Skip to content

Sync CI for sssd-2-9-4 - #8139

Closed
ikerexxe wants to merge 30 commits into
SSSD:sssd-2-9-4from
ikerexxe:sync-ci-sssd-2-9-4
Closed

ikerexxe wants to merge 30 commits into
SSSD:sssd-2-9-4from
ikerexxe:sync-ci-sssd-2-9-4

Conversation

@ikerexxe

@ikerexxe ikerexxe commented Oct 13, 2025 •

Copy link
Copy Markdown
Contributor

As part of #8105 sync CI for sssd-2-9-4 branch. The first part of the PR contains commits that are already available in master, the second part contains the changes I've made to make CI green and the changes to target centos-8, or centos-9 depending on the availability, in CI.

From now on the following jobs will be run in sssd-2-9-4 branch:

  • codeql
  • python-system-tests
  • cppcheck
  • make-distcheck
  • rpm-build:centos-stream-9
  • system (centos-8)

All other jobs have been removed as they don't make sense anymore.

justin-stephenson and others added 10 commits October 13, 2025 09:24
GitHub provides a bot called 'Dependabot' which can
be used to automate version updates to Github
actions. Adding this check monthly will trigger
dependabot to create PRs with updates to github
actions versions in use by SSSD.

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Bumps [vapier/coverity-scan-action](https://github.com/vapier/coverity-scan-action) from 1.7.0 to 1.8.0.
- [Release notes](https://github.com/vapier/coverity-scan-action/releases)
- [Commits](vapier/coverity-scan-action@v1.7.0...v1.8.0)

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
We released a new SSSD beta version as 2.10.0-beta1, unfortunately
this caused issues in the rpm build system as this value is set as
the Version field but dash is not allowed in this field therefore
`make rpms` was broken.

Fedora guidelines requires to use ~ as a prerelease separator so
two NVR versions compare correctly. For example:

* 2.10.0 < 2.10.0-beta1
* 2.10.0~beta1 < 2.10.0

We will follow this guideline to make `make rpms` work again and
to avoid any further rpm issues. Next GitHub release will also
follow this guideline.

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
It turns out that git does not allow tilde in tag name
therefore we need to keep using dash for upstream releases
and tilde in downstream.

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
This automation can be manually triggered in "Actions" tab.

- update translations
- bump version number
- create signed commits and tag
- push the content to upstream repository
- create new github release with autogenerated release notes

Since release notes generated from out commit messages are not yet
supported, the release is created as a draft. When created, we need
to updated release notes manually and then publish the release.

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Jobs inside this workflow are skipped if pull request touches only
system tests and no other files, so it is not run when not needed
(system tests can not break make).

It is however run for all changes when pushed to the target branch to
always have the latest status available.

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
Pull request that only modify test do not need to run the whole test
suite, only the test that were actually touched.

Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
Reviewed-by: Justin Stephenson <jstephen@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
@packit-as-a-service

Copy link
Copy Markdown

Failed to load packit config file:

Cannot parse package config. ValidationError({'jobs': {0: {'packages': defaultdict(<class 'dict'>, {'upstream': {'value': {'actions': ["Unknown action(s) provided: ['pre-build-deps']"]}}})}, 1: {'packages': defaultdict(<class 'dict'>, {'upstream': {'value': {'actions': ["Unknown action(s) provided: ['pre-build-deps']"]}}})}}})

For more info, please check out the documentation or contact the Packit team. You can also use our CLI command config validate or our pre-commit hooks for validation of the configuration.

@ikerexxe ikerexxe closed this Oct 13, 2025
@ikerexxe ikerexxe reopened this Oct 13, 2025
@packit-as-a-service

Copy link
Copy Markdown

Failed to load packit config file:

Cannot parse package config. ValidationError({'jobs': {0: {'packages': defaultdict(<class 'dict'>, {'upstream': {'value': {'actions': ["Unknown action(s) provided: ['pre-build']"]}}})}, 1: {'packages': defaultdict(<class 'dict'>, {'upstream': {'value': {'actions': ["Unknown action(s) provided: ['pre-build']"]}}})}}})

For more info, please check out the documentation or contact the Packit team. You can also use our CLI command config validate or our pre-commit hooks for validation of the configuration.

