Repository navigation
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
brainrake
changed the title
brainrake
changed the title
brainrake
force-pushed
the
martonboros/manifest-diff-tooling
branch
from
September 13, 2026 19:08
31b2aa9 to
5990729
Compare
Runs as a stage2 provisioner (same pattern as ansible.log), deleted before the instance is imaged. Both legs read the resulting /tmp/ami-manifest.txt: testinfra-ami-build.yml uploads it as a build artifact, ami-release-nix.yml (amd64) caches it to S3 as the develop baseline. Replaces the prior SSH-based capture, which blew the existing 10-minute test timeout hashing the whole filesystem over a remote shell. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
brainrake
force-pushed
the
martonboros/manifest-diff-tooling
branch
from
September 30, 2026 23:48
784032c to
98904bd
Compare
mtree is the standard tool for a path/mode/owner/hash directory fingerprint. Also fixes a real bug: the old find+sha256sum loop never excluded /dev or /sys, so sha256sum would hang forever on /dev/zero or /dev/random. Verified end to end against ubuntu:24.04 (11s, libarchive-tools installed then purged, clean exit). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
brainrake
marked this pull request as ready for review
October 1, 2026 00:07
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
brainrake
marked this pull request as draft
October 1, 2026 00:07
Key the S3 path by arch so amd64/arm64 don't clobber each other's latest.txt. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The AMI build instance has no package index cache; install failed with 'Unable to locate package'. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Matches postgres#2450's version-diff pattern: per-leg diff artifact, one job downloads all of them, find-comment + create-or-update-comment instead of a new comment per push. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
AMI manifest diff15-amd64: changed (baseline: pr-d9f98fa2b947b0cc3b35bf62b3880eff223ce94e)... 11 unchanged
-./boot/grub/grub.cfg mode=600 gid=0 uid=0 type=file sha256digest=b3813a4f032f9395262cec57fb359939c0bfa5fd0cf8293b30c6c4b3dd7e40ce
+./boot/grub/grub.cfg mode=600 gid=0 uid=0 type=file sha256digest=a6f29cf2fb9bd89d714f6c7769236cbc8d18ec0af668346295891a4837dd6c82
... 294 unchanged
-./boot/initrd.img-7.0.0-1014-aws mode=644 gid=0 uid=0 type=file sha256digest=ae8d200064cc204a1b4ad60166f870aa409f40f177fd1994fd7ab07150775e03
+./boot/initrd.img-7.0.0-1014-aws mode=644 gid=0 uid=0 type=file sha256digest=5a4958502081ebb6aeac455882b5209819685cf3e5d7244004ef91901705ccc6
... 7 unchanged
-./etc/.resolv.conf.systemd-resolved.bak mode=644 gid=0 uid=0 type=file sha256digest=de972e1c50663704b298c746877bcc6a28992caa9148a7daab97e894d03f8acc
-./etc/.updated mode=644 gid=0 uid=0 type=file sha256digest=a1faaf701001abfd5847d089094cfd9fb3948a2c3fad28df73153e9a789f3f6c
+./etc/.resolv.conf.systemd-resolved.bak mode=644 gid=0 uid=0 type=file sha256digest=4d0682753227caff7fbaa014428572ac943b92aa2271a06ed4fd59a25b44f6c5
+./etc/.updated mode=644 gid=0 uid=0 type=file sha256digest=92f96adccb24c18bd88395021c7c7f2d69e5e1e0b789c4a61c27dab9a341ed66
