ci: add 39 on-demand ARM64 package build workflows#5662
Conversation
Add workflow_dispatch-only workflows for building ARM64 packages across 13 distros and 3 feature tiers (stable/v3.0, PROXYSQL31/v3.1, PROXYSQLGENAI/v4.0). Each workflow is self-contained, runs on ubuntu-24.04-arm, and uploads the built .deb/.rpm as a 90-day workflow artifact.
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
📝 WalkthroughWalkthroughAdds 40+ new manually-dispatched GitHub Actions workflows to build and upload ARM64 packages across multiple Linux distributions and three variants (base, v31, genai); each workflow runs on an ARM64-capable runner, builds via make with optional flags, uploads Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 9
🧹 Nitpick comments (7)
.github/workflows/CI-package-arm64-centos10.yml (1)
41-42: Multi-linelsoutput can corrupt$GITHUB_ENV.If
binaries/contains more than one file matching*[mb](or more than one*.id-hash), the newline-separatedls -1output is written directly into$GITHUB_ENVas a singleKEY=...line, which GitHub Actions will treat as malformed/multiple entries and may fail the step or assign only the first value. Consider using the heredoc multiline syntax or restricting to a single file:♻️ Suggested hardening
- echo "BIN_PKG=$(ls -1 binaries/*[mb])" >> $GITHUB_ENV - echo "BIN_HASH=$(ls -1 binaries/*.id-hash 2>/dev/null || true)" >> $GITHUB_ENV + echo "BIN_PKG=$(ls -1 binaries/*[mb] | head -n1)" >> $GITHUB_ENV + echo "BIN_HASH=$(ls -1 binaries/*.id-hash 2>/dev/null | head -n1 || true)" >> $GITHUB_ENVAlso note
BIN_PKG/BIN_HASHdon't appear to be consumed by any later step in this workflow — if they're intended for a downstream release step, that step seems to be missing; otherwise these twoecholines are dead code.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/CI-package-arm64-centos10.yml around lines 41 - 42, The workflow writes multi-line ls output directly into $GITHUB_ENV via the BIN_PKG and BIN_HASH lines which can corrupt the env file if multiple matches exist; update the steps that set BIN_PKG and BIN_HASH to either (a) restrict to a single file (e.g., pick the first match from binaries/*[mb] and the first binaries/*.id-hash) or (b) use a heredoc/multiline-safe export to write each key/value safely into $GITHUB_ENV, and also remove these lines if BIN_PKG/BIN_HASH are unused downstream (or add the missing release step that consumes them); look for the exact symbols BIN_PKG, BIN_HASH, binaries/*[mb], *.id-hash and $GITHUB_ENV to locate and change the code..github/workflows/CI-package-arm64-centos10-genai.yml (1)
41-42: Remove unused environment variables.The
BIN_PKGandBIN_HASHenvironment variables are set but never referenced in any subsequent steps. This appears to be template code that should be cleaned up.🧹 Proposed cleanup
- name: Build package run: | PROXYSQLGENAI=1 make ${{ env.DIST }} - echo "BIN_PKG=$(ls -1 binaries/*[mb])" >> $GITHUB_ENV - echo "BIN_HASH=$(ls -1 binaries/*.id-hash 2>/dev/null || true)" >> $GITHUB_ENV🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/CI-package-arm64-centos10-genai.yml around lines 41 - 42, Remove the unused environment variables BIN_PKG and BIN_HASH from the workflow by deleting the lines that echo "BIN_PKG=..." and "BIN_HASH=..." into $GITHUB_ENV; ensure no other steps reference BIN_PKG or BIN_HASH (search for those symbols) before removing and leave the rest of the workflow unchanged..github/workflows/CI-package-arm64-debian13-genai.yml (2)
20-29: Pin the checks action to a full commit SHA.
LouisBrunner/checks-action@v2.0.0receivesGITHUB_TOKEN; using a mutable tag weakens supply-chain guarantees. Pin both usages (lines 20 and 52) to the resolved commit SHA:🔒 Pin to commit SHA
- - uses: LouisBrunner/checks-action@v2.0.0 + - uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/CI-package-arm64-debian13-genai.yml around lines 20 - 29, The workflow currently uses the mutable tag "uses: LouisBrunner/checks-action@v2.0.0" which weakens supply-chain guarantees; update both occurrences of that action (the "uses: LouisBrunner/checks-action@v2.0.0" entries around the checks steps) to use the fully resolved commit SHA instead of the tag (e.g., LouisBrunner/checks-action@<commit-sha>), replacing both instances so the CI references an immutable commit.
4-10: Add explicit workflow permissions for least-privilege access.This workflow creates and updates check runs via
LouisBrunner/checks-action@v2.0.0(lines 20, 52) and checks out code viaactions/checkout@v4(line 32), but relies on repository-defaultGITHUB_TOKENpermissions. Add an explicitpermissionsblock to ensure the workflow operates under hardened defaults and avoids over-granting the token under broad defaults.🔐 Proposed permissions block
on: workflow_dispatch: +permissions: + contents: read + checks: write + concurrency: group: ${{ github.workflow }}-${{ github.ref_name }} cancel-in-progress: true🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/CI-package-arm64-debian13-genai.yml around lines 4 - 10, Add an explicit top-level permissions block to the workflow to enforce least-privilege access: grant checks: write (needed by LouisBrunner/checks-action@v2.0.0) and contents: read (needed by actions/checkout@v4) and avoid broad default scopes; insert this permissions block at the top-level of the .github workflow (near the existing on: and concurrency: entries) so the GITHUB_TOKEN is constrained to only those scopes..github/workflows/CI-package-arm64-opensuse16-v31.yml (1)
1-60: Consider consolidating the 39 near-identical workflows into a reusable workflow.All 39
CI-package-arm64-*.ymlfiles in this PR differ only inDIST,MATRIXsuffix, artifact name, and the optionalPROXYSQL31=1/PROXYSQLGENAI=1prefix. Maintaining 39 copies means every future change (runner bump, action version pin, checkout options, artifact retention tweak, the$GITHUB_ENVfix above, etc.) has to be replicated 39 times and is easy to drift.A
workflow_callreusable workflow (e.g._reusable-package-arm64.yml) parameterized ondist,variant(base/v31/genai), andartifact-name— with 39 thinworkflow_dispatchcaller files (or a single dispatcher with achoiceinput) — would keep the on-demand UX and cut maintenance cost substantially.Non-blocking; feel free to defer.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/CI-package-arm64-opensuse16-v31.yml around lines 1 - 60, Many CI workflow files are duplicated with only DIST, MATRIX suffix, artifact name, and PROXYSQL31/PROXYSQLGENAI toggles differing; replace the 39 near-identical CI-package-arm64-*.yml copies with a single reusable workflow that accepts inputs for dist, variant, and artifact-name. Create a workflow with on: workflow_call and inputs {dist, variant, artifact_name}, implement the same jobs.build steps (checkout, Build package, Upload package artifact, checks-action) but derive env.DIST and env.MATRIX from the inputs and set PROXYSQL31 or PROXYSQLGENAI based on the variant input; then convert each existing file into a tiny workflow_dispatch caller that passes the proper dist/variant/artifact_name to the reusable workflow. Ensure the reusable workflow preserves the checks-action configuration, artifact retention, and the GITHUB_ENV exports for BIN_PKG/BIN_HASH..github/workflows/CI-package-arm64-fedora42-v31.yml (2)
20-29:if: always()on the first step is redundant.Nothing has run yet, so
always()is equivalent to the default. Harmless, but misleading — drop it to avoid implying this step is a cleanup/finalizer.♻️ Proposed tweak
- uses: LouisBrunner/checks-action@v2.0.0 id: checks - if: always() with:🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/CI-package-arm64-fedora42-v31.yml around lines 20 - 29, The workflow's first step (uses: LouisBrunner/checks-action@v2.0.0, id: checks) unnecessarily includes the conditional "if: always()"; remove the "if: always()" line from that step so it relies on the default execution semantics and no longer implies it's a cleanup/finalizer.
