mirror of
https://github.com/block/buzz.git
synced 2026-10-27 04:30:52 +00:00
797012ff01
Switch every CI job that starts MinIO to the public `ghcr.io/block/buzz-minio:latest` image published by #7869. Integration jobs pull the image; image builds stay in the separate, path-filtered publisher workflow. - Apply the CI Compose override to both desktop integration shards, backend integration, relay E2E, and mesh lifecycle, including script-mediated Compose calls. Both the server and bucket initializer use the Buzz image. - Override both MinIO images in Helm's quickstart CI values, covering the server, bucket initializer, and relay's wait-for-bucket init container in the gated kind installation. - Select integration and mesh checks when either Compose file changes, with regression coverage using the real pinned `dorny/paths-filter` action. ### Publication verified #7869 is merged, and [the first main-branch publication](https://github.com/block/buzz/actions/runs/36021389137/job/107706874954) succeeded. An anonymous pull using an empty Docker configuration returned the publisher's digest: `sha256:b8470bbeafbf57b20c86cf63804682b714bdcfdbb517f3770247e321e623f48f`. This PR is rebased onto main and ready for consumer integration checks. ### Validation - Ran the repository's MinIO smoke script against the actual published AMD64 image: healthy startup, bucket initialization, object upload/read/delete, and rejection of anonymous reads all passed. Used the rendered CI Compose services with isolated local ports and resource names. - Verified `mc` runs and writes its configuration as Helm's non-root UID/GID 65532 with dropped capabilities and no privilege escalation. - Helm 3.16.4 lint and quickstart rendering passed; all three rendered MinIO container references use the Buzz image. - All 14 CI selection cases and the required-context isolation check passed. Mesh workflow passes actionlint; shared workflows pass with shellcheck disabled for pre-existing findings. - Fresh repository-wide review traced workflow and script consumers and found no remaining CI image omissions. Full application integration checks and a real kind installation have not been run locally. --------- Signed-off-by: Tyler Longwell <tlongwell@squareup.com>
118 lines
4.4 KiB
YAML
118 lines
4.4 KiB
YAML
name: Mesh Lifecycle
|
|
# Relay-driven mesh lifecycle smoke: membership → signed discovery notes →
|
|
# relay-derived allowlist → join → CPU inference over QUIC → stranger denied
|
|
# (relay membership rejection + no routed inference, with a differential
|
|
# trusted-inference health proof so a dead serve node can't fake a denial).
|
|
# Runs the full Buzz "shared compute" join story with three real mesh-llm
|
|
# node processes on one runner, using the Buzz relay as the control plane
|
|
# (no hand-carried invite tokens). Mirrors the shape mesh-llm's own CI uses
|
|
# for its two-node smokes (tiny CPU model, one runner, real QUIC mesh).
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'crates/buzz-mesh-smoke/**'
|
|
- 'crates/buzz-relay/Cargo.toml'
|
|
- 'crates/buzz-admin/**'
|
|
- 'crates/buzz-test-client/**'
|
|
- 'crates/buzz-ws-client/**'
|
|
- 'Cargo.lock'
|
|
- 'desktop/src-tauri/src/mesh_llm/**'
|
|
- 'scripts/ci-mesh-lifecycle-smoke.sh'
|
|
- 'scripts/start-relay-for-tests.sh'
|
|
- '.github/workflows/mesh-lifecycle.yml'
|
|
- 'docker-compose.yml'
|
|
- 'docker-compose.ci.yml'
|
|
pull_request:
|
|
paths:
|
|
- 'crates/buzz-mesh-smoke/**'
|
|
- 'crates/buzz-relay/Cargo.toml'
|
|
- 'crates/buzz-admin/**'
|
|
- 'crates/buzz-test-client/**'
|
|
- 'crates/buzz-ws-client/**'
|
|
- 'Cargo.lock'
|
|
- 'desktop/src-tauri/src/mesh_llm/**'
|
|
- 'scripts/ci-mesh-lifecycle-smoke.sh'
|
|
- 'scripts/start-relay-for-tests.sh'
|
|
- '.github/workflows/mesh-lifecycle.yml'
|
|
- 'docker-compose.yml'
|
|
- 'docker-compose.ci.yml'
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: mesh-lifecycle-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
|
|
jobs:
|
|
lifecycle-smoke:
|
|
env:
|
|
COMPOSE_FILE: docker-compose.yml:docker-compose.ci.yml
|
|
name: Relay-Driven Mesh Lifecycle Smoke
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 45
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
|
|
- uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
|
|
|
|
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1
|
|
with:
|
|
save-if: ${{ github.event_name != 'pull_request' }}
|
|
|
|
# The mesh-llm SDK downloads a signed native runtime (llama.cpp CPU
|
|
# build) on first init, and the serve node downloads the smoke model
|
|
# from HuggingFace on first run. Key on the lockfile so a mesh pin bump
|
|
# rolls the runtime cache; the model ref is stable.
|
|
- name: Restore mesh runtime + model caches
|
|
id: mesh-caches
|
|
uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
|
|
with:
|
|
path: |
|
|
~/.cache/mesh-llm/native-runtimes
|
|
~/.cache/huggingface/hub
|
|
key: mesh-lifecycle-${{ runner.os }}-smollm2-135m-${{ hashFiles('Cargo.lock') }}
|
|
restore-keys: |
|
|
mesh-lifecycle-${{ runner.os }}-smollm2-135m-
|
|
|
|
- name: Start integration services
|
|
run: |
|
|
for attempt in 1 2 3; do
|
|
if docker compose up -d postgres redis minio minio-init; then
|
|
break
|
|
fi
|
|
if [ "$attempt" -eq 3 ]; then
|
|
echo "docker compose up failed after 3 attempts" >&2
|
|
exit 1
|
|
fi
|
|
echo "docker compose up failed (attempt $attempt), retrying in $((attempt * 5))s..." >&2
|
|
sleep $((attempt * 5))
|
|
done
|
|
|
|
- name: Run relay-driven mesh lifecycle smoke
|
|
run: ./scripts/ci-mesh-lifecycle-smoke.sh 2>&1 | tee /tmp/mesh-lifecycle-harness.log
|
|
|
|
- name: Save mesh runtime + model caches
|
|
if: github.ref == 'refs/heads/main' && steps.mesh-caches.outputs.cache-hit != 'true'
|
|
uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
|
|
with:
|
|
path: |
|
|
~/.cache/mesh-llm/native-runtimes
|
|
~/.cache/huggingface/hub
|
|
key: mesh-lifecycle-${{ runner.os }}-smollm2-135m-${{ hashFiles('Cargo.lock') }}
|
|
|
|
- name: Upload relay + harness logs
|
|
if: failure()
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: mesh-lifecycle-logs
|
|
path: |
|
|
/tmp/buzz-relay.log
|
|
/tmp/mesh-lifecycle-harness.log
|
|
if-no-files-found: ignore
|