... 18 unchanged
-./etc/adminapi/pg_upgrade_scripts/common.sh mode=755 gid=0 uid=1006 type=file sha256digest=3b0b51be519ecdce44a9faeb77e8658f265e2b7ef5afde3d588b925dcb9d6a2f
+./etc/adminapi/pg_upgrade_scripts/common.sh mode=755 gid=0 uid=1006 type=file sha256digest=3d8be54d6115a118fdba4b5968531de84ea27b670a623747a06a55640f489437
... 1 unchanged
-./etc/adminapi/pg_upgrade_scripts/initiate.sh mode=755 gid=0 uid=1006 type=file sha256digest=8fe0f478aa097d019dbb4a5a0975470784d2ca5a7eba3d270fe2972c7d3b2475
+./etc/adminapi/pg_upgrade_scripts/initiate.sh mode=755 gid=0 uid=1006 type=file sha256digest=a5e9150541dff09a2af9723c8bf1e6c48e54e81fdf92d066225064536b9ae8ee
... 338 unchanged
-./etc/apparmor.d/transmission mode=644 gid=0 uid=0 type=file sha256digest=f300395b821e5e575a1178a77d5eff7e1ba55caa544139136cbda4038d202dc2
+./etc/apparmor.d/transmission mode=644 gid=0 uid=0 type=file sha256digest=a89214bc6069925284e3f73522e4c7fcbe3b4ccf8f6ac7dd2eeaab0641e50955
... 60 unchanged
-./etc/apt/sources.list.d/ubuntu.sources mode=644 gid=0 uid=0 type=file sha256digest=4002185cb5b4fd0dd0984e1324504891d8f94094178ab7218dcffee53c96033c
+./etc/apt/sources.list.d/ubuntu.sources mode=644 gid=0 uid=0 type=file sha256digest=5d94ed0b748501184714fdf578e0d9fb1fa6151845e84c4b95b7c16dfb5badae
... 382 unchanged
-./etc/fstab mode=644 gid=0 uid=0 type=file sha256digest=82b036954adc16683c55b54b2e97099d7d9f7fcc91980a74c3451cac88ffc4f0
+./etc/fstab mode=644 gid=0 uid=0 type=file sha256digest=e643f304e3cc00e6fdfe93f08b279b5757644a0710980fa3b79e0f77b11ccf2d
... 29 unchanged
-./etc/hostname mode=644 gid=0 uid=0 type=file sha256digest=44c9710c80648f1fe154fa59d038ad632b1fe74d832cc73d6b8d391c33edcfde
+./etc/hostname mode=644 gid=0 uid=0 type=file sha256digest=03209c7993e56fab8ee713486e3d0d65480898fac235d717d1c1e08955299c4e
... 127 unchanged
-./etc/machine-id mode=444 gid=0 uid=0 type=file sha256digest=095d5932a570445a11a16fceef8abc2a1ea2bc96313d32524d85604019d4d107
+./etc/machine-id mode=444 gid=0 uid=0 type=file sha256digest=d0647393fe73e48c08dd1103af7c4cf79bf76e565c87604be53db9cdaf22712a
... 26 unchanged
-./etc/netplan/50-cloud-init.yaml mode=600 gid=0 uid=0 type=file sha256digest=56686b4dab021680dd1f7bbf2f10655551b3a0d3f803f995e2ad7272d5607745
+./etc/netplan/50-cloud-init.yaml mode=600 gid=0 uid=0 type=file sha256digest=c3c579bdf5d53d32f4252b7fa13cfb433f63dc3608f5a042175b87774bb623ef
... 15 unchanged
-./etc/nftables.conf mode=755 gid=0 uid=0 type=file sha256digest=5473f9330a544b7c06297f410389d00707057f277c5e321ea379e8f36090118b
+./etc/nftables.conf mode=755 gid=0 uid=0 type=file sha256digest=b74724fc30b5a5ae382604194be121c4ce0ef71fd1b2575f3fd3167374b3ebcf
+./etc/nftables/egressfilter.conf mode=644 gid=0 uid=1006 type=file sha256digest=efd4709d1c41d5ac78ab944ebf127b013ec490c5b42ad77d0abb0302310fc533
... 75 unchanged
-./etc/postgresql-custom/extension-custom-scripts/pgmq/after-create.sql mode=775 gid=1002 uid=999 type=file sha256digest=9c37e22f172310f099652d3bba09a26231461238b668d6521dc8ffd879335e2b
