From dfcd3813bd1177e180efcacaa9271b325249f7ab Mon Sep 17 00:00:00 2001 From: lczyk Date: Fri, 17 Jul 2026 08:22:31 +0200 Subject: [PATCH 1/6] fix: binaries cache key inputs The ci binaries cache key referenced hack/build_binaries.sh, renamed to .rb in the ruby rewrite. hashFiles silently drops the non-matching path, so the key hashed makefile alone -- edits to the build driver no longer busted the cache. Also add patches/chisel/*.patch so the key mirrors hack/hash_inputs.sh's binaries input set; without it a patch edit would hit a stale cache and ship stale chisel-hacked binaries. --- .github/workflows/binaries.yaml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/binaries.yaml b/.github/workflows/binaries.yaml index 0779238..32a5b0d 100644 --- a/.github/workflows/binaries.yaml +++ b/.github/workflows/binaries.yaml @@ -21,10 +21,11 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # Cache the cross-compiled binaries between runs, keyed on every - # input that affects the build: the build script + the makefile - # (which holds the version pins CHISEL_REF / SPREAD_REF / - # DOCKER_VERSION / GO_BUILDER_IMAGE). Hit -> skip the make step. - # Miss -> make rebuilds and the cache auto-saves at job end. + # input that affects the build: the build script, the chisel patches, + # + the makefile (which holds the version pins CHISEL_REF / SPREAD_REF / + # DOCKER_VERSION / GO_BUILDER_IMAGE). Mirrors hack/hash_inputs.sh's + # binaries input set. Hit -> skip the make step. Miss -> make rebuilds + # and the cache auto-saves at job end. - name: Restore binaries cache id: binaries-cache uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 @@ -32,7 +33,7 @@ jobs: path: | cache/binaries/ .stamp/binaries - key: binaries-${{ hashFiles('hack/build_binaries.sh', 'makefile') }} + key: binaries-${{ hashFiles('hack/build_binaries.rb', 'patches/chisel/*.patch', 'makefile') }} - name: Build go binaries (chisel + spread + docker static) if: steps.binaries-cache.outputs.cache-hit != 'true' From 0f9dbc3d894e1f34194c9604e0035ef0334494d4 Mon Sep 17 00:00:00 2001 From: lczyk Date: Fri, 17 Jul 2026 08:23:26 +0200 Subject: [PATCH 2/6] ci: inlined yaml drift check inlined/*.yaml is generated from templates/ + scripts/ but also committed, so repo-tree consumers grab it directly. Nothing failed when the committed copy went stale -- ci and release both regenerate before use. Add a job that regenerates and diffs, failing if the committed inlined drifts from its sources. --- .github/workflows/ci.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index ef38bee..bb0aee6 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -36,3 +36,22 @@ jobs: matrix: >- [{"runner": "ubuntu-24.04", "arch": "s390x", "qemu": true}, {"runner": "ubuntu-24.04", "arch": "ppc64le", "qemu": true}] + + # Guard: inlined/*.yaml is generated from templates/ + scripts/ and also + # committed (repo-tree consumers grab it directly). Regenerate and fail on + # drift so a template or script edit can't land without its matching + # inlined refresh. Ubuntu runners ship ruby, so no extra setup. + check-inlined: + runs-on: ubuntu-24.04 + timeout-minutes: 5 + steps: + - name: Checkout repository + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + + - name: Assert committed inlined yamls match templates + scripts + run: | + make inlined-yaml-files + if ! git diff --exit-code inlined/; then + echo "::error::inlined/*.yaml is stale -- run 'make inlined-yaml-files' and commit the result" + exit 1 + fi From 42ab74be70d0192fffc15b6fe4c913f6b15003af Mon Sep 17 00:00:00 2001 From: lczyk Date: Fri, 17 Jul 2026 08:25:13 +0200 Subject: [PATCH 3/6] fix: DEBIAN_FRONTEND=noninteractive typo The container env var was set to DEBIAN_FRONTEND=noninteractice (invalid value). debconf ignores an unknown frontend and falls back, so apt run inside the test container never got the intended non-interactive frontend. Correct the spelling in the allocate scripts, tests/spread.yaml, and the hand-maintained demo/spread.yaml; drop the now-dead spellchecker ignore directives; regenerate inlined/*.yaml. --- demo/spread.yaml | 4 +--- inlined/bread-24.04.yaml | 4 +--- inlined/bread-25.10.yaml | 4 +--- inlined/bread-26.04.yaml | 4 +--- inlined/bread-26.10.yaml | 4 +--- inlined/bread-chisel-releases-24.04.yaml | 4 +--- inlined/bread-chisel-releases-25.10.yaml | 4 +--- inlined/bread-chisel-releases-26.04.yaml | 4 +--- inlined/bread-chisel-releases-26.10.yaml | 4 +--- scripts/spread_allocate_bread-chisel-releases.sh | 4 +--- scripts/spread_allocate_bread.sh | 4 +--- tests/spread.yaml | 4 +--- 12 files changed, 12 insertions(+), 36 deletions(-) diff --git a/demo/spread.yaml b/demo/spread.yaml index 0034a2d..e610401 100644 --- a/demo/spread.yaml +++ b/demo/spread.yaml @@ -15,8 +15,6 @@ backends: docker: type: adhoc allocate: | - #spellchecker: ignore noninteractice - set -e ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2) # e.g., ubuntu-24.04-amd64 -> 24.04 @@ -69,7 +67,7 @@ backends: docker run \ --rm \ --platform "linux/$arch" \ - -e DEBIAN_FRONTEND=noninteractice \ + -e DEBIAN_FRONTEND=noninteractive \ -e "usr=$SPREAD_SYSTEM_USERNAME" \ -e "pass=$SPREAD_SYSTEM_PASSWORD" \ $publish_flag \ diff --git a/inlined/bread-24.04.yaml b/inlined/bread-24.04.yaml index f1d0033..81a2c69 100644 --- a/inlined/bread-24.04.yaml +++ b/inlined/bread-24.04.yaml @@ -15,8 +15,6 @@ backends: docker: type: adhoc allocate: | - #spellchecker: ignore noninteractice - set -e ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2) # e.g., ubuntu-24.04-amd64 -> 24.04 @@ -73,7 +71,7 @@ backends: docker run \ --rm \ --platform "linux/$arch" \ - -e DEBIAN_FRONTEND=noninteractice \ + -e DEBIAN_FRONTEND=noninteractive \ -e "usr=$SPREAD_SYSTEM_USERNAME" \ -e "pass=$SPREAD_SYSTEM_PASSWORD" \ $publish_flag \ diff --git a/inlined/bread-25.10.yaml b/inlined/bread-25.10.yaml index 5d7c8f7..fdf60ec 100644 --- a/inlined/bread-25.10.yaml +++ b/inlined/bread-25.10.yaml @@ -15,8 +15,6 @@ backends: docker: type: adhoc allocate: | - #spellchecker: ignore noninteractice - set -e ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2) # e.g., ubuntu-24.04-amd64 -> 24.04 @@ -73,7 +71,7 @@ backends: docker run \ --rm \ --platform "linux/$arch" \ - -e DEBIAN_FRONTEND=noninteractice \ + -e DEBIAN_FRONTEND=noninteractive \ -e "usr=$SPREAD_SYSTEM_USERNAME" \ -e "pass=$SPREAD_SYSTEM_PASSWORD" \ $publish_flag \ diff --git a/inlined/bread-26.04.yaml b/inlined/bread-26.04.yaml index a5f803d..4a71f83 