Skip to content

ci: resolve contrib repo SHA once for hermetic CI #5625

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mwimpelberg28 wants to merge 4 commits into
base: main
Choose a base branch
from
Open

ci: resolve contrib repo SHA once for hermetic CI #5625

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f396376
ci: resolve contrib repo SHA once for hermetic CI
mwimpelberg28 Sep 4, 2026
4a3efae
Add changelog fragment for #5625
mwimpelberg28 Sep 4, 2026
46402c3
ci: retrigger CI after transient Windows runner flake
mwimpelberg28 Sep 6, 2026
f91cdb0
Merge branch 'main' into infra/hermetic-contrib-sha
mwimpelberg28 Sep 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .changelog/5625.changed
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
`ci`: resolve the contrib repo commit SHA once per CI run instead of recomputing a branch-name reference in each workflow, avoiding non-hermetic mismatches between jobs
41 changes: 36 additions & 5 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,21 +18,52 @@ concurrency:
cancel-in-progress: true

jobs:
resolve-contrib-sha:
name: Resolve contrib repo SHA
runs-on: ubuntu-latest
permissions:
contents: read
outputs:
sha: ${{ steps.resolve.outputs.sha }}
env:
# Set the ref to the branch name if the PR has a label 'prepare-release' or 'backport' otherwise, set it to 'main'
# For PRs you can change the inner fallback ('main')
# For pushes you change the outer fallback ('main')
# The logic below is used during releases and depends on having an equivalent branch name in the contrib repo.
CONTRIB_REPO_REF: ${{ github.event_name == 'pull_request' && (
contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
'main'
) || 'main' }}
steps:
- name: Resolve ${{ env.CONTRIB_REPO_REF }} to a commit SHA
id: resolve
run: |
SHA="$(git ls-remote https://github.com/open-telemetry/opentelemetry-python-contrib "refs/heads/${CONTRIB_REPO_REF}" | cut -f1)"
if [ -z "$SHA" ]; then
echo "::error::Could not resolve contrib branch '${CONTRIB_REPO_REF}' to a commit SHA"
exit 1
fi
echo "sha=$SHA" >> "$GITHUB_OUTPUT"

misc:
needs: resolve-contrib-sha
uses: ./.github/workflows/misc.yml
with:
contrib-repo-sha: ${{ needs.resolve-contrib-sha.outputs.sha }}
lint:
uses: ./.github/workflows/lint.yml
tests:
needs: resolve-contrib-sha
uses: ./.github/workflows/test.yml
with:
contrib-repo-sha: ${{ needs.resolve-contrib-sha.outputs.sha }}
contrib:
needs: resolve-contrib-sha
uses: open-telemetry/opentelemetry-python-contrib/.github/workflows/core_contrib_test.yml@main
with:
CORE_REPO_SHA: ${{ github.sha }}
CONTRIB_REPO_SHA: ${{ github.event_name == 'pull_request' && (
contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
'main'
) || 'main' }}
CONTRIB_REPO_SHA: ${{ needs.resolve-contrib-sha.outputs.sha }}

check:
if: always()
Expand Down
10 changes: 0 additions & 10 deletions .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,16 +10,6 @@ permissions:
contents: read

env:
CORE_REPO_SHA: main
# Set the SHA to the branch name if the PR has a label 'prepare-release' or 'backport' otherwise, set it to 'main'
# For PRs you can change the inner fallback ('main')
# For pushes you change the outer fallback ('main')
# The logic below is used during releases and depends on having an equivalent branch name in the contrib repo.
CONTRIB_REPO_SHA: ${{ github.event_name == 'pull_request' && (
contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
'main'
) || 'main' }}
PIP_EXISTS_ACTION: w

jobs:
Expand Down
16 changes: 6 additions & 10 deletions .github/workflows/misc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,21 +5,17 @@ name: Misc

on:
workflow_call:
inputs:
contrib-repo-sha:
description: Commit SHA in the contrib repo to check out for jobs that need it.
required: true
type: string