+./etc/postgresql-custom/extension-custom-scripts/pgmq/after-create.sql mode=775 gid=1002 uid=999 type=file sha256digest=4dbe1a000384f35f15dd84a73072205976bf370241b4bf79b094abaecfa54cf9
... 147 unchanged
-./etc/shadow mode=640 gid=42 uid=0 type=file sha256digest=fd5e67ae69f7b989b4bb042b136d1c1121393bf7840c7f1495e8f80b9c5fe469
-./etc/shadow- mode=640 gid=42 uid=0 type=file sha256digest=16524a75cbcf662b8e5e46aa753b25ee61876bdc43011af897e6d2fe89109819
+./etc/shadow mode=640 gid=42 uid=0 type=file sha256digest=2598e01f3e5c8ebef4f2f9d33471e46140596bf0b0685190dafda7e37a8a12d1
+./etc/shadow- mode=640 gid=42 uid=0 type=file sha256digest=44e22919109e003f031d586ef33a4eaef9c0f9cfb20593f49b0978ab71d2fce6
... 10 unchanged
-./etc/ssh/ssh_host_ecdsa_key mode=600 gid=0 uid=0 type=file sha256digest=6ad12b00f8d00046ca0dc9b721eca6431da639aed87eb54e23e9f7110b9f5faf
-./etc/ssh/ssh_host_ecdsa_key.pub mode=644 gid=0 uid=0 type=file sha256digest=48578ccf5e3edad816817f7844d86de08332c1317a22ecf7d8855e2bc65fc906
-./etc/ssh/ssh_host_ed25519_key mode=600 gid=0 uid=0 type=file sha256digest=657d98fb489c90f65a10204291cc0eab161431a9f99a7ed9f9f88f7ac752d4ff
-./etc/ssh/ssh_host_ed25519_key.pub mode=644 gid=0 uid=0 type=file sha256digest=40e4526582bdd88bd9b650e9b418e7a54acb179c28d4079c63841564c063b3de
-./etc/ssh/ssh_host_rsa_key mode=600 gid=0 uid=0 type=file sha256digest=c00750b3db77bade7d841818a8313e662189120ff46b15db66b0b9ee237817f7
-./etc/ssh/ssh_host_rsa_key.pub mode=644 gid=0 uid=0 type=file sha256digest=ab2c302a93c9b60ef2c66fced2418bb65a1c4df49690a47a7b490b56d9f7ffb9
+./etc/ssh/ssh_host_ecdsa_key mode=600 gid=0 uid=0 type=file sha256digest=4112b214d64cf76c9e33b7def19406cc059f703562ed2c68b845e2216b5f8642
+./etc/ssh/ssh_host_ecdsa_key.pub mode=644 gid=0 uid=0 type=file sha256digest=2d99b7e8f9ec85d702dc84a294a753d028b9d5ebeb8e071c36e953b58aetruncated, full output 15-arm64: No baseline cached yet. Publish one by running ami-release-nix.yml (push to develop).17-amd64: changed (baseline: pr-d9f98fa2b947b0cc3b35bf62b3880eff223ce94e)... 11 unchanged
-./boot/grub/grub.cfg mode=600 gid=0 uid=0 type=file sha256digest=96788c20720398699b39041624da6b4f0736235432403aaf675ef08a1cf8d862
+./boot/grub/grub.cfg mode=600 gid=0 uid=0 type=file sha256digest=3bee67e9dae3a4949348bb752583245149b344eeefadab85d9ec12bd5c031b64
... 294 unchanged
-./boot/initrd.img-7.0.0-1014-aws mode=644 gid=0 uid=0 type=file sha256digest=993348a126e6845a35ba1571b2f7babd3e6db05240f34ed25e44166aca6e7614
+./boot/initrd.img-7.0.0-1014-aws mode=644 gid=0 uid=0 type=file sha256digest=8683614099755ad57a49c6c845ebd91de4eb3fac506a187f41de992f84467b68
... 7 unchanged
-./etc/.resolv.conf.systemd-resolved.bak mode=644 gid=0 uid=0 type=file sha256digest=de972e1c50663704b298c746877bcc6a28992caa9148a7daab97e894d03f8acc
-./etc/.updated mode=644 gid=0 uid=0 type=file sha256digest=5149f8df1866ff1fa6313564d913551c2ace8f385d1b314aeaeb2d6e9f035b33
+./etc/.resolv.conf.systemd-resolved.bak mode=644 gid=0 uid=0 type=file sha256digest=4d0682753227caff7fbaa014428572ac943b92aa2271a06ed4fd59a25b44f6c5
+./etc/.updated mode=644 gid=0 uid=0 type=file sha256digest=7cbdc6ea418239af2c48186ef88ea2dd0e33872705316370ef6815682907bb1f
... 18 unchanged