1-60: Consider a single reusable workflow instead of 39 near-identical files.All 39 workflows differ only by
DIST, artifact name, and thePROXYSQL31/PROXYSQLGENAIflag. Extracting a reusable workflow (workflow_callwith inputs fordistand avariantflag) plus 39 thin dispatcher workflows (or a single dispatcher with achoiceinput) would make fixes like the two above a one-line change instead of 39, and eliminate drift risk between tiers/distros.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/CI-package-arm64-fedora42-v31.yml around lines 1 - 60, This workflow duplicates logic found in 38 others; refactor by extracting a reusable workflow (workflow_call) that accepts inputs like dist and variant (e.g., inputs: dist, proxy_variant) and move the core job "build" into that reusable file using those inputs to set env DIST, ARCH, MATRIX and to conditionally set PROXYSQL31/PROXYSQLGENAI; then replace each of the 39 near-identical files (like this file whose name and run-name are CI-package-arm64-fedora42-v31 and which sets PROXYSQL31, DIST and artifact name proxysql-arm64-fedora42-v31) with a thin dispatcher workflow that calls the reusable workflow with the appropriate inputs (or implement a single dispatcher with a choice input) so changes to steps like Checkout, Build package, Upload package, and checks are made once in the reusable workflow.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/CI-package-arm64-almalinux8-genai.yml:
- Around line 38-42: Replace the echo-with-command-substitution that writes
BIN_PKG and BIN_HASH into $GITHUB_ENV with a safe two-step approach: enable
nullglob (shopt -s nullglob) or check for matching files first, collect the ls
output into a variable, and then append the multi-line value to $GITHUB_ENV
using the heredoc format required by GitHub Actions (i.e., write KEY<<'EOF'
followed by the collected lines and EOF). Update the Build package step that
runs PROXYSQLGENAI=1 make ${{ env.DIST }} to capture the results for BIN_PKG and
BIN_HASH and then write them with the heredoc syntax to avoid $GITHUB_ENV
corruption and avoid embedding ls errors when globs don't match.
In @.github/workflows/CI-package-arm64-debian13-genai.yml:
- Around line 38-42: Remove the two unused GITHUB_ENV assignments that set
BIN_PKG and BIN_HASH in the "Build package" step: delete the lines echoing
"BIN_PKG=$(ls -1 binaries/*[mb])" >> $GITHUB_ENV and "BIN_HASH=$(ls -1
binaries/*.id-hash 2>/dev/null || true)" >> $GITHUB_ENV so the CI job no longer
writes unused environment variables (the rest of the step, including
PROXYSQLGENAI=1 make ${{ env.DIST }}, should remain unchanged).
In @.github/workflows/CI-package-arm64-fedora42-v31.yml:
- Around line 38-42: The BIN_PKG and BIN_HASH values written to GITHUB_ENV may
contain newlines (from multiple matches) which breaks GitHub Actions parsing;
update the Build package step to write these variables using the multiline
heredoc form to $GITHUB_ENV (or otherwise collapse to a single-file value) so
that BIN_PKG and BIN_HASH are stored safely; specifically change the commands
that produce BIN_PKG/BIN_HASH (the lines using echo "BIN_PKG=$(ls -1
binaries/*[mb])" >> $GITHUB_ENV and echo "BIN_HASH=$(ls -1 binaries/*.id-hash
2>/dev/null || true)" >> $GITHUB_ENV) to use the secure heredoc approach when
writing to GITHUB_ENV.
- Around line 11-17: The workflow uses LouisBrunner/checks-action@v2.0.0 which
requires the GITHUB_TOKEN to have checks: write, so add an explicit permissions
block at the top of the job or workflow (e.g., permissions: checks: write) to
grant the required permission and avoid 403 errors when runs invoke
checks-action; update the job named build (and replicate to any other workflows
in this PR using checks-action) to include that permissions entry so the
check-run creation/update can succeed.
In @.github/workflows/CI-package-arm64-fedora43-v31.yml:
- Around line 4-13: Add an explicit top-level permissions block to limit
GITHUB_TOKEN to the minimal rights needed: grant checks: write (so
LouisBrunner/checks-action@v2.0.0 can create/update check runs) and contents:
read (so actions/checkout@v4 can access repo files under read-only defaults);
place this permissions block alongside the existing on: workflow_dispatch and
concurrency keys (affects the jobs.build run) and apply the same change across
the other 42 ARM64 package workflows to avoid relying on repo/org default token
permissions.
