You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
…refix
- Set CVMFS publish location to unpacked.cern.ch/ghcr.io/eic/mac_<env>:nightly
- Phase 1: Build packages into /opt/software with 128-byte padding and populate local/remote buildcaches
- Phase 2: Relocate and install environment specs from buildcache into target prefix with colons in path
- Hardcode tag to nightly for testing deployment to unpacked.cern.ch
- Job 1 (build): Builds missing packages into /opt/software with padding and autopushes to GHCR buildcache
- Job 2 (install): Installs environment specs from network buildcache into CVMFS target prefix, regenerates views, tests, and publishes container image
- Only the remote buildcache serves as intermediary between the jobs
…as artifacts
- Use actions/cache@v4 for Spack repositories across jobs
- Use actions/cache@v4 for Spack concretization cache (~/.spack/cache/concretization)
- Upload spack.lock files as workflow artifacts in build job
- Download lockfiles in install job and skip concretization entirely
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
The macOS workflow’s lockfile download path is very likely to produce a nested directory layout and break subsequent steps, so the CI workflow would not function as intended.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
The new macOS workflow’s publish step can overwrite nightly from unmerged PR runs and currently publishes a macOS-built tree as a linux/arm64 OCI image, which is operationally unsafe/misleading.
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
The new macOS workflow and buildcache-check script include reliability gaps (silent patching, inconsistent install-tree config, and missing exception handling) that can cause hard-to-diagnose CI failures or unnecessary full rebuilds.
The build job configures config:install_tree:padded_length:128, but the install/publish job does not. If buildcache entries rely on padded prefixes for relocation, installs in the second job may be more likely to hit relocation failures.
Add the same padded_length setting in the install job for consistency with the build job's install tree configuration.
Handle per-spec registry query failures in thread pool
scripts/check-buildcache.py:49
_oci_get_blob_info(ref) is called inside a ThreadPoolExecutor without any exception handling. If one query hits a transient registry/auth/network error, pool.map(...) will raise and abort the whole check, causing CI to fall back to a full spack install even when most specs are already present in the buildcache.
Catch exceptions per-spec and treat failures as "missing" (and optionally warn), so the script degrades gracefully and still produces a usable rebuild list.
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
The new macOS workflow and buildcache-check helper need small robustness fixes (CVMFS mount verification and per-spec OCI lookup error handling) to avoid brittle CI failures.
Check /cvmfs availability before using it as install prefix
.github/workflows/macos-ci.yml:518
The /cvmfs firmlink setup ignores failures and does not verify that /cvmfs is actually available before constructing INSTALL_PREFIX under /cvmfs. On macOS runners, synthetic.conf changes can require a reboot; if /cvmfs isn't present, the later mkdir under ${INSTALL_PREFIX} can fail with a confusing error. Add an explicit check/fallback after apfs.util so the workflow uses a writable base path deterministically.
Handle registry lookup failures without crashing the script
scripts/check-buildcache.py:42
Registry lookups in the thread pool can raise (network/auth/transient OCI errors), which will currently fail the entire script with a traceback. Since the workflow already has a fallback path on nonzero status, it's more robust to catch per-spec lookup errors, log a warning, and treat that spec as missing (or at least avoid crashing).
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
The macOS workflow currently risks producing misleading/potentially unsafe artifacts (Linux-labeled image containing macOS build output and a PATH rewrite that can introduce an empty PATH element).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds a GitHub Actions workflow to build the
ci,tf, andxlenvironments on macOS.Features
ci,tf, andxlenvironments