100644 --- a/inlined/bread-26.04.yaml +++ b/inlined/bread-26.04.yaml @@ -15,8 +15,6 @@ backends: docker: type: adhoc allocate: | - #spellchecker: ignore noninteractice - set -e ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2) # e.g., ubuntu-24.04-amd64 -> 24.04 @@ -73,7 +71,7 @@ backends: docker run \ --rm \ --platform "linux/$arch" \ - -e DEBIAN_FRONTEND=noninteractice \ + -e DEBIAN_FRONTEND=noninteractive \ -e "usr=$SPREAD_SYSTEM_USERNAME" \ -e "pass=$SPREAD_SYSTEM_PASSWORD" \ $publish_flag \ diff --git a/inlined/bread-26.10.yaml b/inlined/bread-26.10.yaml index cbccffd..5d74d30 100644 --- a/inlined/bread-26.10.yaml +++ b/inlined/bread-26.10.yaml @@ -15,8 +15,6 @@ backends: docker: type: adhoc allocate: | - #spellchecker: ignore noninteractice - set -e ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2) # e.g., ubuntu-24.04-amd64 -> 24.04 @@ -73,7 +71,7 @@ backends: docker run \ --rm \ --platform "linux/$arch" \ - -e DEBIAN_FRONTEND=noninteractice \ + -e DEBIAN_FRONTEND=noninteractive \ -e "usr=$SPREAD_SYSTEM_USERNAME" \ -e "pass=$SPREAD_SYSTEM_PASSWORD" \ $publish_flag \ diff --git a/inlined/bread-chisel-releases-24.04.yaml b/inlined/bread-chisel-releases-24.04.yaml index 8b4e803..84f217f 100644 --- a/inlined/bread-chisel-releases-24.04.yaml +++ b/inlined/bread-chisel-releases-24.04.yaml @@ -22,8 +22,6 @@ backends: docker: type: adhoc allocate: | - #spellchecker: ignore noninteractice - set -e ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2) # e.g., ubuntu-24.04-amd64 -> 24.04 @@ -79,7 +77,7 @@ backends: --platform "linux/$arch" \ --privileged \ -v /var/run/docker.sock:/var/run/docker.sock \ - -e DEBIAN_FRONTEND=noninteractice \ + -e DEBIAN_FRONTEND=noninteractive \ -e "usr=$SPREAD_SYSTEM_USERNAME" \ -e "pass=$SPREAD_SYSTEM_PASSWORD" \ $publish_flag \ diff --git a/inlined/bread-chisel-releases-25.10.yaml b/inlined/bread-chisel-releases-25.10.yaml index bc09f25..3c6916e 100644 --- a/inlined/bread-chisel-releases-25.10.yaml +++ b/inlined/bread-chisel-releases-25.10.yaml @@ -22,8 +22,6 @@ backends: docker: type: adhoc allocate: | - #spellchecker: ignore noninteractice - set -e ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2) # e.g., ubuntu-24.04-amd64 -> 24.04 @@ -79,7 +77,7 @@ backends: --platform "linux/$arch" \ --privileged \ -v /var/run/docker.sock:/var/run/docker.sock \ - -e DEBIAN_FRONTEND=noninteractice \ + -e DEBIAN_FRONTEND=noninteractive \ -e "usr=$SPREAD_SYSTEM_USERNAME" \ -e "pass=$SPREAD_SYSTEM_PASSWORD" \ $publish_flag \ diff --git a/inlined/bread-chisel-releases-26.04.yaml b/inlined/bread-chisel-releases-26.04.yaml index bd8c7f4..01227d7 100644 --- a/inlined/bread-chisel-releases-26.04.yaml +++ b/inlined/bread-chisel-releases-26.04.yaml @@ -22,8 +22,6 @@ backends: docker: type: adhoc allocate: | - #spellchecker: ignore noninteractice - set -e ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2) # e.g., ubuntu-24.04-amd64 -> 24.04 @@ -79,7 +77,7 @@ backends: --platform "linux/$arch" \ --privileged \ -v /var/run/docker.sock:/var/run/docker.sock \ - -e DEBIAN_FRONTEND=noninteractice \ + -e DEBIAN_FRONTEND=noninteractive \ -e "usr=$SPREAD_SYSTEM_USERNAME" \ -e "pass=$SPREAD_SYSTEM_PASSWORD" \ $publish_flag \ diff --git