- Around line 38-42: The existing writes to $GITHUB_ENV for BIN_PKG and BIN_HASH
are embedding raw newline-separated ls output which can corrupt the env file
when multiple artifacts exist; update the commands that set BIN_PKG and BIN_HASH
(the lines that currently run echo "BIN_PKG=$(ls -1 binaries/*[mb])" >>
$GITHUB_ENV and echo "BIN_HASH=$(ls -1 binaries/*.id-hash 2>/dev/null || true)"
>> $GITHUB_ENV) to emit a single-line value or use GitHub Actions multiline env
file syntax: collapse the ls output into one joined string (e.g., join with
spaces or another safe delimiter) or write a proper multiline block to
$GITHUB_ENV so multiple artifacts do not break the env file format.
In @.github/workflows/CI-package-arm64-opensuse16-v31.yml:
- Around line 38-42: Remove the dead assignments of BIN_PKG and BIN_HASH in the
"Build package" step: delete the two echo lines that write BIN_PKG and BIN_HASH
into $GITHUB_ENV (they are unused and can produce multiline output that corrupts
the env file); if these values are actually needed later, replace the simple
echo form with the GitHub Actions heredoc form (VAR<<EOF ... EOF) and ensure any
consumers reference BIN_PKG/BIN_HASH; apply the same deletion or heredoc fix
across all workflows that contain the same pattern.
In @.github/workflows/CI-package-arm64-ubuntu22-genai.yml:
- Around line 41-42: The BIN_PKG export is fragile because the subshell
expansion `$(ls -1 binaries/*[mb])` can produce an empty value and let the job
continue; replace this pattern by explicitly checking for artifacts and failing
the step if none are found: detect files matching explicit globs like
`binaries/*.deb` and `binaries/*.rpm` (instead of `*[mb]`), set BIN_PKG to the
discovered path only when a file exists, and call `exit 1` (or use `set -e`) if
no matching artifact is found; do the same defensive existence check for
BIN_HASH (the `binaries/*.id-hash` export) so you don't export an empty value
and the job won't proceed silently with missing artifacts.
In @.github/workflows/CI-package-arm64-ubuntu24-genai.yml:
- Around line 4-9: The workflow uses LouisBrunner/checks-action@v2.0.0 which
requires write access to the Checks API, so add an explicit top-level
permissions block that grants the least privilege needed: set GITHUB_TOKEN
permissions with checks: write (and nothing more) in the workflow YAML (add a
top-level permissions: block near the existing on/concurrency keys) so the
checks-action can create/update check runs without relying on repo/org defaults.
---
Nitpick comments:
In @.github/workflows/CI-package-arm64-centos10-genai.yml:
- Around line 41-42: Remove the unused environment variables BIN_PKG and
BIN_HASH from the workflow by deleting the lines that echo "BIN_PKG=..." and
"BIN_HASH=..." into $GITHUB_ENV; ensure no other steps reference BIN_PKG or
BIN_HASH (search for those symbols) before removing and leave the rest of the
workflow unchanged.
In @.github/workflows/CI-package-arm64-centos10.yml:
- Around line 41-42: The workflow writes multi-line ls output directly into
$GITHUB_ENV via the BIN_PKG and BIN_HASH lines which can corrupt the env file if
multiple matches exist; update the steps that set BIN_PKG and BIN_HASH to either
(a) restrict to a single file (e.g., pick the first match from binaries/*[mb]
and the first binaries/*.id-hash) or (b) use a heredoc/multiline-safe export to
write each key/value safely into $GITHUB_ENV, and also remove these lines if
BIN_PKG/BIN_HASH are unused downstream (or add the missing release step that
consumes them); look for the exact symbols BIN_PKG, BIN_HASH, binaries/*[mb],
*.id-hash and $GITHUB_ENV to locate and change the code.
In @.github/workflows/CI-package-arm64-debian13-genai.yml:
- Around line 20-29: The workflow currently uses the mutable tag "uses:
LouisBrunner/checks-action@v2.0.0" which weakens supply-chain guarantees; update
both occurrences of that action (the "uses: LouisBrunner/checks-action@v2.0.0"
entries around the checks steps) to use the fully resolved commit SHA instead of
the tag (e.g., LouisBrunner/checks-action@<commit-sha>), replacing both
instances so the CI references an immutable commit.
- Around line 4-10: Add an explicit top-level permissions block to the workflow
to enforce least-privilege access: grant checks: write (needed by
LouisBrunner/checks-action@v2.0.0) and contents: read (needed by
actions/checkout@v4) and avoid broad default scopes; insert this permissions
block at the top-level of the .github workflow (near the existing on: and
concurrency: entries) so the GITHUB_TOKEN is constrained to only those scopes.
In @.github/workflows/CI-package-arm64-fedora42-v31.yml:
- Around line 20-29: The workflow's first step (uses:
LouisBrunner/checks-action@v2.0.0, id: checks) unnecessarily includes the
conditional "if: always()"; remove the "if: always()" line from that step so it
relies on the default execution semantics and no longer implies it's a
cleanup/finalizer.
- Around line 1-60: This workflow duplicates logic found in 38 others; refactor
by extracting a reusable workflow (workflow_call) that accepts inputs like dist
and variant (e.g., inputs: dist, proxy_variant) and move the core job "build"
into that reusable file using those inputs to set env DIST, ARCH, MATRIX and to
conditionally set PROXYSQL31/PROXYSQLGENAI; then replace each of the 39
near-identical files (like this file whose name and run-name are
CI-package-arm64-fedora42-v31 and which sets PROXYSQL31, DIST and artifact name
proxysql-arm64-fedora42-v31) with a thin dispatcher workflow that calls the
reusable workflow with the appropriate inputs (or implement a single dispatcher
with a choice input) so changes to steps like Checkout, Build package, Upload
package, and checks are made once in the reusable workflow.
