From f374e228ff41b95b0be8b6d08349f91a54080632 Mon Sep 17 00:00:00 2001 From: Dennis Klein Date: Mon, 8 Jun 2026 22:57:39 +0200 Subject: [PATCH] ci: cache gcc as a buildcache node instead of committed lockfiles Committed lockfiles pinned gcc as a host-path external (from spack compiler find), which is not portable across runners and broke CI. Cache the gcc compiler itself as a buildcache node instead, so CI pulls it (~1 min) rather than building it from source (~1 h). - push the freshly-built gcc node in setup-deps BEFORE spack compiler find (which marks it external and excludes it from buildcache push), gated behind a push-gcc input used only by the buildcache workflow - drop the committed-lockfile approach: remove test/ci/locks, the lockfile install path in setup-deps, and the lockfile export in the buildcache workflow - drop the ignored ref input from setup-spack (v3 renamed it to spack_ref) --- .github/actions/setup-deps/action.yml | 54 ++++++++------------------- .github/workflows/buildcache.yml | 18 +-------- test/ci/locks/README.md | 21 ----------- 3 files changed, 17 insertions(+), 76 deletions(-) delete mode 100644 test/ci/locks/README.md diff --git a/.github/actions/setup-deps/action.yml b/.github/actions/setup-deps/action.yml index 649a51e4..81b94054 100644 --- a/.github/actions/setup-deps/action.yml +++ b/.github/actions/setup-deps/action.yml @@ -11,6 +11,12 @@ inputs: fresh: description: 'Use fresh concretization' default: 'false' + push-gcc: + description: 'Push the freshly-built gcc node to the buildcache (buildcache workflow only)' + default: 'false' + push-token: + description: 'Token with packages:write, required when push-gcc is true' + default: '' runs: using: composite @@ -20,7 +26,6 @@ runs: - name: Setup spack uses: spack/setup-spack@v3 with: - ref: v1.1.0 color: true buildcache: true @@ -35,43 +40,29 @@ runs: shell: spack-bash {0} run: | echo "::group::Add FairMQ buildcache mirror" - # Register the mirror globally (the env yamls only configure it inside the - # env, which is created *after* gcc is installed) so that the "Install GCC" - # step below can pull the compiler as a binary instead of building it from - # source (~58 min/job otherwise). spack mirror add --unsigned --type binary \ ghcr-buildcache oci://ghcr.io/fairrootgroup/fairmq-spack-buildcache echo "::endgroup::" - - name: Resolve lockfile - id: lock - shell: bash - run: | - # Prefer a committed, fully-concretized lockfile so the hashes match the - # binaries the buildcache pushed (guaranteed cache hits, no re-solve). - # Fresh runs (the buildcache itself) must re-concretize, so skip the lock. - lock="test/ci/locks/${{ inputs.env }}-gcc${{ inputs.gcc }}.lock" - if [ "${{ inputs.fresh }}" != "true" ] && [ -f "$lock" ]; then - echo "Using committed lockfile: $lock" - echo "use=true" >> "$GITHUB_OUTPUT" - echo "path=$lock" >> "$GITHUB_OUTPUT" - else - echo "No lockfile for ${{ inputs.env }}-gcc${{ inputs.gcc }}; concretizing from spec" - echo "use=false" >> "$GITHUB_OUTPUT" - fi - - name: Install GCC - if: steps.lock.outputs.use != 'true' shell: spack-bash {0} + env: + GITHUB_TOKEN: ${{ inputs.push-token }} run: | echo "::group::Install GCC" spack install ${{ inputs.fresh == 'true' && '--fresh' || '' }} gcc@${{ inputs.gcc }} target=x86_64_v3 gcc_hash=$(spack find --json gcc@${{ inputs.gcc }} target=x86_64_v3 | jq -r 'sort_by(.version | split(".") | map(tonumber)) | last | .hash') + if [ "${{ inputs.push-gcc }}" = "true" ]; then + # Push the gcc node now, BEFORE `spack compiler find` registers it as an + # external -- externals are excluded