Skip to content

ci: add manually-triggered promote workflow - #10

Merged
gboutry merged 3 commits into
openstack-charmers:mainfrom
hemanthnakkina:add-github-workflow-promote
Sep 22, 2026
Merged

gboutry merged 3 commits into
openstack-charmers:mainfrom
hemanthnakkina:add-github-workflow-promote

Conversation

@hemanthnakkina

@hemanthnakkina hemanthnakkina commented Sep 16, 2026 •

Copy link
Copy Markdown
Collaborator

Currently sunbeam-release is triggered on local machines. Instead add a workflow that can be triggered to promote sunbeam snaps/charms.

  • workflow_dispatch with source, release and dry-run inputs
  • charmhub auth via CHARMHUB_AUTH secret (exported charmcraft credentials) passed to charmcraft as CHARMCRAFT_AUTH; falls back to local charmcraft login when unset
  • snap store auth via SNAPCRAFT_STORE_CREDENTIALS for snapcraft promote
  • revision list uploaded as workflow artifact
  • Fix snapcraft command to use non-interactive mode
  • Add environment promotion for promote job. This allows secrets can be maintained only in that environment and not accessible via other jobs.

QA steps:

  • Install act and nodejs on a virtual machine
  • Add environment variables for charmcraft and snapstore authentication as specified in README in a file (secrets)
  • Add arguments to a file in json format (event.json)
  • ../bin/act --artifact-server-path /tmp/artifacts -P ubuntu-latest=-self-hosted --secret-file secrets workflow_dispatch -e event.json

Links:
Jira card: OPEN-4773

@hmlanigan hmlanigan left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please update the description to include why this change is being made.

Comment thread .github/workflows/promote.yml
Comment thread .github/workflows/promote.yml Outdated
@hemanthnakkina

Copy link
Copy Markdown
Collaborator Author

On a VM, install act and nodejs

secrets flle

$ cat secrets
CHARMHUB_AUTH=<>
SNAPCRAFT_STORE_CREDENTIALS=<>

workflow input params

$ cat event.json
{"inputs": {"source": "beta", "release": "caracal", "dry-run": true}}

Workflow trigger:

$ ../bin/act --artifact-server-path /tmp/artifacts -P ubuntu-latest=-self-hosted --secret-file secrets workflow_dispatch -e event.json