In @.github/workflows/CI-package-arm64-opensuse16-v31.yml:
- Around line 1-60: Many CI workflow files are duplicated with only DIST, MATRIX
suffix, artifact name, and PROXYSQL31/PROXYSQLGENAI toggles differing; replace
the 39 near-identical CI-package-arm64-*.yml copies with a single reusable
workflow that accepts inputs for dist, variant, and artifact-name. Create a
workflow with on: workflow_call and inputs {dist, variant, artifact_name},
implement the same jobs.build steps (checkout, Build package, Upload package
artifact, checks-action) but derive env.DIST and env.MATRIX from the inputs and
set PROXYSQL31 or PROXYSQLGENAI based on the variant input; then convert each
existing file into a tiny workflow_dispatch caller that passes the proper
dist/variant/artifact_name to the reusable workflow. Ensure the reusable
workflow preserves the checks-action configuration, artifact retention, and the
GITHUB_ENV exports for BIN_PKG/BIN_HASH.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 3ae87fd7-d8cc-403d-9c81-89a5a56999af
📒 Files selected for processing (39)
.github/workflows/CI-package-arm64-almalinux10-genai.yml.github/workflows/CI-package-arm64-almalinux10-v31.yml.github/workflows/CI-package-arm64-almalinux10.yml.github/workflows/CI-package-arm64-almalinux8-genai.yml.github/workflows/CI-package-arm64-almalinux8-v31.yml.github/workflows/CI-package-arm64-almalinux8.yml.github/workflows/CI-package-arm64-almalinux9-genai.yml.github/workflows/CI-package-arm64-almalinux9-v31.yml.github/workflows/CI-package-arm64-almalinux9.yml.github/workflows/CI-package-arm64-centos10-genai.yml.github/workflows/CI-package-arm64-centos10-v31.yml.github/workflows/CI-package-arm64-centos10.yml.github/workflows/CI-package-arm64-centos9-genai.yml.github/workflows/CI-package-arm64-centos9-v31.yml.github/workflows/CI-package-arm64-centos9.yml.github/workflows/CI-package-arm64-debian12-genai.yml.github/workflows/CI-package-arm64-debian12-v31.yml.github/workflows/CI-package-arm64-debian12.yml.github/workflows/CI-package-arm64-debian13-genai.yml.github/workflows/CI-package-arm64-debian13-v31.yml.github/workflows/CI-package-arm64-debian13.yml.github/workflows/CI-package-arm64-fedora42-genai.yml.github/workflows/CI-package-arm64-fedora42-v31.yml.github/workflows/CI-package-arm64-fedora42.yml.github/workflows/CI-package-arm64-fedora43-genai.yml.github/workflows/CI-package-arm64-fedora43-v31.yml.github/workflows/CI-package-arm64-fedora43.yml.github/workflows/CI-package-arm64-opensuse15-genai.yml.github/workflows/CI-package-arm64-opensuse15-v31.yml.github/workflows/CI-package-arm64-opensuse15.yml.github/workflows/CI-package-arm64-opensuse16-genai.yml.github/workflows/CI-package-arm64-opensuse16-v31.yml.github/workflows/CI-package-arm64-opensuse16.yml.github/workflows/CI-package-arm64-ubuntu22-genai.yml.github/workflows/CI-package-arm64-ubuntu22-v31.yml.github/workflows/CI-package-arm64-ubuntu22.yml.github/workflows/CI-package-arm64-ubuntu24-genai.yml.github/workflows/CI-package-arm64-ubuntu24-v31.yml.github/workflows/CI-package-arm64-ubuntu24.yml
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: claude-review
🔇 Additional comments (21)
.github/workflows/CI-package-arm64-centos10-genai.yml (1)
36-36:fetch-depth: 0is necessary—do not remove it.The Makefile requires full git history for the build process. Line 12 uses
git describe --long --abbrev=7to generate version strings, and line 112 usesgit show -s --format=%ct HEADto set the source date epoch. Both commands require access to git tags and commit history. Using a shallow clone would cause these commands to fail..github/workflows/CI-package-arm64-ubuntu22-genai.yml (1)
16-40: No changes needed — this workflow is correct as-is.The build system uses
PROXYSQLGENAI=1as a feature flag environment variable, not as a make target suffix. The targets defined in the Makefile areubuntu22,ubuntu24, etc., without-genaivariants. The correct invocation isPROXYSQLGENAI=1 make ubuntu22, which:
- Enables the GenAI module via the feature flag
- Produces a v4.0.x version (instead of v3.0.x) due to automatic version incrementation when
PROXYSQLGENAI=1is set- Generates the correct package labeled with
-genaiin the artifact nameThe proposed fix to change
DIST: ubuntu22toDIST: ubuntu22-genaiwould fail — no such make target exists. All 13 other*-genaiworkflows in this PR follow the same correct pattern for consistency.> Likely an incorrect or invalid review comment..github/workflows/CI-package-arm64-almalinux9-genai.yml (1)
38-42: Same$GITHUB_ENVmulti-line hazard as inCI-package-arm64-almalinux8-genai.yml.If
make almalinux9withPROXYSQLGENAI=1emits more than one matching package (e.g., main + debuginfo RPM), theecho "BIN_PKG=$(ls -1 …)"line will write a multi-line value to$GITHUB_ENV, corrupting the env-file format. Apply the heredoc-delimited fix suggested on the almalinux8-genai workflow across this and all siblingCI-package-arm64-*.ymlfiles..github/workflows/CI-package-arm64-fedora43.yml (1)
38-42: Same$GITHUB_ENVmulti-line hazard — apply the shared fix.Fedora RPM builds commonly produce a main package plus
-debuginfo/-debugsourceRPMs, sols -1 binaries/*[mb]is especially likely to return multiple lines here. Use the heredoc-delimited$GITHUB_ENVsyntax shown on the almalinux8-genai workflow..github/workflows/CI-package-arm64-ubuntu22-v31.yml (2)
38-42: Same$GITHUB_ENVmulti-line hazard — apply the shared fix.Debian/Ubuntu builds may produce
.debplus.ddeb(debug) or multiple package variants, which would makeBIN_PKGa multi-line value and corrupt$GITHUB_ENV. Adopt the heredoc-delimited fix proposed onCI-package-arm64-almalinux8-genai.yml.