a/inlined/bread-chisel-releases-26.10.yaml b/inlined/bread-chisel-releases-26.10.yaml index 04e691d..3ce2cdb 100644 --- a/inlined/bread-chisel-releases-26.10.yaml +++ b/inlined/bread-chisel-releases-26.10.yaml @@ -22,8 +22,6 @@ backends: docker: type: adhoc allocate: | - #spellchecker: ignore noninteractice - set -e ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2) # e.g., ubuntu-24.04-amd64 -> 24.04 @@ -79,7 +77,7 @@ backends: --platform "linux/$arch" \ --privileged \ -v /var/run/docker.sock:/var/run/docker.sock \ - -e DEBIAN_FRONTEND=noninteractice \ + -e DEBIAN_FRONTEND=noninteractive \ -e "usr=$SPREAD_SYSTEM_USERNAME" \ -e "pass=$SPREAD_SYSTEM_PASSWORD" \ $publish_flag \ diff --git a/scripts/spread_allocate_bread-chisel-releases.sh b/scripts/spread_allocate_bread-chisel-releases.sh index a582ea4..1a95d2a 100755 --- a/scripts/spread_allocate_bread-chisel-releases.sh +++ b/scripts/spread_allocate_bread-chisel-releases.sh @@ -1,5 +1,3 @@ -#spellchecker: ignore noninteractice - set -e ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2) # e.g., ubuntu-24.04-amd64 -> 24.04 @@ -55,7 +53,7 @@ docker run \ --platform "linux/$arch" \ --privileged \ -v /var/run/docker.sock:/var/run/docker.sock \ - -e DEBIAN_FRONTEND=noninteractice \ + -e DEBIAN_FRONTEND=noninteractive \ -e "usr=$SPREAD_SYSTEM_USERNAME" \ -e "pass=$SPREAD_SYSTEM_PASSWORD" \ $publish_flag \ diff --git a/scripts/spread_allocate_bread.sh b/scripts/spread_allocate_bread.sh index 01a037c..7318ed6 100755 --- a/scripts/spread_allocate_bread.sh +++ b/scripts/spread_allocate_bread.sh @@ -1,5 +1,3 @@ -#spellchecker: ignore noninteractice - set -e ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2) # e.g., ubuntu-24.04-amd64 -> 24.04 @@ -56,7 +54,7 @@ echo "container_name: $container_name" docker run \ --rm \ --platform "linux/$arch" \ - -e DEBIAN_FRONTEND=noninteractice \ + -e DEBIAN_FRONTEND=noninteractive \ -e "usr=$SPREAD_SYSTEM_USERNAME" \ -e "pass=$SPREAD_SYSTEM_PASSWORD" \ $publish_flag \ diff --git a/tests/spread.yaml b/tests/spread.yaml index 587b189..a798942 100644 --- a/tests/spread.yaml +++ b/tests/spread.yaml @@ -17,8 +17,6 @@ backends: type: adhoc allocate: | - #spellchecker: ignore noninteractice - set -e ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2) # ubuntu-26.04-amd64 -> 26.04 @@ -54,7 +52,7 @@ backends: --privileged \ -v /var/run/docker.sock:/var/run/docker.sock \ -v "$repo_root:/spread-bread:ro" \ - -e DEBIAN_FRONTEND=noninteractice \ + -e DEBIAN_FRONTEND=noninteractive \ -e "usr=$SPREAD_SYSTEM_USERNAME" \ -e "pass=$SPREAD_SYSTEM_PASSWORD" \ --name "$container_name" \ From 6755e6fdea50a850710957623d4dc772cb368b89 Mon Sep 17 00:00:00 2001 From: lczyk Date: Fri, 17 Jul 2026 08:25:45 +0200 Subject: [PATCH 4/6] fix: base-refresh masked make failure The drift step piped make update-base into tee. GitHub's default step shell runs with -e but not pipefail, so a failing make was masked by tee's success -- the job would go green having resolved no digests. Add set -eo pipefail so the pipeline fails on make error. --- .github/workflows/base-refresh.