Prepared 8 packages in 3.03s                                                                                                                                                            Installed 8 packages in 7ms                                                                                                                                                             |  + click==8.1.7                                                                                                                                                                       |  + iniconfig==2.3.0                                                                                                                                                                   |  + packaging==26.3                                                                                                                                                                    |  + pluggy==1.6.0                                                                                                                                                                      |  + pygments==2.21.0                                                                                                                                                                   |  + pytest==9.1.1                                                                                                                                                                      |  + ruff==0.16.7                                                                                                                                                                       |  + sunbeam-release==0.1.0 (from file:///home/ubuntu/.cache/act/fe44b867897fa03b/hostexecutor)                                                                                         [Promote/promote]   ✅  Success - Main uv sync [3.063066278s]                                                                                                                           [Promote/promote] ⭐ Run Main Install charmcraft, snapcraft and juju                                                                                                                    | snap "charmcraft" is already installed, see 'snap help refresh'                                                                                                                       | snap "snapcraft" is already installed, see 'snap help refresh'                                                                                                                        | snap "juju" is already installed, see 'snap help refresh'                                                                                                                             [Promote/promote]   ✅  Success - Main Install charmcraft, snapcraft and juju [125.113162ms]                                                                                            [Promote/promote] ⭐ Run Main Run promote                                                                                                                                               | Checking aodh-k8s: 2024.1/beta->2024.1/candidate                                                                                                                                      | Source and target revision match, skipping                                                                                                                                            | Source and target revision match, skipping                                                                                                                                            | Checking barbican-k8s: 2024.1/beta->2024.1/candidate                                                                                                                                  | Source and target revision match, skipping                                                                                                                                            | Source and target revision match, skipping                                                                                                                                            | Checking ceilometer-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping                                                                                                                                            | Source and target revision match, skipping                                                                                                                                            | Checking cinder-ceph-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping                                                                                                                                            | Source and target revision match, skipping                                                                                                                                            | Checking cinder-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping                                                                                                                                            | Source and target revision match, skipping                                                                                                                                            | Checking cinder-volume: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping                                                                                                                                            | Checking cinder-volume-ceph: 2024.1/beta->2024.1/candidate                                                                                                                            | Source and target revision match, skipping                                                                                                                                            | Checking cinder-volume-hitachi: 2024.1/beta->2024.1/candidate                                                                                                                         | Source and target revision match, skipping                                                                                                                                            | Checking cinder-volume-purestorage: 2024.1/beta->2024.1/candidate                                                                                                                     | Source and target revision match, skipping                                                                                                                                            | Checking cinder-volume-hpe3par: 2024.1/beta->2024.1/candidate                                                                                                                         | Source and target revision match, skipping                                                                                                                                            | Checking cinder-volume-infinidat: 2024.1/beta->2024.1/candidate                                                                                                                       | Source and target revision match, skipping                                                                                                                                            | Checking designate-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping                                                                                                                                            | Source and target revision match, skipping