14-17:⚠️ Potential issue | 🟡 MinorAdd explicit
PROXYSQL31=$(PROXYSQL31)forwarding to sub-makes in the Makefile.The top-level Makefile exports
PROXYSQL31but does not explicitly pass it todeps,lib, andsrcsub-makes—onlyPROXYSQLGENAI,PROXYSQLFFTO, andPROXYSQLTSDBare forwarded (lines 377–397). WhilePROXYSQL31currently propagates via inherited environment, this asymmetry creates fragility: a future change usingenv -ior an explicit variable list in sub-make invocations would silently break v3.1 builds without alerting packagers.Align
PROXYSQL31with the other feature flags by addingPROXYSQL31=$(PROXYSQL31)to the sub-make recipes.⛔ Skipped due to learnings
Learnt from: CR Repo: sysown/proxysql PR: 0 File: CLAUDE.md:0-0 Timestamp: 2026-04-17T16:31:58.196Z Learning: Use feature flags `PROXYSQL31=1` for v3.1.x Innovative tier and `PROXYSQLGENAI=1` for v4.0.x AI/MCP tier; PROXYSQLGENAI implies both PROXYSQL31 and PROXYSQLFFTO/PROXYSQLTSDBLearnt from: CR Repo: sysown/proxysql PR: 0 File: CLAUDE.md:0-0 Timestamp: 2026-04-17T16:31:58.196Z Learning: Applies to **/*.{cpp,h,hpp} : C++17 is required; use conditional compilation via `#ifdef PROXYSQLGENAI`, `#ifdef PROXYSQL31`, etc. for feature-gated code.github/workflows/CI-package-arm64-opensuse15-genai.yml (1)
38-42: Same$GITHUB_ENVmulti-line hazard — apply the shared fix.openSUSE RPM builds can also emit multiple
.rpmfiles (main + debuginfo/debugsource), so the single-lineechopattern here can corrupt$GITHUB_ENV. Use the heredoc-delimited form proposed onCI-package-arm64-almalinux8-genai.yml..github/workflows/CI-package-arm64-debian13-v31.yml (1)
38-42: Same$GITHUB_ENVmulti-line hazard — apply the shared fix.Same issue as in the other workflows:
ls -1 binaries/*[mb]may yield multiple lines, corrupting$GITHUB_ENV. Also verifyPROXYSQL31=1propagates to sub-makes (see note onCI-package-arm64-ubuntu22-v31.yml); the top-level Makefile does not explicitly forward it..github/workflows/CI-package-arm64-opensuse15-v31.yml (1)
38-42: Same$GITHUB_ENVmulti-line hazard — apply the shared fix.Same concerns as
CI-package-arm64-ubuntu22-v31.yml: heredoc-delimit theBIN_PKG/BIN_HASHwrites, and verify explicitPROXYSQL31forwarding in the top-levelMakefile..github/workflows/CI-package-arm64-ubuntu22.yml (1)
38-42: Same$GITHUB_ENVmulti-line hazard — apply the shared fix.Same issue as the other 7 workflows in this PR: heredoc-delimit the
BIN_PKG/BIN_HASHassignments so multi-output builds don't corrupt$GITHUB_ENV..github/workflows/CI-package-arm64-opensuse15.yml (1)
38-42: Same dead-code / multi-line-$GITHUB_ENVconcern as raised onCI-package-arm64-opensuse16-v31.yml. Applying the same fix here..github/workflows/CI-package-arm64-opensuse16.yml (1)
38-42: Same dead-code / multi-line-$GITHUB_ENVconcern as raised onCI-package-arm64-opensuse16-v31.yml. Applying the same fix here..github/workflows/CI-package-arm64-almalinux9-v31.yml (1)
38-42: Same dead-code / multi-line-$GITHUB_ENVconcern as raised onCI-package-arm64-opensuse16-v31.yml. Applying the same fix here..github/workflows/CI-package-arm64-almalinux9.yml (1)
38-42: Same dead-code / multi-line-$GITHUB_ENVconcern as raised onCI-package-arm64-opensuse16-v31.yml. Applying the same fix here..github/workflows/CI-package-arm64-almalinux10-genai.yml (1)
38-42: Same dead-code / multi-line-$GITHUB_ENVconcern as raised onCI-package-arm64-opensuse16-v31.yml. Applying the same fix here..github/workflows/CI-package-arm64-almalinux8.yml (1)
38-42: Same dead-code / multi-line-$GITHUB_ENVconcern as raised onCI-package-arm64-opensuse16-v31.yml. Applying the same fix here..github/workflows/CI-package-arm64-fedora42-genai.yml (1)
38-42: Same dead-code / multi-line-$GITHUB_ENVconcern as raised onCI-package-arm64-opensuse16-v31.yml. Applying the same fix here..github/workflows/CI-package-arm64-debian12-v31.yml (2)
38-42: Multi-file glob risk is especially acute for Debian.Debian builds commonly emit multiple artifacts matching
binaries/*[mb](e.g.proxysql_*.debplus a-dbgsym/ metapackage), soBIN_PKGwill very likely end up multi-line here and break$GITHUB_ENV. Apply the heredoc fix from the fedora42-v31 comment. Same applies to every workflow in this PR.
11-17: Same missingpermissions:block as the other workflows — please fix uniformly..github/workflows/CI-package-arm64-centos9-genai.yml (2)
38-42: SameGITHUB_ENVmulti-line risk, plus verifyPROXYSQLGENAI=1 make centos9target.The
BIN_PKG/BIN_HASHheredoc fix from fedora42-v31 applies here too. Additionally, please confirm the Makefile handlesPROXYSQLGENAI=1for all 13 distro targets used by the genai tier — if any target silently ignores the flag, the resulting artifact name will collide with the stable tier's output while containing different bits.#!/bin/bash # Check that PROXYSQLGENAI is actually referenced by the build system rg -n 'PROXYSQLGENAI|PROXYSQL31' Makefile deb/ rpm/ 2>/dev/null | head -80 fd -t f Makefile | head -20
11-17: Same missingpermissions:block.
| - name: Build package | ||
| run: | | ||
| PROXYSQL31=1 make ${{ env.DIST }} | ||
| echo "BIN_PKG=$(ls -1 binaries/*[mb])" >> $GITHUB_ENV | ||
| echo "BIN_HASH=$(ls -1 binaries/*.id-hash 2>/dev/null || true)" >> $GITHUB_ENV |
There was a problem hiding this comment.
BIN_PKG/BIN_HASH may contain multiple lines, breaking GITHUB_ENV.
ls -1 binaries/*[mb] can legitimately match multiple files (e.g., several .deb/.rpm artifacts or dbg packages). A multi-line value written as KEY=value\n to $GITHUB_ENV is invalid and will either fail the step or cause subsequent env entries to be parsed as standalone lines. Same concern for BIN_HASH if more than one *.id-hash exists. Use the heredoc form for multi-line values, or reduce to a single line.
🛡️ Proposed fix
- name: Build package
run: |
PROXYSQL31=1 make ${{ env.DIST }}
- echo "BIN_PKG=$(ls -1 binaries/*[mb])" >> $GITHUB_ENV
- echo "BIN_HASH=$(ls -1 binaries/*.id-hash 2>/dev/null || true)" >> $GITHUB_ENV
+ {
+ echo "BIN_PKG<<__EOF__"
+ ls -1 binaries/*[mb] || true
+ echo "__EOF__"
+ echo "BIN_HASH<<__EOF__"
+ ls -1 binaries/*.id-hash 2>/dev/null || true
+ echo "__EOF__"
+ } >> "$GITHUB_ENV"Note: this same pattern is present in all 39 workflows added by this PR and should be fixed uniformly (ideally via a reusable workflow — see the other comment).
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/CI-package-arm64-fedora42-v31.yml around lines 38 - 42,
The BIN_PKG and BIN_HASH values written to GITHUB_ENV may contain newlines (from
multiple matches) which breaks GitHub Actions parsing; update the Build package
step to write these variables using the multiline heredoc form to $GITHUB_ENV
(or otherwise collapse to a single-file value) so that BIN_PKG and BIN_HASH are
stored safely; specifically change the commands that produce BIN_PKG/BIN_HASH
(the lines using echo "BIN_PKG=$(ls -1 binaries/*[mb])" >> $GITHUB_ENV and echo
"BIN_HASH=$(ls -1 binaries/*.id-hash 2>/dev/null || true)" >> $GITHUB_ENV) to
use the secure heredoc approach when writing to GITHUB_ENV.
| - name: Build package | ||
| run: | | ||
| PROXYSQL31=1 make ${{ env.DIST }} | ||
| echo "BIN_PKG=$(ls -1 binaries/*[mb])" >> $GITHUB_ENV | ||
| echo "BIN_HASH=$(ls -1 binaries/*.id-hash 2>/dev/null || true)" >> $GITHUB_ENV |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Locate workflows that still append newline-prone ls output directly to GITHUB_ENV.
rg -n -C2 'echo "BIN_(PKG|HASH)=\$\(ls -1 binaries/' .github/workflowsRepository: sysown/proxysql
Length of output: 22335
🏁 Script executed:
# Check for other variations of GITHUB_ENV assignments that might be similarly vulnerable
rg -n 'echo.*=.*\$\(' .github/workflows | grep -E 'GITHUB_ENV|GITHUB_OUTPUT' | head -20Repository: sysown/proxysql
Length of output: 2636
🏁 Script executed:
# Check for GITHUB_OUTPUT usage and multiline patterns that might handle this differently
rg -n 'GITHUB_OUTPUT' .github/workflows | head -10Repository: sysown/proxysql
Length of output: 41
🏁 Script executed:
# Also verify if there are any x86_64 workflows with similar patterns
fd '\.yml$' .github/workflows | grep -v 'arm64' | head -10 | xargs grep -l 'BIN_PKG\|BIN_HASH' 2>/dev/null || echo "No matches in non-arm64 workflows"Repository: sysown/proxysql
Length of output: 92
Fix $GITHUB_ENV writes to handle multiple artifacts safely.
Lines 41–42 write raw ls -1 output into $GITHUB_ENV. If the build emits multiple .deb/.rpm or hash files, the embedded newlines corrupt the environment file format before artifact upload runs. Collapse the list into a single line or use multiline syntax; this pattern affects all 38 arm64 CI package workflows.
🛠️ Proposed robust package/hash export
- name: Build package
run: |
PROXYSQL31=1 make ${{ env.DIST }}
- echo "BIN_PKG=$(ls -1 binaries/*[mb])" >> $GITHUB_ENV
- echo "BIN_HASH=$(ls -1 binaries/*.id-hash 2>/dev/null || true)" >> $GITHUB_ENV
+ bin_pkg="$(find binaries -maxdepth 1 -type f \( -name '*.deb' -o -name '*.rpm' \) -print | paste -sd ' ' -)"
+ test -n "$bin_pkg"
+ bin_hash="$(find binaries -maxdepth 1 -type f -name '*.id-hash' -print | paste -sd ' ' -)"
+ {
+ echo "BIN_PKG=$bin_pkg"
+ echo "BIN_HASH=$bin_hash"
+ } >> "$GITHUB_ENV"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/CI-package-arm64-fedora43-v31.yml around lines 38 - 42,
The existing writes to $GITHUB_ENV for BIN_PKG and BIN_HASH are embedding raw
newline-separated ls output which can corrupt the env file when multiple
artifacts exist; update the commands that set BIN_PKG and BIN_HASH (the lines
that currently run echo "BIN_PKG=$(ls -1 binaries/*[mb])" >> $GITHUB_ENV and
echo "BIN_HASH=$(ls -1 binaries/*.id-hash 2>/dev/null || true)" >> $GITHUB_ENV)
to emit a single-line value or use GitHub Actions multiline env file syntax:
collapse the ls output into one joined string (e.g., join with spaces or another
safe delimiter) or write a proper multiline block to $GITHUB_ENV so multiple
artifacts do not break the env file format.
| echo "BIN_PKG=$(ls -1 binaries/*[mb])" >> $GITHUB_ENV | ||
| echo "BIN_HASH=$(ls -1 binaries/*.id-hash 2>/dev/null || true)" >> $GITHUB_ENV |
There was a problem hiding this comment.
Fragile artifact discovery — a failed build will still "succeed" with an empty BIN_PKG.
ls -1 binaries/*[mb] runs with the default shell (no set -e -o pipefail for the subshell), and its stderr is inherited. If the make step produces no matching file (e.g. build produced only a .rpm, or failed partway but exited 0, or the glob simply doesn't match), ls writes an error to stderr and $(...) expands to empty — BIN_PKG= is still exported and the job proceeds to upload. The [mb] character class (matching files ending in m or b, intended for .deb/.rpm) is also quite loose and will match any stray file ending in those letters.
