This is an automated email from the ASF dual-hosted git repository. potiuk pushed a commit to branch hardened-python-base-images in repository https://gitbox.apache.org/repos/asf/airflow.git
commit a09d4114d6826ebac6f490e96af6acdc432066d9 Author: Jarek Potiuk <[email protected]> AuthorDate: Sat Oct 10 22:36:02 2026 +0100 Invalidate the CI image mount cache for the trixie base The uv cache restored into CI image builds held wheels compiled against bookworm's libraries - an xmlsec wheel built against bookworm's MD5-enabled libxmlsec1 failed to import on trixie, which dropped MD5. The cache key does not encode the base OS, so it has to be bumped when that changes. Generated-by: Claude Opus 5 Claude-Session: https://claude.ai/code/session_014np1fVAxHmGaBFt3qebJ8x --- .github/actions/build_ci_image_with_cache/action.yml | 10 +++++----- .github/workflows/ci-image-build.yml | 15 +++++++++------ 2 files changed, 14 insertions(+), 11 deletions(-) diff --git a/.github/actions/build_ci_image_with_cache/action.yml b/.github/actions/build_ci_image_with_cache/action.yml index b7a6d0bbce4..0d6e1afa889 100644 --- a/.github/actions/build_ci_image_with_cache/action.yml +++ b/.github/actions/build_ci_image_with_cache/action.yml @@ -113,7 +113,7 @@ runs: # yamllint disable-line rule:line-length uses: apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # restore/v1.0.0 with: - key: "ci-cache-mount-save-v3-${{ inputs.platform }}-${{ inputs.python }}\ + key: "ci-cache-mount-save-v4-${{ inputs.platform }}-${{ inputs.python }}\ -${{ inputs.image-stash-ref }}" path: "/tmp/" id: restore-mount-cache @@ -122,7 +122,7 @@ runs: shell: bash env: PYTHON_MAJOR_MINOR_VERSION: ${{ inputs.python }} - CACHE_FILE: "/tmp/ci-cache-mount-save-v3-${{ inputs.python }}.tar.gz" + CACHE_FILE: "/tmp/ci-cache-mount-save-v4-${{ inputs.python }}.tar.gz" run: | if [[ ! -f "${CACHE_FILE}" ]]; then echo "${CACHE_FILE} is missing - the stash restore may have timed out. Building without it." @@ -211,14 +211,14 @@ runs: PYTHON_MAJOR_MINOR_VERSION: ${{ inputs.python }} run: > breeze ci-image export-mount-cache - --cache-file /tmp/ci-cache-mount-save-v3-${PYTHON_MAJOR_MINOR_VERSION}.tar.gz + --cache-file /tmp/ci-cache-mount-save-v4-${PYTHON_MAJOR_MINOR_VERSION}.tar.gz if: steps.stashed-image.outputs.reusable != 'true' - name: "Stash the mount cache" uses: apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # save/v1.0.0 with: - key: "ci-cache-mount-save-v3-${{ inputs.platform }}-${{ inputs.python }}\ + key: "ci-cache-mount-save-v4-${{ inputs.platform }}-${{ inputs.python }}\ -${{ inputs.image-stash-ref }}" - path: "/tmp/ci-cache-mount-save-v3-${{ inputs.python }}.tar.gz" + path: "/tmp/ci-cache-mount-save-v4-${{ inputs.python }}.tar.gz" if-no-files-found: 'error' retention-days: '6' if: steps.stashed-image.outputs.reusable != 'true' diff --git a/.github/workflows/ci-image-build.yml b/.github/workflows/ci-image-build.yml index 90ebe985e7f..6c852826590 100644 --- a/.github/workflows/ci-image-build.yml +++ b/.github/workflows/ci-image-build.yml @@ -215,8 +215,11 @@ jobs: ${{ inputs.image-stash-ref != '' && format('for ref {0}', inputs.image-stash-ref) || '' }} # yamllint disable-line rule:line-length uses: apache/infrastructure-actions/stash/restore@c968777141a2afc98d1a09c9f6979455bfebaae3 # restore/v1.0.1 + # The mount cache holds wheels compiled against the image's system libraries - bump the "vN" + # in this key (and in build_ci_image_with_cache) whenever the base OS changes, or wheels built + # for the old one get reused (v4: bookworm -> trixie, whose libxmlsec1 has no MD5 support). with: - key: "ci-cache-mount-save-v3-${{ inputs.platform }}-${{ env.PYTHON_MAJOR_MINOR_VERSION }}\ + key: "ci-cache-mount-save-v4-${{ inputs.platform }}-${{ env.PYTHON_MAJOR_MINOR_VERSION }}\ ${{ inputs.image-stash-ref != '' && format('-{0}', inputs.image-stash-ref) || '' }}" path: "/tmp/" id: restore-cache-mount @@ -224,7 +227,7 @@ jobs: - name: "Verify ci-cache file exists" if: steps.restore-cache-mount.outputs.stash-hit == 'true' env: - CACHE_FILE: "/tmp/ci-cache-mount-save-v3-${{ env.PYTHON_MAJOR_MINOR_VERSION }}.tar.gz" + CACHE_FILE: "/tmp/ci-cache-mount-save-v4-${{ env.PYTHON_MAJOR_MINOR_VERSION }}.tar.gz" run: | if [ ! -f "$CACHE_FILE" ]; then echo "Cache file not found: $CACHE_FILE" @@ -238,7 +241,7 @@ jobs: PYTHON_MAJOR_MINOR_VERSION: ${{ env.PYTHON_MAJOR_MINOR_VERSION }} run: > breeze ci-image import-mount-cache - --cache-file /tmp/ci-cache-mount-save-v3-${PYTHON_MAJOR_MINOR_VERSION}.tar.gz + --cache-file /tmp/ci-cache-mount-save-v4-${PYTHON_MAJOR_MINOR_VERSION}.tar.gz if: steps.restore-cache-mount.outputs.stash-hit == 'true' - name: "Restore CI docker image ${{ inputs.platform }}:${{ env.PYTHON_MAJOR_MINOR_VERSION }}" # yamllint disable-line rule:line-length @@ -376,7 +379,7 @@ jobs: PYTHON_MAJOR_MINOR_VERSION: ${{ env.PYTHON_MAJOR_MINOR_VERSION }} run: > breeze ci-image export-mount-cache - --cache-file /tmp/ci-cache-mount-save-v3-${PYTHON_MAJOR_MINOR_VERSION}.tar.gz + --cache-file /tmp/ci-cache-mount-save-v4-${PYTHON_MAJOR_MINOR_VERSION}.tar.gz if: > inputs.upload-mount-cache-artifact == 'true' && steps.stashed-image.outputs.reusable != 'true' @@ -385,9 +388,9 @@ jobs: ${{ inputs.image-stash-ref != '' && format('for ref {0}', inputs.image-stash-ref) || '' }} uses: apache/infrastructure-actions/stash/save@f1a487181effd0b216892001abdfb524442bb24d # save/v1.0.1 with: - key: "ci-cache-mount-save-v3-${{ inputs.platform }}-${{ env.PYTHON_MAJOR_MINOR_VERSION }}\ + key: "ci-cache-mount-save-v4-${{ inputs.platform }}-${{ env.PYTHON_MAJOR_MINOR_VERSION }}\ ${{ inputs.image-stash-ref != '' && format('-{0}', inputs.image-stash-ref) || '' }}" - path: "/tmp/ci-cache-mount-save-v3-${{ env.PYTHON_MAJOR_MINOR_VERSION }}.tar.gz" + path: "/tmp/ci-cache-mount-save-v4-${{ env.PYTHON_MAJOR_MINOR_VERSION }}.tar.gz" if-no-files-found: 'error' # A ref's cache is read by the next publish of that same ref, days rather than hours # later, so it gets the retention the ref's image gets rather than the branch's.