| Checking epa-orchestrator: 2024.1/beta->2024.1/candidate                                                                                                                              | Source and target revision match, skipping                                                                                                                                            | Checking glance-k8s: 2024.1/beta->2024.1/candidate                                                                                                                                    | Source and target revision match, skipping
| Source and target revision match, skipping
| Checking gnocchi-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking heat-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking horizon-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking ironic-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Checking ironic-conductor-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Checking keystone-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking keystone-ldap-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking keystone-saml-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Checking magnum-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking manila-cephfs-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Checking manila-data: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Checking manila-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Checking masakari-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Checking neutron-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking neutron-baremetal-switch-config-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Checking neutron-generic-switch-config-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Checking nova-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking nova-ironic-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Checking octavia-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking openstack-exporter-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking openstack-hypervisor: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking openstack-images-sync-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking openstack-network-agents: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Checking openstack-port-cni-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Checking sunbeam-ovn-proxy: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Checking placement-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking sunbeam-clusterd: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking sunbeam-machine: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking tempest-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking watcher-k8s: 2024.1/beta->2024.1/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking ovn-relay-k8s: 24.03/beta->24.03/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking ovn-central-k8s: 24.03/beta->24.03/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking consul-k8s: 1.19/beta->1.19/candidate
| Source and target revision match, skipping
| Checking consul-client: 1.19/beta->1.19/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking rabbitmq-k8s: 3.12/beta->3.12/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking designate-bind-k8s: 9/beta->9/candidate
| Source and target revision match, skipping
| Source and target revision match, skipping
| Checking snap openstack: 2024.1/beta->2024.1/candidate
|   Source and target revision match (1101), skipping
| Checking snap openstack-hypervisor: 2024.1/beta->2024.1/candidate
|   Source and target revision match (694), skipping
| Checking snap cinder-volume: 2024.1/beta->2024.1/candidate
|   Source and target revision match (137), skipping
| Checking snap openstack-network-agents: 2024.1/beta->2024.1/candidate
|   Source and target revision match (109), skipping
| Checking snap manila-data: 2024.1/beta->2024.1/candidate
|   Source and target revision match (7), skipping
| Checking snap epa-orchestrator: 2024.1/beta->2024.1/candidate
|   Source and target revision match (43), skipping
| Checking snap consul-client: 1.19/beta->1.19/candidate
|   Source and target revision match (24), skipping
| Checking dependent charm mysql-k8s: 8.0/stable
| Checking dependent charm mysql-router-k8s: 8.0/stable
| Checking dependent charm traefik-k8s: latest/stable
| Checking dependent charm vault-k8s: 1.18/stable
| Checking dependent charm self-signed-certificates: 1/stable
| Checking dependent charm manual-tls-certificates: 1/stable
| Checking dependent charm opentelemetry-collector: 2/stable
| Checking dependent charm opentelemetry-collector-k8s: 2/stable
| Checking dependent charm kratos-external-idp-integrator: 0.2/stable
| Checking dependent charm microceph: squid/stable
| Checking dependent charm microovn: 24.03/stable
| Checking dependent charm microcluster-token-distributor: v1/stable
| Checking dependent charm role-distributor: latest/stable
| Checking dependent charm multus: latest/stable
| Checking dependent charm alertmanager-k8s: 1/stable
| Checking dependent charm grafana-k8s: 1/stable
| Checking dependent charm catalogue-k8s: 1/stable
| Checking dependent charm prometheus-k8s: 1/stable
| Checking dependent charm loki-k8s: 1/stable
| Checking dependent charm hardware-observer: latest/stable
| Checking dependent snap microceph: squid/stable
| Checking dependent snap microovn: 24.03/stable
| Checking dependent snap k8s: 1.32-classic/stable
| Revision table written to caracal-beta-to-candidate-2026-09-17_03-00-24.txt
| Revision yaml written to caracal-beta-to-candidate-2026-09-17_03-00-24.yaml
[Promote/promote]   ✅  Success - Main Run promote [2m7.093547877s]
[Promote/promote] ⭐ Run Main Upload revision list
| With the provided path, there will be 3 files uploaded
| Artifact name is valid!
| Root directory input is valid!
| Beginning upload of artifact content to blob storage
| Uploaded bytes 2784
| Finished uploading artifact content to blob storage!
| SHA256 digest of uploaded artifact zip is ce2e7850f22f47e458c54cd0a0ed9b6cf267bec5e3a6a13832077c5136741f51
| Finalizing artifact upload
| Artifact revision-list.zip successfully finalized. Artifact ID 4040296119
| Artifact revision-list has been successfully uploaded! Final size is 2784 bytes. Artifact ID is 4040296119
| Artifact download URL: https://github.com/hemanthnakkina/sunbeam-release/actions/runs/1/artifacts/4040296119
[Promote/promote]   ✅  Success - Main Upload revision list [496.561472ms]
[Promote/promote]   ⚙  ::set-output:: artifact-digest=ce2e7850f22f47e458c54cd0a0ed9b6cf267bec5e3a6a13832077c5136741f51
[Promote/promote]   ⚙  ::set-output:: artifact-url=https://github.com/hemanthnakkina/sunbeam-release/actions/runs/1/artifacts/4040296119
[Promote/promote]   ⚙  ::set-output:: artifact-id=4040296119
[Promote/promote] ⭐ Run Post astral-sh/setup-uv@v5
| Pruning cache...
| Saving cache path: /home/ubuntu/.cache/act/fe44b867897fa03b/tmp/setup-uv-cache
| [command]/usr/bin/tar --posix -cf cache.tzst --exclude cache.tzst -P -C /home/ubuntu/.cache/act/fe44b867897fa03b/hostexecutor --files-from manifest.txt --use-compress-program zstdmt
| Cache Size: ~0 MB (177323 B)
| Cache saved successfully
| cache saved with the key: setup-uv-1-x86_64-unknown-linux-gnu-3.12.3-a7a4f6ad31165cc49d60dae6938d62a30d5a53b64ae83300c82bf9228135a679
[Promote/promote]   ✅  Success - Post astral-sh/setup-uv@v5 [271.081667ms]
[Promote/promote] ⭐ Run Complete job
[Promote/promote] Cleaning up container for job promote
[Promote/promote]   ✅  Success - Complete job
[Promote/promote] 🏁  Job succeeded