-./etc/adminapi/pg_upgrade_scripts/common.sh mode=755 gid=0 uid=1006 type=file sha256digest=3b0b51be519ecdce44a9faeb77e8658f265e2b7ef5afde3d588b925dcb9d6a2f
+./etc/adminapi/pg_upgrade_scripts/common.sh mode=755 gid=0 uid=1006 type=file sha256digest=3d8be54d6115a118fdba4b5968531de84ea27b670a623747a06a55640f489437
... 1 unchanged
-./etc/adminapi/pg_upgrade_scripts/initiate.sh mode=755 gid=0 uid=1006 type=file sha256digest=8fe0f478aa097d019dbb4a5a0975470784d2ca5a7eba3d270fe2972c7d3b2475
+./etc/adminapi/pg_upgrade_scripts/initiate.sh mode=755 gid=0 uid=1006 type=file sha256digest=a5e9150541dff09a2af9723c8bf1e6c48e54e81fdf92d066225064536b9ae8ee
... 338 unchanged
-./etc/apparmor.d/transmission mode=644 gid=0 uid=0 type=file sha256digest=f300395b821e5e575a1178a77d5eff7e1ba55caa544139136cbda4038d202dc2
+./etc/apparmor.d/transmission mode=644 gid=0 uid=0 type=file sha256digest=a89214bc6069925284e3f73522e4c7fcbe3b4ccf8f6ac7dd2eeaab0641e50955
... 60 unchanged
-./etc/apt/sources.list.d/ubuntu.sources mode=644 gid=0 uid=0 type=file sha256digest=4002185cb5b4fd0dd0984e1324504891d8f94094178ab7218dcffee53c96033c
+./etc/apt/sources.list.d/ubuntu.sources mode=644 gid=0 uid=0 type=file sha256digest=5d94ed0b748501184714fdf578e0d9fb1fa6151845e84c4b95b7c16dfb5badae
... 382 unchanged
-./etc/fstab mode=644 gid=0 uid=0 type=file sha256digest=f23f1d0c1f8083b700be642f477c39ea45a52190248adf46b09134775b2b8041
+./etc/fstab mode=644 gid=0 uid=0 type=file sha256digest=3a808679e2c9b4f6404e22ad783917c807327e6d0a108daef431b624152241af
... 29 unchanged
-./etc/hostname mode=644 gid=0 uid=0 type=file sha256digest=85583d7758d5dc204f22c8c11a0721893fce9af6b2851b2aa6b99e4d73450b2c
+./etc/hostname mode=644 gid=0 uid=0 type=file sha256digest=8ea78b44f8ef07db54ed0444291956164f91484e29b034728917a6da3a2b5816
... 127 unchanged
-./etc/machine-id mode=444 gid=0 uid=0 type=file sha256digest=e89481083e438dea3263994b16bf812405e7105d184726ab3626e909c2484131
+./etc/machine-id mode=444 gid=0 uid=0 type=file sha256digest=e0b2cd9639c143c7194d9389197202d5677245226948931942b4e6f9c550ae55
... 26 unchanged
-./etc/netplan/50-cloud-init.yaml mode=600 gid=0 uid=0 type=file sha256digest=6562b7ea749116cf77b33fd1c5e6aead5b91b546a593bbf2fa589fce24562c46
+./etc/netplan/50-cloud-init.yaml mode=600 gid=0 uid=0 type=file sha256digest=aadb1e0f9e8fc1a06406b1493fd65fb35bf25e496e0b2a98c4cc490683cd016f
... 15 unchanged
-./etc/nftables.conf mode=755 gid=0 uid=0 type=file sha256digest=5473f9330a544b7c06297f410389d00707057f277c5e321ea379e8f36090118b
+./etc/nftables.conf mode=755 gid=0 uid=0 type=file sha256digest=b74724fc30b5a5ae382604194be121c4ce0ef71fd1b2575f3fd3167374b3ebcf
+./etc/nftables/egressfilter.conf mode=644 gid=0 uid=1006 type=file sha256digest=efd4709d1c41d5ac78ab944ebf127b013ec490c5b42ad77d0abb0302310fc533
... 75 unchanged
-./etc/postgresql-custom/extension-custom-scripts/pgmq/after-create.sql mode=775 gid=1002 uid=999 type=file sha256digest=9c37e22f172310f099652d3bba09a26231461238b668d6521dc8ffd879335e2b
+./etc/postgresql-custom/extension-custom-scripts/pgmq/after-create.sql mode=775 gid=1002 uid=999 type=file sha256digest=4dbe1a000384f35f15dd84a73072205976bf370241b4bf79b094abaecfa54cf9