permissions:
contents: read

env:
CORE_REPO_SHA: main
# Set the SHA to the branch name if the PR has a label 'prepare-release' or 'backport' otherwise, set it to 'main'
# For PRs you can change the inner fallback ('main')
# For pushes you change the outer fallback ('main')
# The logic below is used during releases and depends on having an equivalent branch name in the contrib repo.
CONTRIB_REPO_SHA: ${{ github.event_name == 'pull_request' && (
contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
'main'
) || 'main' }}
CONTRIB_REPO_SHA: ${{ inputs.contrib-repo-sha }}
PIP_EXISTS_ACTION: w
CONTRIB_REPO_UTIL_HTTP: ${{ github.workspace }}/opentelemetry-python-contrib/util/opentelemetry-util-http
CONTRIB_REPO_INSTRUMENTATION: ${{ github.workspace }}/opentelemetry-python-contrib/opentelemetry-instrumentation
Expand Down
41 changes: 36 additions & 5 deletions .github/workflows/templates/ci.yml.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,21 +18,52 @@ concurrency:
cancel-in-progress: true

jobs:
resolve-contrib-sha:
name: Resolve contrib repo SHA
runs-on: ubuntu-latest
permissions:
contents: read
outputs:
sha: ${% raw %}{{ steps.resolve.outputs.sha }}{% endraw %}
env:
# Set the ref to the branch name if the PR has a label 'prepare-release' or 'backport' otherwise, set it to 'main'
# For PRs you can change the inner fallback ('main')
# For pushes you change the outer fallback ('main')
# The logic below is used during releases and depends on having an equivalent branch name in the contrib repo.
CONTRIB_REPO_REF: {% raw %}${{ github.event_name == 'pull_request' && (
contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
'main'
) || 'main' }}{% endraw %}
steps:
- name: Resolve ${% raw %}{{ env.CONTRIB_REPO_REF }}{% endraw %} to a commit SHA
id: resolve
run: |
SHA="$(git ls-remote https://github.com/open-telemetry/opentelemetry-python-contrib "refs/heads/${CONTRIB_REPO_REF}" | cut -f1)"
if [ -z "$SHA" ]; then
echo "::error::Could not resolve contrib branch '${CONTRIB_REPO_REF}' to a commit SHA"
exit 1
fi
echo "sha=$SHA" >> "$GITHUB_OUTPUT"

misc:
needs: resolve-contrib-sha
uses: ./.github/workflows/misc.yml
with:
contrib-repo-sha: ${% raw %}{{ needs.resolve-contrib-sha.outputs.sha }}{% endraw %}
lint:
uses: ./.github/workflows/lint.yml
tests:
needs: resolve-contrib-sha
uses: ./.github/workflows/test.yml
with:
contrib-repo-sha: ${% raw %}{{ needs.resolve-contrib-sha.outputs.sha }}{% endraw %}
contrib:
needs: resolve-contrib-sha
uses: open-telemetry/opentelemetry-python-contrib/.github/workflows/core_contrib_test.yml@main

@emdneto emdneto Sep 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The major problem is still this, where we can't pass a dynamic value for the reusable workflow

with:
CORE_REPO_SHA: ${% raw %}{{ github.sha }}{% endraw %}
CONTRIB_REPO_SHA: {% raw %}${{ github.event_name == 'pull_request' && (
contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
'main'
) || 'main' }}{% endraw %}
CONTRIB_REPO_SHA: ${% raw %}{{ needs.resolve-contrib-sha.outputs.sha }}{% endraw %}

check:
if: always()
Expand Down
10 changes: 0 additions & 10 deletions .github/workflows/templates/lint.yml.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,16 +10,6 @@ permissions:
contents: read

env:
CORE_REPO_SHA: main
# Set the SHA to the branch name if the PR has a label 'prepare-release' or 'backport' otherwise, set it to 'main'
# For PRs you can change the inner fallback ('main')
# For pushes you change the outer fallback ('main')
# The logic below is used during releases and depends on having an equivalent branch name in the contrib repo.
CONTRIB_REPO_SHA: {% raw %}${{ github.event_name == 'pull_request' && (

@emdneto emdneto Sep 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't we need CONTRIB_REPO_SHA in lint?