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/base-refresh.yaml b/.github/workflows/base-refresh.yaml index caba3dd..95c3432 100644 --- a/.github/workflows/base-refresh.yaml +++ b/.github/workflows/base-refresh.yaml @@ -40,7 +40,9 @@ jobs: token: ${{ secrets.BOT_PAT }} - name: Resolve + rewrite drifted base pins - run: make update-base | tee /tmp/base-refresh.log + run: | + set -eo pipefail + make update-base | tee /tmp/base-refresh.log - name: Open / update PR on drift env: From 2baae0d74864c895c01bcd7cee77680a766e76cb Mon Sep 17 00:00:00 2001 From: lczyk Date: Fri, 17 Jul 2026 09:25:48 +0200 Subject: [PATCH 5/6] fix: correct binaries cache key filename 89c22e2 changed the key to hash hack/build_binaries.rb, but that file only exists on the ruby-rewrite branch -- on this branch the build driver is hack/build_binaries.sh. hashFiles silently drops the non-existent .rb, so the key was hashing patches + makefile but not the driver itself. Point it back at .sh; keep the patches/chisel/*.patch addition (the real gap here). --- .github/workflows/binaries.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/binaries.yaml b/.github/workflows/binaries.yaml index 32a5b0d..136b9e1 100644 --- a/.github/workflows/binaries.yaml +++ b/.github/workflows/binaries.yaml @@ -33,7 +33,7 @@ jobs: path: | cache/binaries/ .stamp/binaries - key: binaries-${{ hashFiles('hack/build_binaries.rb', 'patches/chisel/*.patch', 'makefile') }} + key: binaries-${{ hashFiles('hack/build_binaries.sh', 'patches/chisel/*.patch', 'makefile') }} - name: Build go binaries (chisel + spread + docker static) if: steps.binaries-cache.outputs.cache-hit != 'true' From 8332d14ae68f7d9da8b0eeb6ae489a43856dbf26 Mon Sep 17 00:00:00 2001 From: lczyk Date: Mon, 20 Jul 2026 07:53:15 +0100 Subject: [PATCH 6/6] fix: regenerate stale inlined yamls templates fixed the DEBIAN_FRONTEND=noninteractive typo but the committed inlined/*.yaml were not regenerated, failing check-inlined. --- inlined/bread-22.04.yaml | 4 +--- inlined/bread-chisel-releases-22.04.yaml | 4 +--- 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/inlined/bread-22.04.yaml b/inlined/bread-22.04.yaml index c0b1fc9..bbb2308 100644 --- a/inlined/bread-22.04.yaml +++ b/inlined/bread-22.04.yaml @@ -15,8 +15,6 @@ backends: docker: type: adhoc allocate: | - #spellchecker: ignore noninteractice - set -e ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2) # e.g., ubuntu-24.04-amd64 -> 24.04 @@ -73,7 +71,7 @@ backends: docker run \ --rm \ --platform "linux/$arch" \ - -e DEBIAN_FRONTEND=noninteractice \ + -e DEBIAN_FRONTEND=noninteractive \ -e "usr=$SPREAD_SYSTEM_USERNAME" \ -e "pass=$SPREAD_SYSTEM_PASSWORD" \ $publish_flag \ diff --git a/inlined/bread-chisel-releases-22.04.yaml b/inlined/bread-chisel-releases-22.04.yaml index f538906..1f9610f 100644 --- a/inlined/bread-chisel-releases-22.04.yaml +++ b/inlined/bread-chisel-releases-22.04.yaml @@ -22,8 +22,6 @@ backends: docker: type: adhoc allocate: | - #spellchecker: ignore noninteractice - set -e ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2) # e.g., ubuntu-24.04-amd64 -> 24.04 @@ -79,7 +77,7 @@ backends: --platform "linux/$arch" \ --privileged \ -v /var/run/docker.sock:/var/run/docker.sock \ - -e DEBIAN_FRONTEND=noninteractice \ + -e DEBIAN_FRONTEND=noninteractive \ -e "usr=$SPREAD_SYSTEM_USERNAME" \ -e "pass=$SPREAD_SYSTEM_PASSWORD" \ $publish_flag \