enricobuehler
e044f68500
apple / swift (pull_request) Successful in 1m38s
apple / screenshots (pull_request) Skipped
android / android (pull_request) Successful in 5m47s
ci / rust-arm64 (pull_request) Successful in 2m35s
ci / web (pull_request) Successful in 1m53s
ci / docs-site (pull_request) Successful in 1m24s
ci / bun-nix (pull_request) Successful in 26s
ci / rust (pull_request) Successful in 7m26s
Arch moved FFmpeg 8 -> 9 (every libav soname +1) hours before the release. PR #108 fixed the real bug — packaging/arch/PKGBUILD now binds punktfunk-host to the sonames it actually linked, so pacman refuses an upgrade instead of bricking the install — and re-keyed ci/arch-ci.Dockerfile so the builder would carry FFmpeg 9. The tag was pushed four minutes later. arch.yml and docker.yml have no `needs:` between them, and arch.yml deliberately runs no -Syu ("the image's snapshot IS the build environment"), so the release build pulled the still-FFmpeg-8 `:latest` and published punktfunk-host 0.25.0-1 depends: libavcodec.so=62-64, libavutil.so=60-64, libavfilter.so=11-64, libavdevice.so=62-64, libswscale.so=9-64 against a world that had moved to 63/61/12/63/10. It fails safely — pacman refuses, nothing bricks — but it fails broadly: pacman prepares one transaction, so an unsatisfiable dependency of OURS stopped affected users' entire `pacman -Syu`. Nothing in the pipeline could have caught it. The existing assert proves the dep is VERSIONED; it cannot prove the version EXISTS. So two guards, plus the lever to repair a release that has already shipped: * Preflight parity — compare the builder's libav `provides` against the live repos and `-Syu` the container if they differ. The image is a cache and may lag; on this one axis it may not. Syncs into a throwaway --dbpath so the container never sits in the partial-upgrade state a bare `pacman -Sy` leaves. * Publish gate — resolve every built package with `pacman -U --print` against a PRISTINE --dbpath. Empty db means "nothing is installed", so every dependency must come from the repos exactly as on a user's box. Resolving against the builder's own installed set is what would hide this: a stale ffmpeg satisfies a stale bound. gamescope stays best-effort (dropped from the upload with a warning, never fatal). * workflow_dispatch(release_tag, pkgrel) — a published release cannot be repaired by re-running its tag: pkgrel would stay 1, which is invisible to a box that already recorded the broken build, and the workflow file at the tag can never carry inputs added after it. Dispatched from main it takes the WORKFLOW from main and the SOURCE from the tag, publishes to the stable repo at a higher pkgrel, and replaces the release-page assets (prune_release_assets: upsert replaces by NAME, and a rebuild's filenames differ, so the superseded package would otherwise stay one click away). Verified on a real ffmpeg-9 box (.21, CachyOS) rather than reasoned about: the gate rejects the published 0.25.0-1 host with the user-visible error verbatim, and passes client, web, scripting and gamescope — 0 false positives across all five artifacts. The parity snippet reads today's `provides` correctly (`-Si --dbpath` on an empty db works; pacman does not wrap fields when piped). Version logic exercised on all four paths: rebuild -> 0.25.0-2 stable, tag push and canary unchanged, pkgrel=1 refused. Ships as punktfunk-host 0.25.0-2. README gains the pacman error and what to do about it; CHANGELOG says plainly that 0.25.0's Arch packages were wrong.