@emdneto emdneto Sep 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm pretty sure we use CONTRIB_REPO_SHA in tox.ini, otherwise, CI will fail during releases.

contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
'main'
) || 'main' }}{% endraw %}
PIP_EXISTS_ACTION: w

jobs:
Expand Down
16 changes: 6 additions & 10 deletions .github/workflows/templates/misc.yml.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,21 +5,17 @@ name: Misc

on:
workflow_call:
inputs:
contrib-repo-sha:
description: Commit SHA in the contrib repo to check out for jobs that need it.
required: true
type: string

permissions:
contents: read

env:
CORE_REPO_SHA: main
# Set the SHA to the branch name if the PR has a label 'prepare-release' or 'backport' otherwise, set it to 'main'
# For PRs you can change the inner fallback ('main')
# For pushes you change the outer fallback ('main')
# The logic below is used during releases and depends on having an equivalent branch name in the contrib repo.
CONTRIB_REPO_SHA: {% raw %}${{ github.event_name == 'pull_request' && (
contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
'main'
) || 'main' }}{% endraw %}
CONTRIB_REPO_SHA: {% raw %}${{ inputs.contrib-repo-sha }}{% endraw %}
PIP_EXISTS_ACTION: w
CONTRIB_REPO_UTIL_HTTP: ${% raw %}{{ github.workspace }}{% endraw %}/opentelemetry-python-contrib/util/opentelemetry-util-http
CONTRIB_REPO_INSTRUMENTATION: ${% raw %}{{ github.workspace }}{% endraw %}/opentelemetry-python-contrib/opentelemetry-instrumentation
Expand Down
16 changes: 6 additions & 10 deletions .github/workflows/templates/test.yml.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,21 +5,17 @@ name: Test

on:
workflow_call:
inputs:
contrib-repo-sha:
description: Commit SHA in the contrib repo to check out for jobs that need it.
required: true
type: string

permissions:
contents: read

env:
CORE_REPO_SHA: main
# Set the SHA to the branch name if the PR has a label 'prepare-release' or 'backport' otherwise, set it to 'main'
# For PRs you can change the inner fallback ('main')
# For pushes you change the outer fallback ('main')
# The logic below is used during releases and depends on having an equivalent branch name in the contrib repo.
CONTRIB_REPO_SHA: {% raw %}${{ github.event_name == 'pull_request' && (
contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
'main'
) || 'main' }}{% endraw %}
CONTRIB_REPO_SHA: {% raw %}${{ inputs.contrib-repo-sha }}{% endraw %}
WEAVER_VERSION: "v0.25.1"
PIP_EXISTS_ACTION: w
CONTRIB_REPO_UTIL_HTTP: ${% raw %}{{ github.workspace }}{% endraw %}/opentelemetry-python-contrib/util/opentelemetry-util-http
Expand Down
16 changes: 6 additions & 10 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,21 +5,17 @@ name: Test

on:
workflow_call:
inputs:
contrib-repo-sha:
description: Commit SHA in the contrib repo to check out for jobs that need it.
required: true
type: string

permissions:
contents: read

env:
CORE_REPO_SHA: main
# Set the SHA to the branch name if the PR has a label 'prepare-release' or 'backport' otherwise, set it to 'main'
# For PRs you can change the inner fallback ('main')
# For pushes you change the outer fallback ('main')
# The logic below is used during releases and depends on having an equivalent branch name in the contrib repo.
CONTRIB_REPO_SHA: ${{ github.event_name == 'pull_request' && (
contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
'main'
) || 'main' }}
CONTRIB_REPO_SHA: ${{ inputs.contrib-repo-sha }}
WEAVER_VERSION: "v0.25.1"
PIP_EXISTS_ACTION: w
CONTRIB_REPO_UTIL_HTTP: ${{ github.workspace }}/opentelemetry-python-contrib/util/opentelemetry-util-http
Expand Down
Loading