Repository navigation
CI: manual no-cache rebuild, Node 24 actions, pipx Poetry - #461
Merged
Merged
Conversation
- Add workflow_dispatch with a no_cache input (default true) so a manual run rebuilds without layer cache, re-runs apt-get upgrade and pushes. - Key venv caches on the exact Python version from setup-python, so a new patch release does not restore a stale venv. - Install Poetry with pipx instead of the unpinned snok/install-poetry action, and drop the ~/.local Poetry cache. - Bump all actions to their Node 24 majors. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This was referenced Oct 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ports the CI work from OperationCode/back-end#412 to pybot.
Changes
Manual rebuild: add
workflow_dispatchwith a booleanno_cacheinput (defaulttrue). A dispatch run builds and pushes (:prod/:latestfrommaster,:stagingfrom other refs). Withno_cache, build-push-action getsno-cache: trueandpull: true, soapt-get upgraderuns again and picks up Debian security fixes when nothing in the repo changed.Venv cache key:
actions/setup-pythonhasid: setup-python. The venv caches usesteps.setup-python.outputs.python-version(for example3.14.x), not a hardcoded3.14. A stale venv from an older patch release no longer breaks CI with "Command not found".Poetry install: replace the unpinned third-party
snok/install-poetry@v1withpipx install "poetry==$POETRY_VERSION"on the setup-python interpreter. The~/.localPoetry cache step is removed.Node 24 actions:
docker/* and aws-actions/* stay on major tags, not SHAs (accepted risk).
Release notes review
No breaking change affects the inputs we use:
pull_request_target/workflow_run. We use neither.pip-install. Not used. Outputspython-versionandpython-pathstill exist.platformsstill exists.DOCKER_BUILD_NO_SUMMARY/DOCKER_BUILD_EXPORT_RETENTION_DAYSenvs. Not used.no-cacheandpullexist.files,fail_ci_if_error,verbosestill exist.Checks
poetry.lockonly as optional extras ofaiohttp[speedups]andurllib3[brotli], which are not installed.ubuntu-latestto Ubuntu 26 notice).--no-cache --pull, linux/arm64),docker scout cves --only-severity critical,high: 0 critical, 1 high: CVE-2026-85091 inzlib 1:1.3.dfsg+really1.3.1-1, no Debian fix yet. The image has nolibbrotli1,curl,brotliorbrotlicffi.Dependabot
This PR supersedes the action bumps in #458, #455, #451, #450 and #449.
🤖 Generated with Claude Code