CI: nightly build hygiene + fix leftover runner directories - #448
Merged
Conversation
The nightly workflow ran unconditionally on every scheduled trigger, rebuilding and republishing identical packages even when master hadn't moved since the last nightly build (observed: daily reruns from 2026-06-23 through 2026-07-01 with zero new commits in that window). Add a CheckForChanges job that compares master's HEAD against the commit the "nightly" tag currently points to, and skip GenerateNightly when they match. Manual workflow_dispatch runs always proceed.
GitHub already auto-generates source tarballs for every tag, including the "nightly" tag this workflow publishes to, making the make sourcegz step and its output pure duplication.
Debian-riscv64's Cleanup step only pruned Docker images and never removed its own checkout directory, leaking it on every single run. Debian-arm64/Debian-armhf had the same gap, deferring removal to FunctionalTest-arm64/armhf downstream - but those jobs only run on push events, so every pull_request run left the directory behind. Debian-riscv64 now always removes its directory; Debian-arm64/armhf only self-clean on non-push events, preserving the push-path .deb reuse optimization for the FunctionalTest-* jobs.
Historical workflow changes (e.g. a since-deleted cross-arch QEMU workflow with a buggy cleanup condition) have left directories on the runner that no current workflow can ever clean up, and any future cleanup-step authoring bug of the same shape would silently leak forever with nothing catching it. Sweeps ~ for directories matching pam_usb_*<digits> older than 3 hours. The pattern deliberately excludes anything not ending in a digit, so the hand-maintained pam_usb_reprovision checkout and the persistent pam_usb clone are never touched.
mcdope
added
enhancement
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.tar.gzsource package from nightly builds, since GitHub already auto-generates source tarballs for every tag it publishes to (includingnightly).Debian-riscv64's Cleanup step never actually removed its checkout directory (leaked on every run), andDebian-arm64/Debian-armhfdeferred cleanup to downstreamFunctionalTest-*jobs that only run onpush, so everypull_requestrun left those directories behind permanently.pam_usb_*<digits>directories older than 3 hours, as a safety net against future cleanup-step bugs of the same shape (a similar gap in a now-deleted workflow is why the runner had accumulated ~800MB/165 directories going back to May, since manually cleared as a one-time sweep).Why this approach
nightlytag currently points to (via the GitHub API), rather than anything more complex, since that's exactly what "has anything changed since last nightly" means operationally.pushevents (rather than always self-cleaning, or makingFunctionalTest-*unconditional) was chosen specifically to preserve the deliberate push-path optimization where those jobs reuse the already-built.debinstead of rebuilding it.pam_usb_*ending in a digit) rather than an exclude-list, so it automatically stays safe against the hand-maintainedpam_usb_reprovisioncheckout and the persistentpam_usbclone without needing to know about them explicitly.Test plan
Debian-riscv64's directory is removed after a buildpam_usb_reprovisionand the barepam_usbclone.debreuse still working (FunctionalTest-arm64/FunctionalTest-armhffinding and reusing the existing.debrather than rebuilding) requires apush-triggered run after merge🤖 This PR was generated with the assistance of Claude Code (Sonnet 5).