Skip to content

fix(ci): a one-variant build keeps the other tags in sbom.json and their manifests #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ahze merged 1 commit into from
Nov 15, 2026
Merged

fix(ci): a one-variant build keeps the other tags in sbom.json and their manifests #2

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 13 additions & 3 deletions .github/workflows/daemonless-build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -513,9 +513,11 @@ jobs:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
VARIANT: ${{ inputs.variant }}
run: |
export PYTHONPATH="/tmp/dbuild"
python3 -m dbuild -v manifest
# A one-variant build re-creates only that tag's manifests.
python3 -m dbuild -v ${VARIANT:+--variant "$VARIANT"} manifest

# Compose-only test (no build, just test pre-built images)
test-compose:
Expand Down Expand Up @@ -698,11 +700,13 @@ jobs:
- name: Commit SBOM and generated files
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
VARIANT: ${{ inputs.variant }}
run: |
# Keep this run's files aside: main moves while the build runs (the
# aarch64 leg and overlapping runs commit too), so each attempt
# starts from the current tip and lays our files on top. The newest
# build's SBOM is the truth; there is nothing to merge.
# starts from the current tip and lays our files on top. A full
# build's SBOM is the truth; a one-variant build only replaces the
# tags it built and keeps the rest of main's.
FILES="sbom.json"
for f in ${{ steps.generate.outputs.files }}; do
[ -f "$f" ] && FILES="$FILES $f"
Expand All @@ -718,6 +722,12 @@ jobs:
git fetch -q origin main
git reset -q --hard origin/main
for f in $FILES; do cp "/tmp/ours/$f" "$f"; done
if [ -n "$VARIANT" ] && git cat-file -e HEAD:sbom.json 2>/dev/null; then
git show HEAD:sbom.json > /tmp/sbom-main.json
jq -S --slurpfile ours /tmp/ours/sbom.json \
'.image = $ours[0].image | .generated = $ours[0].generated | .tags += $ours[0].tags' \
/tmp/sbom-main.json > sbom.json
fi

# The top-level and per-tag `generated` timestamps change every
# run; only commit when the versions or package lists actually
Expand Down
Loading