/workflows/reconcile.yml, which on a push tomaintouchingomni/versions.yamlrunsscripts/check-version-drift.py --writeand commits the derived-file fix.Guarded split (no writer race)
--writesucceeds (installer exists in ghcr), reconcile commits here. Fully automatic.installer_built()guard refuses with "build first", the job fails, and the operator runs the talos-images build as today; that build ships the installer and rewrites derived files (existing 4.2 path).The
paths: [omni/versions.yaml]filter means the reconcile commit (noversions.yamlchange) cannot re-trigger the workflow, so it converges.Verified
Throwaway-worktree test:
v1.13.6re-pin ->--writerewrote both machine classes (rc 0);v9.9.9unbuilt -> refused (rc 1), derived files untouched.Objective of change
This is pick + me hooks wire from a prior parent PR. Supports the same trunk.