feat(ci): add unified "GCP: Build, Test and Publish" workflow#358
Merged
Conversation
Single workflow_dispatch chaining the three standalone GCP workflows: build (x86_64 + aarch64, gcp-build-steps) -> test (cloud-image-tests: smoke on both arches in parallel, then the per-shape matrices) -> publish each arch to almalinux-cloud (prod), one arch at a time. Inputs: all gcp-build.yml inputs, plus a new run_test gate (default true) to build+publish without testing, plus the gcp-test.yml inputs except version_major and arch (arch acts as ALL - both arches built/tested/ published). No gcp-publish.yml inputs are exposed: publish runs as a max-parallel:1 arch matrix and takes image_datetag from the build's YYYYMMDD date_stamp. Stage gating (job results): tests require both builds to succeed; publish requires the builds and, when run_test is true, all test jobs to pass - so run_test=false builds and publishes straight through. The standalone gcp-build.yml / gcp-test.yml / gcp-publish.yml are left unchanged.
Member
|
We need a way to override test failures and still push forward to the publish stage. |
Tests now always run (the run_test skip gate is removed). The new override_test_failure input (default false) controls only whether a test *failure* still lets the publish stage proceed: override_test_failure=false (default) -> a failing test job skips publish override_test_failure=true -> publish even if test(s) fail build-cit, the test jobs, and the quota summary no longer reference run_test; publish gates on `override_test_failure || all tests passed` (still also requiring both builds and publish_images). The run-name always shows "Build, Test and Publish" since tests always run.
Member
|
Is there a way to have the test failure overridable after the tests have run instead of as an input flag? We need to override once we know what the test failures are, not before. |
Replace override_test_failure with an interactive approval. Tests still always run. When all tests pass, publish runs automatically. When a test job fails, a new approve-publish gate job - behind the gcp-prod-publish GitHub Environment (required reviewers) - pauses the run so a human can inspect the failure and approve or reject publishing; publish-gcp then runs only if all tests passed OR approve-publish was approved. Requires a one-time repo setup: create the `gcp-prod-publish` Environment (Settings -> Environments) with Required reviewers. Without reviewers the environment provides no protection and the gate does not actually pause.
jonathanspw
approved these changes
Jul 1, 2026
Document gcp-build-test-publish.yml (build -> cloud-image-tests -> publish): inputs, job layout, stage gating, the manual approve-publish gate behind the gcp-prod-publish environment (auto-publish on all-green, human approval on test failure), OIDC auth, and required config. Add a README index row.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Single workflow_dispatch chaining the three standalone GCP workflows:
build (x86_64 + aarch64, gcp-build-steps) -> test (cloud-image-tests:
smoke on both arches in parallel, then the per-shape matrices) ->
publish each arch to almalinux-cloud (prod), one arch at a time.
Inputs: all gcp-build.yml inputs, plus a new run_test gate (default true) to build+publish without testing, plus the gcp-test.yml inputs except version_major and arch (arch acts as ALL - both arches built/tested/ published). No gcp-publish.yml inputs are exposed: publish runs as a max-parallel:1 arch matrix and takes image_datetag from the build's YYYYMMDD date_stamp.
Stage gating (job results): tests require both builds to succeed; publish requires the builds and, when run_test is true, all test jobs to pass - so run_test=false builds and publishes straight through. The standalone gcp-build.yml / gcp-test.yml / gcp-publish.yml are left unchanged.