@ikerexxe
ikerexxe force-pushed the sync-ci-sssd-2-9-4 branch 3 times, most recently from ef298bd to b72429f Compare October 16, 2025 15:26
@ikerexxe
ikerexxe marked this pull request as ready for review October 16, 2025 16:44
@ikerexxe ikerexxe added the no-backport This should go to target branch only. label Oct 16, 2025
@justin-stephenson

Copy link
Copy Markdown
Contributor

From now on the following jobs will be run in sssd-2-9-4 branch:

* codeql

* python-system-tests

* cppcheck

* make-distcheck

* rpm-build:centos-stream-9

* system (centos-8)

Is system (centos-8) correct? I don't see it run here.

alexey-tikhonov and others added 19 commits October 30, 2025 09:59
In theory new API might be somewhat better.

But:

1) it's fairly new: `ares_search_dnsrec()` and `ares_query_dnsrec()`
were introduced in c-ares-1.28 while even CentOS Stream 10 has
c-ares-1.25, so SSSD would need to support (fallback) old API anyway.

2) SSSD doesn't make heavy use of DNS, so potential performance
improvements are really negligible.

On the other hand, old API/ABI will be available for a long time:
c-ares/c-ares#732 (comment)

For those reasons it's not worth the effort to port code to new API
right now.

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
with `sss_erase_mem_securely()`

Resolves: SSSD#7606

Reviewed-by: Alejandro López <allopez@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
In OpenSSL 3.0 some of the calls we currently use in the utility
functions to covert the public key from a X.509 certificate into an ssh
public key got deprecated. This patch replaces them if OpenSSL 3.0 or
newer is used.

In contrast to the older calls which just returned references the new
calls return the requested data in freshly allocated memory. To keep
it consistent the data referenced by the old calls are copied into
allocated memory as well.

Resolves: SSSD#5861

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
:packaging:Support of OpenSSL older than 1.0.1 was dropped

Reviewed-by: Sumit Bose <sbose@redhat.com>
Don't include <openssl/core_names.h> header if OpenSSL older 3.0 is
used. Fix compile typos for build with OpenSSL 1.1.

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
This test was previously unstable, since it is possible that the
contents of the log file were not yet fully written to the disk.
We need to stop SSSD to ensure that all logs are flushed.

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Since curl version 7.85.0 CURLOPT_PROTOCOLS is deprecated and should be
replaced by CURLOPT_PROTOCOLS_STR.

Resolves: SSSD#6922

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
This test has been refactored in master and the current implementation
for this branch isn't valid anymore. Porting the refactored version
isn't an option.

Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com>
When only system test files are touched in a PR, the get-changed.sh
script fails due to -o pipefail option being added by
GH action shell built-in.

https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#defaultsrunshell

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v5)

Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5 to 6.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v5...v6)

Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
@alexey-tikhonov

Copy link
Copy Markdown
Member

Pushed PR: #8139

  • sssd-2-9-4
    • fe2f6dd - build(deps): bump actions/setup-python from 5 to 6
    • c603d5e - build(deps): bump actions/checkout from 4 to 5
    • 3efe6f2 - ci: Override shell builtin bash options for get-changed script
    • 15d643a - CI: stop running intgcheck
    • 8c52d6a - Makefile: fix installation issue
    • da0f045 - tests: remove failing test
    • 87df940 - CI: only run sssd-2-9-4 branch in centos-8
    • 243196d - sssd-badversion.conf: fix pre-commit issue
    • cb00740 - CI: remove FreeBSD as they don't rely on sssd-2-9-4
    • 25820ef - CI: install dependencies
    • d389c2e - CI: target sssd-2-9-4 branch in workflows
    • 6361a8e - ci: get changed script handle run for master push (non-PR)
    • f4863fd - oidc_child: use CURLOPT_PROTOCOLS_STR if available
    • 01334ba - tests: stabilize test_sudo__refresh_random_offset
    • 6993310 - cert util: add support build with OpenSSL older than 3.0
    • 2a05858 - Require OpenSSL >= 1.0.1
    • 6cf8408 - cert util: replace deprecated OpenSSL calls
    • 155825c - CLIENT:PAM: replace deprecated _pam_overwrite
    • 8f2f159 - RESOLV: supress deprecation warnings
    • 138afc3 - ci: remove custom copr builds
    • 9ad6eb8 - ci: use parallel build
    • edadc97 - ci: only run changed tests for test only changes
    • afb3ce5 - ci: move build to standalone workflow
    • 9696256 - ci: add automation for creating new release
    • 2f67151 - scripts: switch back to dash for pre-releases
    • b6990f6 - version: replace dash with tilda
    • 0e563f7 - scripts: add support for beta and rc versions
    • 73ac9bd - build(deps): bump vapier/coverity-scan-action from 1.7.0 to 1.8.0
    • 143482e - dependapot: add ci prefix to commit messages
    • a5903fa - CI: Add dependabot to get updates of github actions

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

no-backport This should go to target branch only. Pushed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants