[PATCH for-6.1 0/2] gitlab: misc tweaks to job execution rules

[PATCH for-6.1 0/2] gitlab: misc tweaks to job execution rules

[Daniel P. Berrangé]

 - Fixes a problem with acceptance jobs running when build jobs fail
 - Fixes a problem with pages job publishing website from undesirable
   branches.

Daniel P. Berrangé (2):
  gitlab: only let pages be published from default branch
  gitlab: don't run acceptance jobs if build jobs fail

 .gitlab-ci.d/buildtest-template.yml |  4 ++--
 .gitlab-ci.d/buildtest.yml          | 18 ++++++++++++++++++
 2 files changed, 20 insertions(+), 2 deletions(-)

-- 
2.31.1

[PATCH 1/2] gitlab: only let pages be published from default branch

[Daniel P. Berrangé]

GitLab will happily publish pages generated by the latest CI pipeline
from any branch:

https://docs.gitlab.com/ee/user/project/pages/introduction.html

  "Remember that GitLab Pages are by default branch/tag agnostic
   and their deployment relies solely on what you specify in
   .gitlab-ci.yml. You can limit the pages job with the only
   parameter, whenever a new commit is pushed to a branch used
   specifically for your pages."

The current "pages" job is not limited, so it is happily publishing
docs content from any branch/tag in qemu.git that gets pushed to.
This means we're potentially publishing from the "staging" branch
or worse from outdated "stable-NNN" branches

This change restricts it to only publish from the default branch
in the main repository. For contributor forks, however, we allow
it to publish from any branch, since users will have arbitrarily
named topic branches in flight at any time.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 .gitlab-ci.d/buildtest.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index 89df51517c..eaaf1189d8 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -663,6 +663,17 @@ build-tools-and-docs-debian:
 
 # Prepare for GitLab pages deployment. Anything copied into the
 # "public" directory will be deployed to $USER.gitlab.io/$PROJECT
+#
+# GitLab publishes from any branch that triggers a CI pipeline
+#
+# For the main repo we don't want to publish from 'staging'
+# since that content may not be pushed, nor do we wish to
+# publish from 'stable-NNN' branches as that content is outdated.
+# Thus we restrict to just the default branch
+#
+# For contributor forks we want to publish from any repo so
+# that users can see the results of their commits, regardless
+# of what topic branch they're currently using
 pages:
   image: $CI_REGISTRY_IMAGE/qemu/debian-amd64:latest
   stage: test
@@ -681,3 +692,10 @@ pages:
   artifacts:
     paths:
       - public
+  rules:
+    - if '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+      when: on_success
+    - if '$CI_PROJECT_NAMESPACE == "qemu-project"'
+      when: never
+    - if '$CI_PROJECT_NAMESPACE != "qemu-project"'
+      when: on_success
-- 
2.31.1

[PATCH 2/2] gitlab: don't run acceptance jobs if build jobs fail

[Daniel P. Berrangé]

The 'when: always' clause tells gitlab to run the job even if the
dependant jobs have failed. This is wrong for the acceptance jobs,
since we need the build artifacts from the dependant jobs. This
results in the acceptance jobs given extra failures with wierd
messages about missing files.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 .gitlab-ci.d/buildtest-template.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitlab-ci.d/buildtest-template.yml b/.gitlab-ci.d/buildtest-template.yml
index 3e3e19d96b..fcbcc4e627 100644
--- a/.gitlab-ci.d/buildtest-template.yml
+++ b/.gitlab-ci.d/buildtest-template.yml
@@ -73,9 +73,9 @@
     # in its namespace setting or via git-push option, see documentation
     # in /.gitlab-ci.yml of this repository).
     - if: '$CI_PROJECT_NAMESPACE == "qemu-project"'
-      when: always
+      when: on_success
     - if: '$QEMU_CI_AVOCADO_TESTING'
-      when: always
+      when: on_success
     # Otherwise, set to manual (the jobs are created but not run).
     - when: manual
       allow_failure: true
-- 
2.31.1

Re: [PATCH for-6.1 0/2] gitlab: misc tweaks to job execution rules

[Daniel P. Berrangé]

Self-nack.  Sent the wrong version of the code - this one is broken,
ignore it.

On Thu, Jul 22, 2021 at 05:20:33PM +0100, Daniel P. Berrangé wrote:
>  - Fixes a problem with acceptance jobs running when build jobs fail
>  - Fixes a problem with pages job publishing website from undesirable
>    branches.
> 
> Daniel P. Berrangé (2):
>   gitlab: only let pages be published from default branch
>   gitlab: don't run acceptance jobs if build jobs fail
> 
>  .gitlab-ci.d/buildtest-template.yml |  4 ++--
>  .gitlab-ci.d/buildtest.yml          | 18 ++++++++++++++++++
>  2 files changed, 20 insertions(+), 2 deletions(-)
> 
> -- 
> 2.31.1
> 
> 

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|