... 147 unchanged
-./etc/shadow mode=640 gid=42 uid=0 type=file sha256digest=fd5e67ae69f7b989b4bb042b136d1c1121393bf7840c7f1495e8f80b9c5fe469
-./etc/shadow- mode=640 gid=42 uid=0 type=file sha256digest=16524a75cbcf662b8e5e46aa753b25ee61876bdc43011af897e6d2fe89109819
+./etc/shadow mode=640 gid=42 uid=0 type=file sha256digest=2598e01f3e5c8ebef4f2f9d33471e46140596bf0b0685190dafda7e37a8a12d1
+./etc/shadow- mode=640 gid=42 uid=0 type=file sha256digest=44e22919109e003f031d586ef33a4eaef9c0f9cfb20593f49b0978ab71d2fce6
... 10 unchanged
-./etc/ssh/ssh_host_ecdsa_key mode=600 gid=0 uid=0 type=file sha256digest=614b1e09c5e1bcc9312479b5974a82d176f25b53df4bafd46726702ba006dd65
-./etc/ssh/ssh_host_ecdsa_key.pub mode=644 gid=0 uid=0 type=file sha256digest=c86347cab6738bdc28b42700396f7636529341cd9f1b992189ebde073c63d2bc
-./etc/ssh/ssh_host_ed25519_key mode=600 gid=0 uid=0 type=file sha256digest=b2551c793c7647555b4ca9de4a5f43ec324bad89390d2c974dd4871980e05bd2
-./etc/ssh/ssh_host_ed25519_key.pub mode=644 gid=0 uid=0 type=file sha256digest=d06c9d787938caabf0925f52e15d8f02ff60619702b45d030b81c1370a89ed05
-./etc/ssh/ssh_host_rsa_key mode=600 gid=0 uid=0 type=file sha256digest=fa6d17f84d081837312ad767b84ad250733b737a9b19c4542ddfca14cf3843ba
-./etc/ssh/ssh_host_rsa_key.pub mode=644 gid=0 uid=0 type=file sha256digest=0e4b88db3e3cbe7d45d6c685c8a5e7c81dd98543f2f22088f34e0b63f9c49777
+./etc/ssh/ssh_host_ecdsa_key mode=600 gid=0 uid=0 type=file sha256digest=041f498456db7bb20e516031fa395ed7ed419d49e7106f02ac6c8ce6d257eabb
+./etc/ssh/ssh_host_ecdsa_key.pub mode=644 gid=0 uid=0 type=file sha256digest=99397fd138268cde40a804a084297e02c3cd6c212840f05e26a26f0cc67truncated, full output 17-arm64: No baseline cached yet. Publish one by running ami-release-nix.yml (push to develop).orioledb-17-amd64: changed (baseline: pr-d9f98fa2b947b0cc3b35bf62b3880eff223ce94e)... 11 unchanged
-./boot/grub/grub.cfg mode=600 gid=0 uid=0 type=file sha256digest=b49f06772550d57d8e93ff07016f467f7c23fdad4da5249a76374ff0c0189817
+./boot/grub/grub.cfg mode=600 gid=0 uid=0 type=file sha256digest=2a43b0c5406d5786799584ba8c02d7db24582404218d993c482c131d30a54084
... 294 unchanged
-./boot/initrd.img-7.0.0-1014-aws mode=644 gid=0 uid=0 type=file sha256digest=29a75eec76b3dca73d1c652a37031778a8d78d0e80e02db443a68b067e670be1
+./boot/initrd.img-7.0.0-1014-aws mode=644 gid=0 uid=0 type=file sha256digest=dd075900e5ed6c333b166f16247d5c538e03846aa1a747bac42d1964ecd82df1
... 7 unchanged
-./etc/.resolv.conf.systemd-resolved.bak mode=644 gid=0 uid=0 type=file sha256digest=de972e1c50663704b298c746877bcc6a28992caa9148a7daab97e894d03f8acc
-./etc/.updated mode=644 gid=0 uid=0 type=file sha256digest=03d8b40424fbfd7518097764f4e6d1749f0834013d97cbb6c311d60de962ec08
+./etc/.resolv.conf.systemd-resolved.bak mode=644 gid=0 uid=0 type=file sha256digest=4d0682753227caff7fbaa014428572ac943b92aa2271a06ed4fd59a25b44f6c5
+./etc/.updated mode=644 gid=0 uid=0 type=file sha256digest=cf32755cfabd98695f603361e68d7ff424a81f0f06d2e2611109356da2112a93
... 18 unchanged
-./etc/adminapi/pg_upgrade_scripts/common.sh mode=755 gid=0 uid=1006 type=file sha256digest=3b0b51be519ecdce44a9faeb77e8658f265e2b7ef5afde3d588b925dcb9d6a2f
+./etc/adminapi/pg_upgrade_scripts/common.sh mode=755 gid=0 uid=1006 type=file sha256digest=3d8be54d6115a118fdba4b5968531de84ea27b670a623747a06a55640f489437
... 1 unchanged
-./etc/adminapi/pg_upgrade_scripts/initiate.sh mode=755 gid=0 uid=1006 type=file sha256digest=8fe0f478aa097d019dbb4a5a0975470784d2ca5a7eba3d270fe2972c7d3b2475
+./etc/adminapi/pg_upgrade_scripts/initiate.sh mode=755 gid=0 uid=1006 type=file sha256digest=a5e9150541dff09a2af9723c8bf1e6c48e54e81fdf92d066225064536b9ae8ee
... 338 unchanged
-./etc/apparmor.d/transmission mode=644 gid=0 uid=0 type=file sha256digest=f300395b821e5e575a1178a77d5eff7e1ba55caa544139136cbda4038d202dc2
+./etc/apparmor.d/transmission mode=644 gid=0 uid=0 type=file sha256digest=a89214bc6069925284e3f73522e4c7fcbe3b4ccf8f6ac7dd2eeaab0641e50955
... 60 unchanged
-./etc/apt/sources.list.d/ubuntu.sources mode=644 gid=0 uid=0 type=file sha256digest=4002185cb5b4fd0dd0984e1324504891d8f94094178ab7218dcffee53c96033c
+./etc/apt/sources.list.d/ubuntu.sources mode=644 gid=0 uid=0 type=file sha256digest=5d94ed0b748501184714fdf578e0d9fb1fa6151845e84c4b95b7c16dfb5badae
... 383 unchanged
-./etc/fstab mode=644 gid=0 uid=0 type=file sha256digest=d30f66ac94138a3594e1b421b76bf232f41442600d4f5938a7204888b26bf768
+./etc/fstab mode=644 gid=0 uid=0 type=file sha256digest=6cc986e1949ed6d2f39e585ecd37c17b8b4f03adbc9ca953b2eecf08f14a0874
... 33 unchanged
-./etc/hostname mode=644 gid=0 uid=0 type=file sha256digest=0e8330a0ab385e8c848289f97316188001b3dd0e2076931e22f99a551d4ab8d5
+./etc/hostname mode=644 gid=0 uid=0 type=file sha256digest=9962a21cbb8e36bc2dba25fc1dccb097a70d27e5087d18150e3f374ec0b0a539
... 127 unchanged
-./etc/machine-id mode=444 gid=0 uid=0 type=file sha256digest=7c7a947b4079e25c78c9862f8040286c1352e8dfcdfbb82fda87f72620b22d4c
+./etc/machine-id mode=444 gid=0 uid=0 type=file sha256digest=f0d3793fc0858e50facf8bb28092cd2527f3516c36701f19552d809584a46956
... 26 unchanged
-./etc/netplan/50-cloud-init.yaml mode=600 gid=0 uid=0 type=file sha256digest=f1be9bd11ce423f881cfe03d92d90283c6a8fb7479e9488afd6af2941eba4964
+./etc/netplan/50-cloud-init.yaml mode=600 gid=0 uid=0 type=file sha256digest=19d1e8d42f23727336b4c82824f09e890c931358591b7ad7e66f655a25becf1f
... 15 unchanged
-./etc/nftables.conf mode=755 gid=0 uid=0 type=file sha256digest=5473f9330a544b7c06297f410389d00707057f277c5e321ea379e8f36090118b
+./etc/nftables.conf mode=755 gid=0 uid=0 type=file sha256digest=b74724fc30b5a5ae382604194be121c4ce0ef71fd1b2575f3fd3167374b3ebcf
+./etc/nftables/egressfilter.conf mode=644 gid=0 uid=1006 type=file sha256digest=efd4709d1c41d5ac78ab944ebf127b013ec490c5b42ad77d0abb0302310fc533
... 75 unchanged
-./etc/postgresql-custom/extension-custom-scripts/pgmq/after-create.sql mode=775 gid=1002 uid=999 type=file sha256digest=9c37e22f172310f099652d3bba09a26231461238b668d6521dc8ffd879335e2b
+./etc/postgresql-custom/extension-custom-scripts/pgmq/after-create.sql mode=775 gid=1002 uid=999 type=file sha256digest=4dbe1a000384f35f15dd84a73072205976bf370241b4bf79b094abaecfa54cf9
