From 96e27c871654812738b5c008263c28f198845eaa Mon Sep 17 00:00:00 2001 From: Michal Date: Mon, 10 Aug 2026 16:41:26 +0100 Subject: [PATCH] build: extend the main-sync gate to the image build and the k8s deploy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Same hazard as the package build, with the cluster on the receiving end: a branch behind main builds images missing whatever landed there, and deploy-k8s.sh pins that sha in Pulumi — making the stale build the cluster's source of truth. build-mcpd.sh gets its own call because it is run standalone as well as from deploy-k8s.sh, so neither can rely on the other having checked. `--dry-run` is exempt. It builds and cuts over nothing, and blocking a read-only inspection is exactly what teaches people to export MCPCTL_ALLOW_BEHIND_MAIN=1 permanently — which would disable the gate for the real deploys too. The failure text is now artifact-agnostic ("produce an artifact" / "shipping it"), since one helper now speaks for packages, images and deploys. Verified against a synthetic ref one commit ahead: build-mcpd.sh exits 1 before any docker work, and deploy-k8s.sh exits 1 before the test gate, the pg_dump, the image build and pulumi. Neither the working tree nor HEAD was moved to test this — the ref was built with git commit-tree and deleted afterwards. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_019wUmrfkVQR6CKcYKxENq7k --- docs/project-summary.md | 10 ++++++++-- scripts/build-mcpd.sh | 5 +++++ scripts/check-main-sync.sh | 6 ++++-- scripts/deploy-k8s.sh | 14 ++++++++++++++ 4 files changed, 31 insertions(+), 4 deletions(-) diff --git a/docs/project-summary.md b/docs/project-summary.md index 9ec9bd7..23e7a75 100644 --- a/docs/project-summary.md +++ b/docs/project-summary.md @@ -890,8 +890,14 @@ ships a binary missing whatever landed on main meanwhile, and `rpm -U --force` overwrites the good one with it. That happened on 2026-08-10: a build from a stale checkout replaced `/usr/bin/mcpctl` with one that had no `statusline` command, months after the status line landed. `scripts/check-main-sync.sh` -(sourced by `build-rpm.sh` and `build-deb.sh`) fetches `main`, compares, and -fails before any work happens, listing the commits you are missing. +fetches `main`, compares, and fails before any work happens, listing the commits +you are missing. It gates every path that produces something others consume: +`build-rpm.sh`, `build-deb.sh`, `build-mcpd.sh` (each is also run standalone, so +none can rely on another having checked) and `deploy-k8s.sh` — where a stale +branch would pin its sha in Pulumi and make it the cluster's source of truth. +`deploy-k8s.sh --dry-run` skips the check: it builds and cuts over nothing, and +blocking a read-only inspection only teaches people to export the escape hatch +permanently, disabling the gate for real deploys too. ```bash git merge main # the fix diff --git a/scripts/build-mcpd.sh b/scripts/build-mcpd.sh index 08a7f3a..99ece3a 100755 --- a/scripts/build-mcpd.sh +++ b/scripts/build-mcpd.sh @@ -16,6 +16,11 @@ if [ -f .env ]; then set -a; source .env; set +a fi +# This pushes an image to the registry, so the same staleness gate as the package +# builds applies. Run standalone as well as from deploy-k8s.sh, hence its own copy. +source "$SCRIPT_DIR/check-main-sync.sh" +check_main_sync + # Push directly to internal address (external proxy has body size limit) REGISTRY="10.0.0.194:3012" IMAGE="mcpd" diff --git a/scripts/check-main-sync.sh b/scripts/check-main-sync.sh index 246ada2..05c0e3f 100755 --- a/scripts/check-main-sync.sh +++ b/scripts/check-main-sync.sh @@ -84,8 +84,10 @@ check_main_sync() { echo "" >&2 echo "ERROR: '$branch' is $behind commit(s) behind $base — refusing to build." >&2 echo "" >&2 - echo " Building now would package a binary without these, and installing it" >&2 - echo " would overwrite a good one with a version missing them:" >&2 + # Deliberately artifact-agnostic: the same helper gates RPM/DEB packages, the + # mcpd image, and the k8s deploy. + echo " Building now would produce an artifact without these, and shipping it" >&2 + echo " would replace a good one with a version missing them:" >&2 echo "" >&2 git log --oneline --no-decorate "HEAD..$ref" | head -15 | sed 's/^/ /' >&2 if [ "$behind" -gt 15 ]; then diff --git a/scripts/deploy-k8s.sh b/scripts/deploy-k8s.sh index e41efad..eff872a 100755 --- a/scripts/deploy-k8s.sh +++ b/scripts/deploy-k8s.sh @@ -80,6 +80,20 @@ cat <