Repository navigation
build: check the built image before pushing it - #2828
Merged
Merged
Conversation
The Containerfile installs python-osism, the bundled managers, openstackclient, ansible, openstack-project-manager and openstack-simple-stress with separate `uv pip install` runs. Each run resolves on its own and may change versions an earlier run installed, so nothing checks the requirements of the final environment together. The unit and integration tests run in a separate pipenv virtualenv and never exercise the shipped image either. Add a step after the build, before the push, that runs inside the built image: - `uv pip check --system`, which lists every installed package whose declared requirements are not met. Such conflicts can come from requirements declared by packages that are released from other repositories, so the check reports them in the build log instead of failing the job (exit code 1). Any other non-zero exit code means the check itself could not run, e.g. a missing uv (127) or an image that cannot be started (125), and fails the job. - `--help` or `--version` of every command the image bundles: osism, netbox-manager, openstack-image-manager, openstack-flavor-manager, openstack, ansible, the openstack-project-manager scripts manage.py and create.py (run the way osism invokes them), and the openstack-simple-stress main.py. A failing command fails the job. The frontend image does not bundle these, so the step is skipped for it. Tested against the published image built from 180cf92, registry.osism.tech/osism/osism@sha256:98a47c05d7a6c79a314f3a4c8f3a8f82568c92619172752949409cc67f89ac9e where the check reports 10 incompatibilities with exit code 1, which the step tolerates, and all smoke tests succeed. Against an image without uv, the step fails with exit code 127. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Roger Luethi <luethi@osism.tech>
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Containerfile installs python-osism, the bundled managers, openstackclient, ansible, openstack-project-manager and openstack-simple-stress with separate
uv pip installruns. Each run resolves on its own and may change versions an earlier run installed, so nothing checks the requirements of the final environment together. The unit and integration tests run in a separate pipenv virtualenv and never exercise the shipped image either.This adds a step to
playbooks/build.yml, after the build and before the push, that runs inside the built image:uv pip check --systemlists every installed package whose declared requirements are not met. Such conflicts can come from requirements declared by packages released from other repositories, so conflicts (exit code 1) are reported in the build log and do not fail the job. Any other non-zero exit code means the check itself could not run (e.g. 127 for a missing uv, 125 for an image that cannot be started) and fails the job.--helpor--versionof every command the image bundles:osism,netbox-manager,openstack-image-manager,openstack-flavor-manager,openstack,ansible, the openstack-project-manager scriptsmanage.pyandcreate.py(run the way osism invokes them), and the openstack-simple-stressmain.py. A failing command fails the job.The frontend image does not bundle these commands, so the step is skipped for it.
The step runs in
container-image-python-osism-build(check) andcontainer-image-python-osism-push(post, tag, periodic-midnight). In the push jobs, a failing smoke test stops the image from being pushed.Tested locally with podman against the published image built from 180cf92 (
registry.osism.tech/osism/osism@sha256:98a47c05d7a6c79a314f3a4c8f3a8f82568c92619172752949409cc67f89ac9e): the check reports 10 incompatibilities with exit code 1, which the step tolerates, and all smoke tests succeed. Against an image without uv, the step fails with exit code 127.🤖 Generated with Claude Code