ci: add a consumer canary that uses the published action#95
Merged
Conversation
Every other lane here runs the action from the working tree (uses: ./),
which never exercises what a downstream consumer actually hits: resolving
a pinned ref to a release, downloading and checksum-verifying the release
assets, or building the in-guest validator from source with only the
documented dependencies. Both paths have broken before without a single
red check in this repo -- the first scheduled run of the
falcosecurity/libs lane failed exactly that way.
Two jobs, one per resolution path:
prebuilt pins the v0.3.2 release commit, as falcosecurity/libs
does, and deliberately does not install libbpf-dev. If
release resolution regresses and falls back to a source
build, the compile fails here.
source-build pins @main (not a release) to force the source path with
exactly the dependency set we document, so drift shows up
here before it shows up downstream.
Runs Sundays 18:00 UTC, ahead of the downstream Monday 06:00 UTC lane.
Schedule and dispatch only: both jobs resolve the action from a published
ref, so a pull_request trigger would test those refs rather than the
change under review.
Signed-off-by: ErenAri <erenari27@gmail.com>
The compatibility matrix page is the natural place for a reader to ask 'who actually depends on this?'. States the fact and links the workflow; no endorsement claim and no Falco branding. Signed-off-by: ErenAri <erenari27@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Every lane in this repo runs the action as
uses: ./— the working tree. That never exercises what an external consumer actually hits:Both have broken before with every check in this repo green. The first scheduled run of the falcosecurity/libs lane failed precisely this way (SHA pin fell through to a source build on a runner without
libbpf-dev). We found out from their CI, which is the wrong way round.What
Two jobs, one per resolution path:
prebuiltlibbpf-devsource-build@main(not a release)The
prebuiltjob omitting the toolchain is the point: if resolution breaks, the source build has nothing to compile with and fails loudly here.source-builduses command mode with a shipped binary, mirroring how falcosecurity/libs drives its own loader (verdict = the command's exit code), so the ship-binary-into-guest path is covered too.Runs Sundays 18:00 UTC, ~12h ahead of the downstream Monday 06:00 UTC lane.
Scope note
Schedule +
workflow_dispatchonly, deliberately. Both jobs resolve the action from a published ref, so apull_requesttrigger would test those refs rather than the change under review — a green that proves nothing. Working-tree changes to the action are already covered bybpfcompat-example-hosted(uses: ./). Dispatch this lane by hand before cutting a release.Matrix is deliberately two kernels: this lane exists to catch plumbing breakage, not to prove kernel coverage (the quirk library does that).