vh
920f37c6c2
Canonical pin bump for the 3.7.0 rollout forseti approved and released (althing 6db955f, tag v3.7.0). Image built from that tree and pushed as sha256:df0709b3f532557aebb47d6ece486ae32e851776f732862094608d55eefcd4e7; previous pin was 3.6.3@sha256:978f8553 and remains the rollback target. Content-verified rather than tag-verified: `postbox --version` inside the built image reports 3.7.0 before it was pushed, and again inside the running container after. A tag is a claim. Also adds playbooks/nh3-extdev-althing-upgrade.yaml -- a version-parameterised upgrade for the box a git pull cannot move. The existing nh3-extdev-althing-v3.yaml is the historical v2->v3 CUTOVER and is left alone rather than mutated per release; it still carries v2-retirement steps that document what happened. Every check in the new playbook asserts what the installed entry point reports, including one that the herald restarted within the last 5 minutes rather than surviving from before -- "active" does not mean "running the code you just installed".
61 lines
2.8 KiB
YAML
61 lines
2.8 KiB
YAML
# Upgrade althing on nh3-extdev to a given release. Version-parameterised and
|
|
# rerunnable — the sibling `nh3-extdev-althing-v3.yaml` is the historical
|
|
# v2→v3 CUTOVER and should not be mutated per release.
|
|
#
|
|
# scripts/elway infra-ops@10.100.50.42 \
|
|
# --playbook playbooks/nh3-extdev-althing-upgrade.yaml --var version=3.7.0
|
|
#
|
|
# ⚠ nh3-extdev is the box a `git pull` cannot move. althing is a system WHEEL
|
|
# at /opt/uv-tools/althing-core, entry points in /usr/local/bin, its herald is
|
|
# a SYSTEM unit (not a user unit like nh3-dev's), and `uv` is not on lkraven's
|
|
# PATH — it lives at /home/infra-ops/.local/bin/uv. BOTH UV_TOOL_DIR and
|
|
# UV_TOOL_BIN_DIR are required; setting only one installs to the wrong place.
|
|
#
|
|
# ⚠ `uv tool install` WITHOUT --force IS A SILENT NO-OP — uv matches the source
|
|
# SPEC, not its contents, so on a box that already installed from this path it
|
|
# prints "already installed" and exits 0 having done nothing.
|
|
#
|
|
# ⚠ VERIFY THE BINARY, NOT THE TAG. Every check below asserts the version the
|
|
# installed entry point actually reports. A wheel filename is a claim.
|
|
vars:
|
|
version: "3.7.0"
|
|
uv: /home/infra-ops/.local/bin/uv
|
|
tool_dir: /opt/uv-tools
|
|
bin_dir: /usr/local/bin
|
|
|
|
steps:
|
|
- name: Stage the release wheel
|
|
upload:
|
|
src: /tmp/althing-release-3.7.0/althing_core-3.7.0-py3-none-any.whl
|
|
dest: /tmp/althing_core-{{ version }}-py3-none-any.whl
|
|
mode: "0644"
|
|
|
|
- name: Record the version we are replacing
|
|
shell: "{{ bin_dir }}/postbox --version"
|
|
|
|
- name: Install the staged wheel over the system wheel install
|
|
sudo: true
|
|
shell: env UV_TOOL_DIR={{ tool_dir }} UV_TOOL_BIN_DIR={{ bin_dir }} {{ uv }} tool install --force /tmp/althing_core-{{ version }}-py3-none-any.whl
|
|
# Idempotent on the INSTALLED VERSION, not on the wheel's presence.
|
|
when: "test \"$({{ bin_dir }}/postbox --version | awk '{print $2}')\" != '{{ version }}'"
|
|
|
|
- name: Restart the herald so the new code is what is actually running
|
|
sudo: true
|
|
shell: systemctl restart althing-po-herald.service
|
|
|
|
verify:
|
|
- name: the installed binary reports the new version
|
|
shell: "test \"$({{ bin_dir }}/postbox --version | awk '{print $2}')\" = '{{ version }}'"
|
|
changed_when: "false"
|
|
- name: the herald is running, and on the new code
|
|
sudo: true
|
|
shell: systemctl is-active --quiet althing-po-herald.service
|
|
changed_when: "false"
|
|
- name: the herald restarted just now rather than surviving from before
|
|
sudo: true
|
|
shell: "test $(( $(date +%s) - $(date -d \"$(systemctl show althing-po-herald.service -p ActiveEnterTimestamp --value)\" +%s) )) -lt 300"
|
|
changed_when: "false"
|
|
- name: the v2 entry points are still gone
|
|
shell: "! test -e {{ bin_dir }}/althing-cli && ! test -e {{ bin_dir }}/althing-receiver"
|
|
changed_when: "false"
|