Artifacts:

$ ls /tmp/artifacts/1/revision-list/
revision-list.zip

Unzip artifcats:

$ ls
caracal-beta-to-candidate-2026-09-17_03-00-24.txt  caracal-beta-to-candidate-2026-09-17_03-00-24.yaml

- workflow_dispatch with source, release and dry-run inputs
- charmhub auth via CHARMHUB_AUTH secret (exported charmcraft
  credentials) passed to charmcraft as CHARMCRAFT_AUTH; falls back
  to local charmcraft login when unset
- snap store auth via SNAPCRAFT_STORE_CREDENTIALS for snapcraft
  promote
- revision list uploaded as workflow artifact
@hemanthnakkina
hemanthnakkina force-pushed the add-github-workflow-promote branch from ecb9586 to 52810e3 Compare September 17, 2026 03:16
snapcraft promote command is interactive and asks
user for y/N. Make it non-interactive by passing
--yes argument to snapcraft promote command

Signed-off-by: Hemanth Nakkina <hemanth.nakkina@canonical.com>
@hemanthnakkina

Copy link
Copy Markdown
Collaborator Author

Please update the description to include why this change is being made.

Thanks for the review. Description updated

The secrets are maintained as part of environment
promotion and hence add the same in the github workflow.

Signed-off-by: Hemanth Nakkina <hemanth.nakkina@canonical.com>
@gboutry

gboutry commented Sep 22, 2026

Copy link
Copy Markdown
Collaborator

Can we get an example of caracal-beta-to-candidate-2026-09-17_03-00-24.yaml or like that?

I'd like to see exactly what's promoted. I'm interested to see if we have resource revisions in this manifest

@hemanthnakkina

hemanthnakkina commented Sep 22, 2026 •

Copy link
Copy Markdown
Collaborator Author

Can we get an example of caracal-beta-to-candidate-2026-09-17_03-00-24.yaml or like that?

I'd like to see exactly what's promoted. I'm interested to see if we have resource revisions in this manifest

I dont have those results for this run But there is one in PR #9 description

@hemanthnakkina

Copy link
Copy Markdown
Collaborator Author

Can we get an example of caracal-beta-to-candidate-2026-09-17_03-00-24.yaml or like that?
I'd like to see exactly what's promoted. I'm interested to see if we have resource revisions in this manifest

I dont have those results for this run But there is one in PR #9 description

And we do not have resource revisions. I do not think we require resource revisions in this file because any resource revision change, we should always update the charm revision during publish.

@gboutry

gboutry commented Sep 22, 2026

Copy link
Copy Markdown
Collaborator

Ok; thanks. then it's alright for this PR.

And we do not have resource revisions. I do not think we require resource revisions in this file because any resource revision change, we should always update the charm revision during publish.

What about SRU and bug fixes that are package only? We need to test with a charm,but do we need to publish a new charm revision for that? We don't do the same for snaps updates

@gboutry
gboutry merged commit b0c7ea0 into openstack-charmers:main Sep 22, 2026
1 check passed
@hemanthnakkina

hemanthnakkina commented Sep 22, 2026 •

Copy link
Copy Markdown
Collaborator Author

Ok; thanks. then it's alright for this PR.

And we do not have resource revisions. I do not think we require resource revisions in this file because any resource revision change, we should always update the charm revision during publish.

What about SRU and bug fixes that are package only? We need to test with a charm,but do we need to publish a new charm revision for that? We don't do the same for snaps updates

For package fixes

  • charms - we built rock and then we always built charm, so this will result in new revision.
  • snaps - snap needs to be rebuilt to get latest package, so we are good here as well.

@gboutry

gboutry commented Sep 22, 2026

Copy link
Copy Markdown
Collaborator

built rock and then we always built charm, so this will result in new revision.

no, not for SRU and CVE that needs fast publishing. Let's discuss that on the later sync

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants