From 213bca6295d27ba4dcce231cda8cbd125e5baaeb Mon Sep 17 00:00:00 2001 From: robfrank Date: Fri, 23 Oct 2026 00:58:09 +0200 Subject: [PATCH] feat(#3): arcadedb-tag input to pin the ArcadeDB image in CI Both workflows take arcadedb-tag (workflow_dispatch and workflow_call, default latest). download-jars pulls arcadedata/arcadedb: and fails fast when a pinned tag does not hold that exact engine version, since the build jobs pull their base image by the jar version. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/test-python-bindings.yml | 33 ++++++++++++++++++---- .github/workflows/test-python-examples.yml | 30 ++++++++++++++++---- README.md | 3 +- 3 files changed, 53 insertions(+), 13 deletions(-) diff --git a/.github/workflows/test-python-bindings.yml b/.github/workflows/test-python-bindings.yml index 1f5ab6b..e7a56c9 100644 --- a/.github/workflows/test-python-bindings.yml +++ b/.github/workflows/test-python-bindings.yml @@ -13,6 +13,11 @@ on: # Allow being called by other workflows (e.g., release workflow) workflow_call: inputs: + arcadedb-tag: + description: "arcadedata/arcadedb image tag to take the jars from (e.g. 26.10.2); default latest" + required: false + type: string + default: "latest" build-version: description: "Override package version (PEP 440) for build.sh" required: false @@ -20,6 +25,16 @@ on: # Allow manual trigger workflow_dispatch: + inputs: + arcadedb-tag: + description: "arcadedata/arcadedb image tag to take the jars from (e.g. 26.10.2); default latest" + required: false + default: "latest" + +env: + # The image download-jars takes the jars from. Unset (push, pull_request, schedule) + # means latest; a release build passes its tag. + ARCADEDB_IMAGE_TAG: ${{ inputs.arcadedb-tag || 'latest' }} permissions: contents: read @@ -141,18 +156,18 @@ jobs: id: jars shell: bash run: | - # Download JARs from the official Docker image. `latest` follows - # upstream's current snapshot. Every build job, Linux included, builds + # Download JARs from the official Docker image: ARCADEDB_IMAGE_TAG, + # `latest` (upstream's current snapshot) unless the caller pinned a tag. Every build job, Linux included, builds # from these jars (the artifact below), not from its own pull: upstream # re-pushes the snapshot tag on every deploy, so a pull per job could put # two different engine builds under one version in a single run. - echo "📦 Downloading JARs from arcadedata/arcadedb:latest..." + echo "📦 Downloading JARs from arcadedata/arcadedb:${ARCADEDB_IMAGE_TAG}..." # Create output directory mkdir -p src/arcadedb_embedded/jars # Create a temporary container and copy JARs from it - CONTAINER_ID=$(docker create arcadedata/arcadedb:latest) + CONTAINER_ID=$(docker create "arcadedata/arcadedb:${ARCADEDB_IMAGE_TAG}") docker cp $CONTAINER_ID:/home/arcadedb/lib/. src/arcadedb_embedded/jars/ docker rm $CONTAINER_ID @@ -163,6 +178,12 @@ jobs: ARCADEDB_TAG=$(python3 scripts/extract_version.py src/arcadedb_embedded/jars --format=docker) echo "📌 ArcadeDB version: $ARCADEDB_TAG" + # The build jobs pull arcadedata/arcadedb: as their base image, + # so a pinned tag must name that version exactly (26.10.2, not an alias). + if [ "$ARCADEDB_IMAGE_TAG" != "latest" ] && [ "$ARCADEDB_IMAGE_TAG" != "$ARCADEDB_TAG" ]; then + echo "❌ arcadedb-tag '$ARCADEDB_IMAGE_TAG' holds engine $ARCADEDB_TAG; pass the exact version tag" + exit 1 + fi echo "arcadedb-tag=$ARCADEDB_TAG" >> "$GITHUB_OUTPUT" # Unfiltered on purpose: build-native.sh applies scripts/jar_exclusions.txt @@ -272,8 +293,8 @@ jobs: - name: Build and test arcadedb-embedded (${{ matrix.platform }}) shell: bash env: - # The version download-jars resolved from `latest`; the Docker build still - # takes its base image by tag, but the jars come from the artifact + # The engine version download-jars read from the ARCADEDB_IMAGE_TAG jars; + # the Docker build takes its base image by this tag, the jars from the artifact ARCADEDB_TAG: ${{ needs.download-jars.outputs.arcadedb-tag }} run: | echo "🔨 Building arcadedb-embedded for ${{ matrix.platform }} with Python ${{ matrix.python-version }}..." diff --git a/.github/workflows/test-python-examples.yml b/.github/workflows/test-python-examples.yml index 17f2c4d..9a78b2d 100644 --- a/.github/workflows/test-python-examples.yml +++ b/.github/workflows/test-python-examples.yml @@ -13,6 +13,11 @@ on: # Allow being called by other workflows (e.g., release