Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 21 additions & 21 deletions .buildkite/scripts/build_packages.sh
Original file line number Diff line number Diff line change
Expand Up @@ -48,37 +48,36 @@ report_build_failure() {
}

build_packages() {
pushd packages > /dev/null || exit 1
local packages=""
local version=""
local name=""
local package_zip=""
local package_path=""

for it in $(find . -maxdepth 1 -mindepth 1 -type d); do
local package
local version
local name
package=$(basename "${it}")
echo "Package ${package}: check"
packages=$(list_all_directories)
for package_path in ${packages}; do
pushd "${package_path}" > /dev/null || exit 1
echo "Package \"${package_path}\": check"

pushd "${package}" > /dev/null || exit 1
version=$(yq .version manifest.yml)
name=$(yq .name manifest.yml)

version=$(cat manifest.yml | yq .version)
name=$(cat manifest.yml | yq .name)

local package_zip="${name}-${version}.zip"
package_zip="${name}-${version}.zip"

if is_already_published "${package_zip}" ; then
echo "Skipping. ${package_zip} already published"
popd > /dev/null
continue
fi

echo "Build package as zip: ${package}"
if check_and_build_package "${package}" ; then
echo "Build package as zip: ${package_path}"
if check_and_build_package "${package_path}" ; then
unpublished="true"
else
report_build_failure "${package}"
report_build_failure "${package_path}"
fi
popd > /dev/null || exit 1
done
popd > /dev/null || exit 1
}

if [ "${SKIP_PUBLISHING}" == "true" ] ; then
Expand All @@ -88,13 +87,13 @@ fi

if skipPublishing ; then
echo "packageStoragePublish: not the main branch or a backport branch, nothing will be published"
exit 0
# exit 0
fi
Comment on lines 88 to 91
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Medium scripts/build_packages.sh:88

When skipPublishing returns true, the script prints "nothing will be published" but continues executing instead of exiting. This causes the script to proceed through expensive build steps (tool installation, package building, artifact copying, pipeline generation) on branches that should skip publishing entirely, wasting resources and potentially causing side effects.

if skipPublishing ; then
    echo "packageStoragePublish: not the main branch or a backport branch, nothing will be published"
-    # exit 0
+    exit 0
 fi
🤖 Copy this AI Prompt to have your agent fix this:
In file .buildkite/scripts/build_packages.sh around lines 88-91:

When `skipPublishing` returns true, the script prints "nothing will be published" but continues executing instead of exiting. This causes the script to proceed through expensive build steps (tool installation, package building, artifact copying, pipeline generation) on branches that should skip publishing entirely, wasting resources and potentially causing side effects.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes related to debugging. It will be reverted before merging.


Comment on lines 87 to 92
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Medium scripts/build_packages.sh:87

When skipPublishing returns true, the script prints "nothing will be published" but continues executing instead of exiting. It proceeds to build packages, copy artifacts, and generate the signing/publishing pipeline YAML, wasting CI resources on non-main/non-backport branches. If the DRY_RUN or buildkite-agent pipeline upload guards are re-enabled later, packages could be signed and published from arbitrary feature branches.

@@ -88,5 +88,5 @@
 if skipPublishing ; then
     echo "packageStoragePublish: not the main branch or a backport branch, nothing will be published"
-    # exit 0
+    exit 0
 fi
 
 add_bin_path
🤖 Copy this AI Prompt to have your agent fix this:
In file .buildkite/scripts/build_packages.sh around lines 87-92:

When `skipPublishing` returns true, the script prints "nothing will be published" but continues executing instead of exiting. It proceeds to build packages, copy artifacts, and generate the signing/publishing pipeline YAML, wasting CI resources on non-main/non-backport branches. If the `DRY_RUN` or `buildkite-agent pipeline upload` guards are re-enabled later, packages could be signed and published from arbitrary feature branches.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes related to debugging. It will be reverted before merging.

add_bin_path

with_yq
with_go
with_mage
use_elastic_package

echo "--- Build packages"
Expand All @@ -117,7 +116,7 @@ cp "${BUILD_PACKAGES_FOLDER}"/*.zip "${ARTIFACTS_FOLDER}"/

if [ "${DRY_RUN}" == "true" ]; then
echo "DRY_RUN enabled. Publish packages steps skipped."
exit 0
# exit 0
fi

# triggering dynamically the steps for signing and publishing
Expand Down Expand Up @@ -148,7 +147,7 @@ steps:
env:
SIGNING_STEP_KEY: "sign-service"
ARTIFACTS_FOLDER: "packageArtifacts"
DRY_RUN: "${DRY_RUN}"
DRY_RUN: "true"
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Medium scripts/build_packages.sh:150

DRY_RUN is hardcoded to "true" on line 150, so the trigger_publish_packages.sh step always runs in dry-run mode regardless of the DRY_RUN environment variable value. Packages will never actually be published when the pipeline intends to run for real. Consider reverting to "${DRY_RUN}" to respect the environment variable.

Suggested change
DRY_RUN: "true"
DRY_RUN: "${DRY_RUN}"
🤖 Copy this AI Prompt to have your agent fix this:
In file .buildkite/scripts/build_packages.sh around line 150:

`DRY_RUN` is hardcoded to `"true"` on line 150, so the `trigger_publish_packages.sh` step always runs in dry-run mode regardless of the `DRY_RUN` environment variable value. Packages will never actually be published when the pipeline intends to run for real. Consider reverting to `"${DRY_RUN}"` to respect the environment variable.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes related to debugging. It will be reverted before merging.

agents:
image: "${LINUX_AGENT_IMAGE}"
cpu: "8"
Expand All @@ -158,4 +157,5 @@ steps:
allow_failure: false
EOF

buildkite-agent pipeline upload "${PIPELINE_FILE}"
cat "${PIPELINE_FILE}"
# buildkite-agent pipeline upload "${PIPELINE_FILE}"
Comment on lines 159 to +161
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Critical scripts/build_packages.sh:159

The buildkite-agent pipeline upload command is replaced with cat, so the pipeline that signs and publishes packages is never uploaded to Buildkite. Built packages will remain in artifacts but never reach the package registry.

 cat "${PIPELINE_FILE}"
-# buildkite-agent pipeline upload "${PIPELINE_FILE}"
+buildkite-agent pipeline upload "${PIPELINE_FILE}"
🤖 Copy this AI Prompt to have your agent fix this:
In file .buildkite/scripts/build_packages.sh around lines 159-161:

The `buildkite-agent pipeline upload` command is replaced with `cat`, so the pipeline that signs and publishes packages is never uploaded to Buildkite. Built packages will remain in artifacts but never reach the package registry.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a change to allow debugging the script safely. This will be reverted before merging the PR.

Loading
Loading