This is an automated email from the ASF dual-hosted git repository. sadpandajoe pushed a commit to branch codex/fix-scheduled-docker-refresh-ci in repository https://gitbox.apache.org/repos/asf/superset.git
commit 704963f69d245b484fd56f42f1e3ce9a15598c3e Author: Joe Li <[email protected]> AuthorDate: Mon Jul 27 06:48:14 2026 -0700 fix(ci): use current actions for Docker refresh --- .../workflows/scheduled-docker-image-refresh.yml | 16 +++++- scripts/change_detector.py | 1 + .../scheduled_docker_image_refresh_test.py | 65 ++++++++++++++++++++++ 3 files changed, 79 insertions(+), 3 deletions(-) diff --git a/.github/workflows/scheduled-docker-image-refresh.yml b/.github/workflows/scheduled-docker-image-refresh.yml index 432ec9d0f51..0390b8999d2 100644 --- a/.github/workflows/scheduled-docker-image-refresh.yml +++ b/.github/workflows/scheduled-docker-image-refresh.yml @@ -108,8 +108,18 @@ jobs: fetch-depth: 0 persist-credentials: false + # Keep workflow tooling on the triggering revision. Release tags can + # contain action pins that no longer satisfy the repository allowlist. + - name: Checkout workflow actions + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ github.sha }} + path: workflow-source + persist-credentials: false + sparse-checkout: .github/actions + - name: Setup Docker Environment - uses: ./.github/actions/setup-docker + uses: ./workflow-source/.github/actions/setup-docker with: dockerhub-user: ${{ secrets.DOCKERHUB_USER }} dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }} @@ -122,7 +132,7 @@ jobs: node-version: 20 - name: Setup supersetbot - uses: ./.github/actions/setup-supersetbot/ + uses: ./workflow-source/.github/actions/setup-supersetbot/ - name: Rebuild and push env: @@ -171,7 +181,7 @@ jobs: --repo "$REPOSITORY" \ --title "Scheduled Docker image refresh failed for ${LATEST_RELEASE}" \ --label "infra:container" \ - --label "bug" \ + --label "#bug" \ --body "The weekly Docker base-image refresh failed for release \`${LATEST_RELEASE}\`. Published images may be missing upstream base-layer security patches until this is resolved. Failed run: ${RUN_URL}" diff --git a/scripts/change_detector.py b/scripts/change_detector.py index 55548b270b0..dca41268534 100755 --- a/scripts/change_detector.py +++ b/scripts/change_detector.py @@ -39,6 +39,7 @@ RETRYABLE_STATUS_CODES: frozenset[int] = frozenset({403, 429}) PATTERNS = { "python": [ r"^\.github/workflows/.*python", + r"^\.github/workflows/scheduled-docker-image-refresh\.yml$", r"^tests/", r"^superset/", r"^scripts/", diff --git a/tests/unit_tests/scheduled_docker_image_refresh_test.py b/tests/unit_tests/scheduled_docker_image_refresh_test.py new file mode 100644 index 00000000000..fd57eff4707 --- /dev/null +++ b/tests/unit_tests/scheduled_docker_image_refresh_test.py @@ -0,0 +1,65 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +from pathlib import Path +from typing import Any + +import yaml + +from scripts import change_detector + +WORKFLOW_PATH = ( + Path(__file__).resolve().parents[2] + / ".github/workflows/scheduled-docker-image-refresh.yml" +) + + +def load_workflow() -> dict[str, Any]: + return yaml.safe_load(WORKFLOW_PATH.read_text()) + + +def test_scheduled_refresh_uses_current_workflow_actions() -> None: + workflow = load_workflow() + steps = {step["name"]: step for step in workflow["jobs"]["docker-rebuild"]["steps"]} + + action_checkout = steps["Checkout workflow actions"] + assert action_checkout["with"]["ref"] == "${{ github.sha }}" + assert action_checkout["with"]["path"] == "workflow-source" + assert ( + steps["Setup Docker Environment"]["uses"] + == "./workflow-source/.github/actions/setup-docker" + ) + assert ( + steps["Setup supersetbot"]["uses"] + == "./workflow-source/.github/actions/setup-supersetbot/" + ) + + +def test_scheduled_refresh_notifier_uses_existing_labels() -> None: + workflow = load_workflow() + notify_step = workflow["jobs"]["notify-on-failure"]["steps"][0] + + assert '--label "infra:container"' in notify_step["run"] + assert '--label "#bug"' in notify_step["run"] + assert '--label "bug"' not in notify_step["run"] + + +def test_scheduled_refresh_changes_trigger_python_tests() -> None: + assert change_detector.detect_changes( + [".github/workflows/scheduled-docker-image-refresh.yml"], + change_detector.PATTERNS["python"], + )
