Skip to content

Track deployments of semver dev image tags at their commit - #2569

Merged
bert-e merged 3 commits into
development/2.16from
improvement/ZENKO-5389-dev-tag-deployments
Nov 12, 2026
Merged

bert-e merged 3 commits into
development/2.16from
improvement/ZENKO-5389-dev-tag-deployments

Conversation

@francoisferrand

Copy link
Copy Markdown
Contributor

Backbeat branch images are now tagged as a dev pre-release of the next version, like 9.6.3-dev.2.sha-13bbb8b (scality/backbeat#2910). Such a tag is no git ref of the repo, so the component deployment could not be created, and the image manifest fallback failed as well since the tag points to an OCI image index. Cleanup also listed deployments at the image tag, so deployments created at the resolved commit were never inactivated.

  • follow OCI image indexes to the image manifest when looking for the revision annotation, skipping attestations;
  • resolve the deployment ref the same way in create and cleanup: the tag when it is a git ref of the repo, else the image revision (ignored when the image was built from another repo, e.g. labels inherited from a base image);
  • take the commit from the sha-<hex> suffix of the tag, so dev tags do not depend on registry access.

Looking up commits needs contents:read on the deployments token: the GitHub App must have that permission.

Issue: ZENKO-5389

@bert-e

bert-e commented Oct 30, 2026

Copy link
Copy Markdown
Contributor

Hello francoisferrand,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options
name description privileged authored
/after_pull_request Wait for the given pull request id to be merged before continuing with the current one.
/bypass_author_approval Bypass the pull request author's approval ⭐
/bypass_build_status Bypass the build and test status ⭐
/bypass_commit_size Bypass the check on the size of the changeset TBA ⭐
/bypass_incompatible_branch Bypass the check on the source branch prefix ⭐
/bypass_jira_check Bypass the Jira issue check ⭐
/bypass_peer_approval Bypass the pull request peers' approval ⭐
/bypass_leader_approval Bypass the pull request leaders' approval ⭐
/bypass_source_branch_lineage Bypass the cross-branch contamination check ⭐
/approve Instruct Bert-E that the author has approved the pull request. ✍️
/create_pull_requests Allow the creation of integration pull requests.
/create_integration_branches Allow the creation of integration branches.
/no_octopus Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
/unanimity Change review acceptance criteria from one reviewer at least to all reviewers
/wait Instruct Bert-E not to run until further notice.
Available commands
name description privileged
/help Print Bert-E's manual in the pull request.
/status Print Bert-E's current status in the pull request.
/clear Remove all comments from Bert-E from the history TBA
/retry Re-start a fresh build TBA
/build Re-start a fresh build TBA
/force_reset Delete integration branches & pull requests, and restart merge process from the beginning.
/reset Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

@francoisferrand
francoisferrand force-pushed the improvement/ZENKO-5389-dev-tag-deployments branch 2 times, most recently from 600f217 to 1b88c10 Compare October 30, 2026 08:00
@francoisferrand
francoisferrand force-pushed the improvement/ZENKO-5389-dev-tag-deployments branch from 1b88c10 to deb4c42 Compare November 10, 2026 21:29
@francoisferrand
francoisferrand marked this pull request as ready for review November 10, 2026 21:38
@francoisferrand
francoisferrand requested a review from a team November 10, 2026 21:59
@scality scality deleted a comment from bert-e Nov 10, 2026
@SylvainSenechal

Copy link
Copy Markdown
Contributor

Ah on the other pr on the dashboard, i saw this

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/github-script@v7. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

It's from actions/github-script@v7, there is a v9 available that uses node 24. v7 is used in 6 places btw

While we are at it, same issue with actions/setup-python@v5, v7 available

@scality scality deleted a comment from bert-e Nov 12, 2026
@scality scality deleted a comment from bert-e Nov 12, 2026
@francoisferrand

Copy link
Copy Markdown
Contributor Author

/approve

Images built with provenance attestations are tagged as an OCI image
index, which the registry would not return as we only accepted image
manifests. Accept index types, and when the index itself carries no
revision, read it from the image manifest it points to.

Issue: ZENKO-5389
Create used the image tag as deployment ref and fell back to the image
revision when GitHub rejected it, while cleanup always listed
deployments at the tag: those created at the image revision were never
inactivated.

Both now resolve the ref within the component repo the same way: the
tag when it is a git ref of the repo, else the image revision. Looking
up commits needs contents:read on the deployments token.

Issue: ZENKO-5389
Branch images are now tagged as a dev pre-release of the next version,
like 9.6.3-dev.2.sha-13bbb8b, which is no git ref of the repo. Take the
commit from the sha- suffix of the tag, expanded to the full sha, so
deployments do not depend on registry access and image annotations.

Issue: ZENKO-5389
@francoisferrand
francoisferrand force-pushed the improvement/ZENKO-5389-dev-tag-deployments branch from deb4c42 to 3c22f07 Compare November 12, 2026 16:29
@scality scality deleted a comment from bert-e Nov 12, 2026
@scality scality deleted a comment from bert-e Nov 12, 2026
@bert-e

bert-e commented Nov 12, 2026

Copy link
Copy Markdown
Contributor

I have successfully merged the changeset of this pull request
into targetted development branches:

  • ✔️ development/2.16

The following branches have NOT changed:

  • development/2.10
  • development/2.11
  • development/2.12
  • development/2.13
  • development/2.14
  • development/2.15
  • development/2.5
  • development/2.6
  • development/2.7
  • development/2.8
  • development/2.9

This pull request did not target the following hotfix branch(es) so they
were left untouched:

  • hotfix/2.13.5

Please check the status of the associated issue ZENKO-5389.

Goodbye francoisferrand.

The following options are set: approve

@bert-e
bert-e merged commit 3c22f07 into development/2.16 Nov 12, 2026
24 checks passed
@bert-e
bert-e deleted the improvement/ZENKO-5389-dev-tag-deployments branch November 12, 2026 18:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants