Disable Ubuntu unattended-upgrades in image build; fix Pages root clean - #141
Merged
Conversation
Bake `unattended-upgrades` removal into the Ubuntu image setup component so stock background apt/snap upgrades can't hold the dpkg lock -- both during the image build (racing our own apt-get) and, once the AMI is baked, at runner boot (racing the agent's first heartbeat). Applies to every Ubuntu image builder, including scaffold-generated ones. Bumps the shared recipe version so a fresh AMI is built. Also fix GH.publish_to_pages clearing the Pages root: preserve the worktree's own .git link when cleaning, otherwise it stops being a git working tree and every later git command fails. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
|
Workflow [Praktika CI Advanced], commit [b7a8001] Summary: ✅ Code ReviewResult: What changed: Disables Ubuntu background apt upgrade units during image baking, adds a global dpkg lock timeout, purges unattended-upgrades, and bumps the shared image recipe version. It also preserves the Git worktree metadata when cleaning the root of a GitHub Pages publication. GitHub Pages root cleaning
|
![praktika-gh[bot]](https://avatars.githubusercontent.com/in/3494315?s=60&v=4){kind=small}
Address review: `systemctl disable --now <timer>` stops the timer unit only,
not the apt-daily{,-upgrade}.service instance a timer may have already
activated -- which keeps holding the dpkg lock. Stop those service units
explicitly, and set DPkg::Lock::Timeout globally via apt.conf.d so the purge
and the following apt-get update wait out any residual run instead of failing
instantly on a held lock (previously the timed-out purge was swallowed by
`|| true` and the lockless `apt-get update` then aborted the build).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
| for item in worktree.iterdir(): | ||
| if item.name == ".git": | ||
| continue | ||
| if item.is_dir(): |
Contributor
There was a problem hiding this comment.
Path.is_dir() follows symlinks, but shutil.rmtree() raises OSError: Cannot call rmtree on a symbolic link. Therefore, publishing with destination_dir="" and clean_destination=True fails if the existing Pages root contains a tracked symlink to a directory. Check item.is_symlink() first and unlink it, using rmtree only for real directories.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
unattended-upgradesremoval (and disable theapt-daily*timers) into_ubuntu_setup_component, before its firstapt-get. This stops stock Ubuntu background upgrades from holding the dpkg lock during the image build and, once the AMI is baked, at runner boot. Every Ubuntu image builder routes through this component, so scaffold-generated projects inherit the fix — no per-project workaround needed.recipe_version(1.0.16→1.0.17) so a fresh AMI is actually built (baked component content changed; all recipes share the one version and must bump together).GH.publish_to_pageswhen clearing the Pages root: preserve the worktree's own.gitlink while removing its contents, otherwise the directory stops being a git working tree and every later git command fails.Notes
purgecarries|| trueand runs under the Image Builderset -econtext, so a missing package or transient apt failure won't abort the build.