67 lines
4.5 KiB
Docker
67 lines
4.5 KiB
Docker
# Arch CI builder: base-devel + every dependency arch.yml's two makepkg legs used to
|
|
# pacman-install per run (~1 GB of mirror traffic each time) + bun + sccache + nodejs
|
|
# (JS actions exec node INSIDE the job container — the same lesson as android-ci).
|
|
# Content-keyed and rebuilt only when the ci/ tree changes (docker.yml `builders`).
|
|
#
|
|
# docker build -f ci/arch-ci.Dockerfile -t punktfunk-arch-ci ci
|
|
#
|
|
# ROLLING-RELEASE TRADEOFF, on purpose: packages now build against the Arch snapshot
|
|
# from the last image rebuild instead of a fresh -Syu per run. That is the same staleness
|
|
# the gamescope cache already embraces ("a stale binary against newer system libs is the
|
|
# same risk the distro's own package carries between rebuilds"), and any ci/ edit — or
|
|
# bumping the date in this line (refreshed: 2026-08-08) — re-keys and re-snapshots it.
|
|
#
|
|
# ⚠ That staleness has a sharp edge, and 2026-08-08 is why the date above moved: this snapshot is
|
|
# what decides which FFmpeg the HOST links, and arch.yml deliberately runs no -Syu, so the builder
|
|
# stayed frozen on ffmpeg 8 (libavcodec 62) even after Arch shipped 2:9.0-5 (libavcodec 63) to
|
|
# every user. A canary built from the old snapshot therefore CANNOT satisfy the soname dep that
|
|
# packaging/arch/PKGBUILD now derives from the link (libavcodec.so=62-64 against a box that has
|
|
# 63-64), so it would simply refuse to install rather than start. Re-keying this image is the step
|
|
# that makes the ffmpeg-9 bump actually reach the package — a Cargo.toml bump alone does nothing
|
|
# here. Whenever Arch moves to an FFmpeg major, bump the date in the same commit.
|
|
#
|
|
# ⚠ AND KNOW WHY THAT WAS NOT ENOUGH: bumping this date only helps once docker.yml has actually
|
|
# republished the image, and nothing sequences the two workflows. v0.25.0 was tagged four minutes
|
|
# after the ffmpeg-9 merge, so the release build still pulled the FFmpeg-8 `:latest` and published
|
|
# a punktfunk-host that no up-to-date Arch box could install — which blocks the user's ENTIRE
|
|
# `pacman -Syu`, not just our package. arch.yml therefore no longer trusts this image on that one
|
|
# axis: it compares the builder's libav sonames against the repos before building (and `-Syu`s
|
|
# itself if they differ), and refuses to publish anything a pristine-db `pacman -U --print` says
|
|
# is unsatisfiable. This file staying current is still the CHEAP path — those guards are the
|
|
# backstop, not the plan.
|
|
FROM docker.io/library/archlinux:base-devel
|
|
|
|
# One transaction: the main build/runtime deps (first list) + the gamescope companion's
|
|
# deps (second list) — both copied verbatim from what arch.yml installed in-job, where
|
|
# they now no-op as `--needed` guards.
|
|
# vulkan-headers rides the first list only because arch.yml's copy does; the package it actually
|
|
# serves is the gamescope companion (packaging/gamescope/PKGBUILD makedepends). punktfunk itself
|
|
# needs no system Vulkan headers — pyrowave-sys bindgens its own vendored copy and ash dlopens the
|
|
# loader — but arch.yml builds gamescope with `makepkg -d`, so an absent makedepend would not be
|
|
# reported as a missing dependency, only as a compile failure. Keep it.
|
|
RUN pacman -Syu --noconfirm --needed \
|
|
git nodejs rust clang cmake ninja nasm pkgconf python vulkan-headers \
|
|
gtk4 libadwaita sdl3 ffmpeg pipewire wayland libxkbcommon opus libei \
|
|
mesa libglvnd unzip libarchive \
|
|
glslang libcap libdrm libinput libx11 libxcomposite libxdamage libxext \
|
|
libxmu libxrender libxres libxtst libxxf86vm libavif libdecor \
|
|
hwdata luajit seatd sdl2-compat vulkan-icd-loader \
|
|
xcb-util-errors xcb-util-wm xorg-xwayland \
|
|
meson glm wayland-protocols benchmark libxcursor \
|
|
&& pacman -Scc --noconfirm
|
|
|
|
# bun builds the punktfunk-web console + the punktfunk-scripting runner AND is vendored
|
|
# as their runtime (PF_WITH_WEB=1 / PF_WITH_SCRIPTING=1); it's AUR-only on Arch, so
|
|
# bootstrap the official binary — once, here, instead of per run.
|
|
RUN curl -fsSL https://bun.sh/install | bash \
|
|
&& install -m0755 /root/.bun/bin/bun /usr/local/bin/bun \
|
|
&& rm -rf /root/.bun \
|
|
&& bun --version
|
|
|
|
# Shared compile cache: jobs set RUSTC_WRAPPER=sccache (backend = RustFS S3 on the LAN,
|
|
# see .gitea/workflows — the env lives there so dev use of this image stays uncached).
|
|
ARG SCCACHE_VERSION=0.10.0
|
|
RUN curl -fsSL "https://github.com/mozilla/sccache/releases/download/v${SCCACHE_VERSION}/sccache-v${SCCACHE_VERSION}-x86_64-unknown-linux-musl.tar.gz" \
|
|
| tar -xz --wildcards --strip-components=1 -C /usr/local/bin '*/sccache' \
|
|
&& sccache --version
|