workflow) workflow_call: inputs: + arcadedb-tag: + description: "arcadedata/arcadedb image tag to take the jars from (e.g. 26.10.2); default latest" + required: false + type: string + default: "latest" examples: description: "Glob pattern(s) for examples to run (space-separated, relative to examples)." required: false @@ -26,6 +31,10 @@ on: # Allow manual trigger workflow_dispatch: inputs: + arcadedb-tag: + description: "arcadedata/arcadedb image tag to take the jars from (e.g. 26.10.2); default latest" + required: false + default: "latest" examples: description: "Glob pattern(s) for examples to run (space-separated, relative to examples)." required: false @@ -46,6 +55,9 @@ concurrency: cancel-in-progress: ${{ github.event_name == 'pull_request' }} env: + # The image download-jars takes the jars from. Unset (push, pull_request, schedule) + # means latest; a release build passes its tag. + ARCADEDB_IMAGE_TAG: ${{ inputs.arcadedb-tag || 'latest' }} EXAMPLES: ${{ inputs.examples || '0[1-9]_*.py 1[0-9]_*.py 2[0-9]_*.py' }} # Note: Example 21 runs in CI at reduced scale; its arguments and 15-minute @@ -72,18 +84,18 @@ jobs: id: jars shell: bash run: | - # Download JARs from the official Docker image. `latest` follows - # upstream's current snapshot. Every build job, Linux included, builds + # Download JARs from the official Docker image: ARCADEDB_IMAGE_TAG, + # `latest` (upstream's current snapshot) unless the caller pinned a tag. Every build job, Linux included, builds # from these jars (the artifact below), not from its own pull: upstream # re-pushes the snapshot tag on every deploy, so a pull per job could put # two different engine builds under one version in a single run. - echo "📦 Downloading JARs from arcadedata/arcadedb:latest..." + echo "📦 Downloading JARs from arcadedata/arcadedb:${ARCADEDB_IMAGE_TAG}..." # Create output directory mkdir -p src/arcadedb_embedded/jars # Create a temporary container and copy JARs from it - CONTAINER_ID=$(docker create arcadedata/arcadedb:latest) + CONTAINER_ID=$(docker create "arcadedata/arcadedb:${ARCADEDB_IMAGE_TAG}") docker cp $CONTAINER_ID:/home/arcadedb/lib/. src/arcadedb_embedded/jars/ docker rm $CONTAINER_ID @@ -91,6 +103,12 @@ jobs: ARCADEDB_TAG=$(python3 scripts/extract_version.py src/arcadedb_embedded/jars --format=docker) echo "📌 ArcadeDB version: $ARCADEDB_TAG" + # The build jobs pull arcadedata/arcadedb: as their base image, + # so a pinned tag must name that version exactly (26.10.2, not an alias). + if [ "$ARCADEDB_IMAGE_TAG" != "latest" ] && [ "$ARCADEDB_IMAGE_TAG" != "$ARCADEDB_TAG" ]; then + echo "❌ arcadedb-tag '$ARCADEDB_IMAGE_TAG' holds engine $ARCADEDB_TAG; pass the exact version tag" + exit 1 + fi echo "arcadedb-tag=$ARCADEDB_TAG" >> "$GITHUB_OUTPUT" # Unfiltered on purpose: build-native.sh applies scripts/jar_exclusions.txt @@ -197,8 +215,8 @@ jobs: - name: Build arcadedb-embedded (${{ matrix.platform }}) shell: bash env: - # The version download-jars resolved from `latest`; the Docker build still - # takes its base image by tag, but the jars come from the artifact + # The engine version download-jars read from the ARCADEDB_IMAGE_TAG jars; + # the Docker build takes its base image by this tag, the jars from the artifact ARCADEDB_TAG: ${{ needs.download-jars.outputs.arcadedb-tag }} run: | echo "🔨 Building arcadedb-embedded for ${{ matrix.platform }} with Python ${{ matrix.python-version }}..." diff --git a/README.md b/README.md index 3b0390b..1a946c5 100644 --- a/README.md +++ b/README.md @@ -137,7 +137,8 @@ default, which follows ArcadeDB's current snapshot, or the tag in `ARCADEDB_TAG` to pin one (`ARCADEDB_TAG=26.11.1-SNAPSHOT ./scripts/build.sh`). The package version is taken from the `arcadedb-engine-.jar` in that image, so `26.11.1-SNAPSHOT` builds `26.11.1.devN`. CI does the same, and also runs every -night so each new snapshot is tested. See [versioning strategy](https://docs.humem.ai/arcadedb/latest/development/release/#python-versioning-strategy) for details on development vs release mode handling. +night so each new snapshot is tested. Both workflows take an `arcadedb-tag` input +(manual run or `workflow_call`) to build from a pinned image: an exact version tag such as `26.10.2`. See [versioning strategy](https://docs.humem.ai/arcadedb/latest/development/release/#python-versioning-strategy) for details on development vs release mode handling. ## Origin