Skip to content

Patch release pipeline: Verify Omnibus packages are published

What does this MR do and why?

Describe in detail what your merge request does and why.

Content

  • Patch release pipeline: Verify Omnibus packages are published

Add a job to the patch release pipeline to check if the Omnibus packages are released.

Since this is patch release, each of the three versions are checked one by one.

Ref: gitlab-com/gl-infra/delivery#20430 (closed)

Testing

Pipeline creation

This was tested in this repo (gitlab-org/release-tools), just to see that the pipeline gets created as we expect it.

With SECURITY_RELEASE_PIPELINE=true

With SECURITY_RELEASE_PIPELINE='verify'

The new job check_omnibus_packages is a part of the stage security_release:verify

Screenshot 2024-09-03 at 21.15.29.png

As you can see, when creating just verify steps, the security_release:verify:start does not need to wait for security_release_publish:deploy_blog_post job, but is is still delayed for 30 minutes. This is acceptable IMO, since these jobs are just for verifying, so even if we leave it there and it starts automatically after the delay, it doesn't do anything harmful.

Screenshot 2024-09-03 at 21.25.12.png

Pipeline

Pipeline

Configuration testing

This was to test the configuration of the pipeline (the job order).

Checking the dependencies between jobs, we see that security_release_verify:start depends on security_release_publish:generate_jobs job. So, 30 minutes after the packages are published, the verification starts.

Screenshot 2024-09-04 at 15.24.36.png

Execution testing

This MR does not implement a new execution logic. It was done in !3333 (merged).

Edited by Dat Tang

Merge request reports

Loading