from `buildcache push`. This is what + # lets CI pull gcc from the cache (~1 min) instead of building it (~1 h). + spack mirror set --oci-username ${{ github.actor }} --oci-password-variable GITHUB_TOKEN ghcr-buildcache + spack buildcache push --unsigned ghcr-buildcache /$gcc_hash + fi spack compiler find "$(spack location -i /$gcc_hash)" echo "::endgroup::" - name: Install dependencies - if: steps.lock.outputs.use != 'true' shell: spack-bash {0} run: | echo "::group::Install dependencies" @@ -79,20 +70,5 @@ runs: spack -e fairmq add gcc@${{ inputs.gcc }} spack -e fairmq config add "packages:all:require:'%gcc@${{ inputs.gcc }}'" spack -e fairmq install --fail-fast ${{ inputs.fresh == 'true' && '--fresh' || '' }} - echo "::endgroup::" - - - name: Install dependencies (from lockfile) - if: steps.lock.outputs.use == 'true' - shell: spack-bash {0} - run: | - echo "::group::Install dependencies (from lockfile)" - spack env create fairmq ${{ steps.lock.outputs.path }} - spack -e fairmq install --fail-fast - echo "::endgroup::" - - - name: Export environment - shell: spack-bash {0} - run: | - echo "::group::Export environment" spack env activate --sh fairmq | grep '^export ' | sed 's/^export //;s/;$//' >> $GITHUB_ENV echo "::endgroup::" diff --git a/.github/workflows/buildcache.yml b/.github/workflows/buildcache.yml index 26e03cbf..955eafd5 100644 --- a/.github/workflows/buildcache.yml +++ b/.github/workflows/buildcache.yml @@ -40,6 +40,8 @@ jobs: gcc: ${{ matrix.gcc }} env: ${{ matrix.env }} fresh: 'true' + push-gcc: 'true' + push-token: ${{ secrets.GITHUB_TOKEN }} - name: Push to buildcache if: ${{ !cancelled() }} @@ -50,21 +52,6 @@ jobs: spack -e fairmq mirror set --oci-username ${{ github.actor }} --oci-password-variable GITHUB_TOKEN ghcr-buildcache spack -e fairmq buildcache push --unsigned ghcr-buildcache - - name: Export lockfile - if: ${{ !cancelled() }} - shell: spack-bash {0} - run: | - mkdir -p test/ci/locks - cp "$(spack location -e fairmq)/spack.lock" \ - "test/ci/locks/${{ matrix.env }}-gcc${{ matrix.gcc }}.lock" - - - name: Upload lockfile - if: ${{ !cancelled() }} - uses: actions/upload-artifact@v4 - with: - name: lock-${{ matrix.env }}-gcc${{ matrix.gcc }} - path: test/ci/locks/${{ matrix.env }}-gcc${{ matrix.gcc }}.lock - update-index: if: github.repository == 'FairRootGroup/FairMQ' && !cancelled() needs: build @@ -79,7 +66,6 @@ jobs: - name: Setup spack uses: spack/setup-spack@v3 with: - ref: v1.1.0 color: true - name: Update buildcache index diff --git a/test/ci/locks/README.md b/test/ci/locks/README.md deleted file mode 100644 index 1d81ebf1..00000000 --- a/test/ci/locks/README.md +++ /dev/null @@ -1,21 +0,0 @@ -# Committed spack lockfiles - -`setup-deps` installs from `-gcc.lock` here when a matching file exists, -skipping concretization so the resolved hashes match the binaries the buildcache -pushed (guaranteed cache hits). When no lockfile is present it falls back to -concretizing from `test/ci/spack-.yaml`. - -## Regenerating - -Lockfiles pin host externals (glibc, system gcc), so they must be concretized on -the same runner image CI uses (`ubuntu-24.04`) — do **not** generate them on a -local machine. - -1. Run the `Spack Buildcache` workflow (push to `dev`/`master` touching the spack - configs, or `workflow_dispatch`). It concretizes fresh (`fresh: 'true'`), - pushes binaries, and uploads each env's `spack.lock` as a `lock--gcc` - artifact. -2. Download the artifacts and commit them here as `-gcc.lock`. - -Regenerate whenever the specs in `test/ci/spack-*.yaml` change or the runner -image is bumped.