Consider validating explicitly, e.g.:
- PROXYSQLGENAI=1 make ${{ env.DIST }}
- echo "BIN_PKG=$(ls -1 binaries/*[mb])" >> $GITHUB_ENV
- echo "BIN_HASH=$(ls -1 binaries/*.id-hash 2>/dev/null || true)" >> $GITHUB_ENV
+ set -euo pipefail
+ PROXYSQLGENAI=1 make ${{ env.DIST }}
+ shopt -s nullglob
+ pkgs=(binaries/*.deb binaries/*.rpm)
+ if (( ${`#pkgs`[@]} == 0 )); then
+ echo "No package artifacts produced under binaries/" >&2
+ exit 1
+ fi
+ echo "BIN_PKG=${pkgs[0]}" >> "$GITHUB_ENV"
+ hashes=(binaries/*.id-hash)
+ (( ${`#hashes`[@]} )) && echo "BIN_HASH=${hashes[0]}" >> "$GITHUB_ENV" || trueSince this same pattern is duplicated across all 39 workflows in this PR, fixing it here means fixing it everywhere — worth getting right once.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/CI-package-arm64-ubuntu22-genai.yml around lines 41 - 42,
The BIN_PKG export is fragile because the subshell expansion `$(ls -1
binaries/*[mb])` can produce an empty value and let the job continue; replace
this pattern by explicitly checking for artifacts and failing the step if none
are found: detect files matching explicit globs like `binaries/*.deb` and
`binaries/*.rpm` (instead of `*[mb]`), set BIN_PKG to the discovered path only
when a file exists, and call `exit 1` (or use `set -e`) if no matching artifact
is found; do the same defensive existence check for BIN_HASH (the
`binaries/*.id-hash` export) so you don't export an empty value and the job
won't proceed silently with missing artifacts.
Add explicit permissions (contents: read, checks: write) to ensure checks-action works under read-only default token permissions. Remove dead BIN_PKG and BIN_HASH environment variable assignments that could corrupt $GITHUB_ENV with multi-line ls output.
|
There was a problem hiding this comment.
🧹 Nitpick comments (2)
.github/workflows/CI-package-arm64-debian12-genai.yml (2)
24-26: Nit:if: always()is redundant on the first step.Nothing precedes this step, so
if: always()has no effect here. It's meaningful only on the final checks-update step (line 55) where preceding steps may have failed. Harmless; fix only if you're doing a sweep.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/CI-package-arm64-debian12-genai.yml around lines 24 - 26, The workflow step defining the checks action (uses: LouisBrunner/checks-action@v2.0.0, id: checks) includes an unnecessary "if: always()" because it's the first step and nothing precedes it; remove the "if: always()" from that step so the condition is not redundantly applied (keep "if: always()" only on the final checks-update step where it matters).
1-62: Consider consolidating the 39 near-identical workflows via a reusable workflow.All 39 workflows in this PR differ only in
DIST,MATRIXlabel, artifact name, and the build flag (PROXYSQL31=1/PROXYSQLGENAI=1/ none). A single reusable workflow (workflow_call) invoked by 39 thin dispatch wrappers (or a single dispatcher with a choice input) would eliminate ~2k lines of duplication and make future edits (e.g., runner image bump, checks-action version pin) a one-line change instead of 39.The PR description acknowledges self-containment as a design choice, so feel free to defer — flagging as optional maintainability improvement.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/CI-package-arm64-debian12-genai.yml around lines 1 - 62, Consolidate the near-duplicate workflow by extracting the core job (the "build" job that runs on ubuntu-24.04-arm, sets env vars ARCH/DIST/MATRIX, executes PROXYSQLGENAI=1 make ${{ env.DIST }}, uploads binaries/, and reports status via LouisBrunner/checks-action) into a reusable workflow using workflow_call; then replace each of the 39 copies with tiny dispatcher workflows that call the reusable workflow and pass the varying inputs (DIST, MATRIX label, artifact name, and optional build flag like PROXYSQL31 or PROXYSQLGENAI) so changes to runner, checks-action version, or steps live in one place (refer to the existing job "build", env keys DIST and MATRIX, and the PROXYSQLGENAI build flag to locate code to extract).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/workflows/CI-package-arm64-debian12-genai.yml:
- Around line 24-26: The workflow step defining the checks action (uses:
LouisBrunner/checks-action@v2.0.0, id: checks) includes an unnecessary "if:
always()" because it's the first step and nothing precedes it; remove the "if:
always()" from that step so the condition is not redundantly applied (keep "if:
always()" only on the final checks-update step where it matters).
- Around line 1-62: Consolidate the near-duplicate workflow by extracting the
core job (the "build" job that runs on ubuntu-24.04-arm, sets env vars
ARCH/DIST/MATRIX, executes PROXYSQLGENAI=1 make ${{ env.DIST }}, uploads
binaries/, and reports status via LouisBrunner/checks-action) into a reusable
workflow using workflow_call; then replace each of the 39 copies with tiny
dispatcher workflows that call the reusable workflow and pass the varying inputs
(DIST, MATRIX label, artifact name, and optional build flag like PROXYSQL31 or
PROXYSQLGENAI) so changes to runner, checks-action version, or steps live in one
place (refer to the existing job "build", env keys DIST and MATRIX, and the
PROXYSQLGENAI build flag to locate code to extract).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: bcac638b-4c2d-4136-ac39-af9fca95cde3
📒 Files selected for processing (39)
.github/workflows/CI-package-arm64-almalinux10-genai.yml.github/workflows/CI-package-arm64-almalinux10-v31.yml.github/workflows/CI-package-arm64-almalinux10.yml.github/workflows/CI-package-arm64-almalinux8-genai.yml.github/workflows/CI-package-arm64-almalinux8-v31.yml.github/workflows/CI-package-arm64-almalinux8.yml.github/workflows/CI-package-arm64-almalinux9-genai.yml.github/workflows/CI-package-arm64-almalinux9-v31.yml.github/workflows/CI-package-arm64-almalinux9.yml.github/workflows/CI-package-arm64-centos10-genai.yml.github/workflows/CI-package-arm64-centos10-v31.yml.github/workflows/CI-package-arm64-centos10.yml.github/workflows/CI-package-arm64-centos9-genai.yml.github/workflows/CI-package-arm64-centos9-v31.yml.github/workflows/CI-package-arm64-centos9.yml.github/workflows/CI-package-arm64-debian12-genai.yml.github/workflows/CI-package-arm64-debian12-v31.yml.github/workflows/CI-package-arm64-debian12.yml.github/workflows/CI-package-arm64-debian13-genai.yml.github/workflows/CI-package-arm64-debian13-v31.yml.github/workflows/CI-package-arm64-debian13.yml.github/workflows/CI-package-arm64-fedora42-genai.yml.github/workflows/CI-package-arm64-fedora42-v31.yml.github/workflows/CI-package-arm64-fedora42.yml.github/workflows/CI-package-arm64-fedora43-genai.yml.github/workflows/CI-package-arm64-fedora43-v31.yml.github/workflows/CI-package-arm64-fedora43.yml.github/workflows/CI-package-arm64-opensuse15-genai.yml.github/workflows/CI-package-arm64-opensuse15-v31.yml.github/workflows/CI-package-arm64-opensuse15.yml.github/workflows/CI-package-arm64-opensuse16-genai.yml.github/workflows/CI-package-arm64-opensuse16-v31.yml.github/workflows/CI-package-arm64-opensuse16.yml.github/workflows/CI-package-arm64-ubuntu22-genai.yml.github/workflows/CI-package-arm64-ubuntu22-v31.yml.github/workflows/CI-package-arm64-ubuntu22.yml.github/workflows/CI-package-arm64-ubuntu24-genai.yml.github/workflows/CI-package-arm64-ubuntu24-v31.yml.github/workflows/CI-package-arm64-ubuntu24.yml
✅ Files skipped from review due to trivial changes (20)
- .github/workflows/CI-package-arm64-centos9-genai.yml
- .github/workflows/CI-package-arm64-centos10.yml
- .github/workflows/CI-package-arm64-centos10-genai.yml
- .github/workflows/CI-package-arm64-almalinux9-genai.yml
- .github/workflows/CI-package-arm64-almalinux10-genai.yml
- .github/workflows/CI-package-arm64-ubuntu24-v31.yml
- .github/workflows/CI-package-arm64-centos9-v31.yml
- .github/workflows/CI-package-arm64-fedora43-v31.yml
- .github/workflows/CI-package-arm64-centos9.yml
- .github/workflows/CI-package-arm64-ubuntu24.yml
- .github/workflows/CI-package-arm64-opensuse15-genai.yml
- .github/workflows/CI-package-arm64-debian13-genai.yml
- .github/workflows/CI-package-arm64-centos10-v31.yml
- .github/workflows/CI-package-arm64-debian13-v31.yml
- .github/workflows/CI-package-arm64-opensuse15.yml
- .github/workflows/CI-package-arm64-fedora42-genai.yml
- .github/workflows/CI-package-arm64-fedora43-genai.yml
- .github/workflows/CI-package-arm64-almalinux8.yml
- .github/workflows/CI-package-arm64-almalinux9-v31.yml
- .github/workflows/CI-package-arm64-ubuntu22.yml
🚧 Files skipped from review as they are similar to previous changes (13)
- .github/workflows/CI-package-arm64-fedora42.yml
- .github/workflows/CI-package-arm64-almalinux9.yml
- .github/workflows/CI-package-arm64-fedora42-v31.yml
- .github/workflows/CI-package-arm64-opensuse16.yml
- .github/workflows/CI-package-arm64-debian13.yml
- .github/workflows/CI-package-arm64-almalinux10-v31.yml
- .github/workflows/CI-package-arm64-opensuse15-v31.yml
- .github/workflows/CI-package-arm64-almalinux8-genai.yml
- .github/workflows/CI-package-arm64-fedora43.yml
- .github/workflows/CI-package-arm64-ubuntu22-genai.yml
- .github/workflows/CI-package-arm64-opensuse16-genai.yml
- .github/workflows/CI-package-arm64-debian12.yml
- .github/workflows/CI-package-arm64-ubuntu24-genai.yml
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: claude-review
🔇 Additional comments (9)
.github/workflows/CI-package-arm64-debian12-genai.yml (1)
54-62: LGTM — graceful on initial-checks failure.If the initial
checks-actionstep itself fails,steps.checks.outputs.check_idwill be empty and this update step will no-op/error, but theif: always()plus job.status mapping (success/failure/cancelled) to checks-actionconclusionis correct..github/workflows/CI-package-arm64-debian12-v31.yml (1)
1-62: LGTM.Identical pattern to the other
*-v31workflows;PROXYSQL31=1 make debian12correctly bumps the minor version perMakefile:63-86. See duplication note onCI-package-arm64-debian12-genai.ymlregarding consolidation..github/workflows/CI-package-arm64-almalinux8-v31.yml (1)
1-62: LGTM.Matches the established pattern;
make almalinux8target resolves correctly (Makefile:413-439) and artifact naming is consistent..github/workflows/CI-package-arm64-ubuntu22-v31.yml (1)
1-62: LGTM.Consistent with the rest of the
*-v31workflow set..github/workflows/CI-package-arm64-opensuse16-v31.yml (1)
42-44: DeadBIN_PKG/BIN_HASHassignments correctly removed.Prior concern about multiline
$GITHUB_ENVcorruption fromls -1 binaries/*[mb]is resolved — the build step is now a singlemakeinvocation..github/workflows/CI-package-arm64-almalinux10.yml (4)
1-13: LGTM — trigger, permissions, and concurrency match the PR intent.This is manual-only, grants the minimal extra
checks: writepermission needed for the check run, and scopes cancellation per workflow/ref.
15-21: LGTM — the job targets the intended ARM64 AlmaLinux 10 build.
DIST=almalinux10aligns with the referenced Makefile target and docker-compose build service.
23-52: LGTM — build and artifact handling follow the established ARM64 workflow pattern.The workflow checks out the dispatched SHA, builds the expected
almalinux10target, and fails clearly if no package artifacts are produced.
54-62: LGTM — final check status is updated on all job outcomes.Using
if: always()here keeps the custom check result aligned with the job conclusion after build or upload failures.
1 participant
Summary
Adds 39 self-contained
workflow_dispatch-only GitHub Actions workflows for building ARM64 packages on demand (no automatic triggers on push/PR).Structure
CI-package-arm64-<dist>.ymlPROXYSQL31=1CI-package-arm64-<dist>-v31.ymlPROXYSQLGENAI=1CI-package-arm64-<dist>-genai.ymlDistros covered
centos9, centos10, debian12, debian13, ubuntu22, ubuntu24, fedora42, fedora43, opensuse15, opensuse16, almalinux8, almalinux9, almalinux10
Per-workflow details
ubuntu-24.04-arm.deb/.rpm+ hash, 90-day retentionLouisBrunner/checks-action@v2.0.0Usage
Trigger from GitHub Actions UI or CLI:
Summary by CodeRabbit