... 147 unchanged
-./etc/shadow mode=640 gid=42 uid=0 type=file sha256digest=a4b28688a88924e29787f6def903beab125a91d9f1bd9ff4f17f23a00f7b86b0
-./etc/shadow- mode=640 gid=42 uid=0 type=file sha256digest=fd5e67ae69f7b989b4bb042b136d1c1121393bf7840c7f1495e8f80b9c5fe469
+./etc/shadow mode=640 gid=42 uid=0 type=file sha256digest=16a5478536e85534d076e64031ce37a09261a39681f2c8443df5b339dea4ff25
+./etc/shadow- mode=640 gid=42 uid=0 type=file sha256digest=2598e01f3e5c8ebef4f2f9d33471e46140596bf0b0685190dafda7e37a8a12d1
... 10 unchanged
-./etc/ssh/ssh_host_ecdsa_key mode=600 gid=0 uid=0 type=file sha256digest=89b56990fc59683af4c5e7767277c85e828799b156d6a9fb211046cf9d236f5c
-./etc/ssh/ssh_host_ecdsa_key.pub mode=644 gid=0 uid=0 type=file sha256digest=6d12f1108ec8f8254b88a7f11d3e4eb6f230cd6c0298f25f010222037e525b45
-./etc/ssh/ssh_host_ed25519_key mode=600 gid=0 uid=0 type=file sha256digest=35bdbff0bad62ca9101e7f5723d9ee6d1327d5905137b752b80edf36142c1e04
-./etc/ssh/ssh_host_ed25519_key.pub mode=644 gid=0 uid=0 type=file sha256digest=63f4a901cd74c3b71c3579e647bf91728078c673e45784e8b15b835ab9478e06
-./etc/ssh/ssh_host_rsa_key mode=600 gid=0 uid=0 type=file sha256digest=96b481f09ca9a9324da59b9cb9691071818d581ac0ae0491d237a41f38825ce0
-./etc/ssh/ssh_host_rsa_key.pub mode=644 gid=0 uid=0 type=file sha256digest=58b10839a2d13c0603a2553b0beb73ff7924de760584cfee88133059593e68dc
+./etc/ssh/ssh_host_ecdsa_key mode=600 gid=0 uid=0 type=file sha256digest=01ceee40afcc354d9292be273b1bb857d38943a75b1d42d5dc322f32d5eaf8e3
+./etc/ssh/ssh_host_ecdsa_key.pub mode=644 gid=0 uid=0 type=file sha256digest=e03c9e51c4e7183971498f9072b2a29ead29290d9496fb0a42016969da0truncated, full output orioledb-17-arm64: No baseline cached yet. Publish one by running ami-release-nix.yml (push to develop). |
6 legs x 20000 bytes exceeded the ~65536 char comment limit, silently dropping orioledb-17's two sections entirely. 6000/leg keeps the worst case (all legs differ) comfortably under it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
brainrake
marked this pull request as ready for review
October 1, 2026 14:32
This comment has been minimized.
This comment has been minimized.
mmlb
reviewed
Oct 1, 2026
Per review: GH-managed GC, no ARTIFACTS_BUCKET secret threading. restore-keys prefix match gets the latest develop-side save. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
mmlb
requested changes
Oct 2, 2026
Co-authored-by: Manuel Mendez <708570+mmlb@users.noreply.github.com>
Drop unused github.sha from restore key (never hits, confusing). Explain always() on manifest-diff-comment. Fix diff description: baseline is the last built AMI, not develop HEAD (cache only updates on ami-release-nix runs). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Docker image manifest diffCompares each Docker image's rootfs manifest between this PR and the last published image. |
nix run .#manifest-diff / .#manifest-comment, following the repo's own image-size-analyzer/docker-image-test convention, instead of bash embedded in composite-action YAML. Verified for real: nix build (writeShellApplication's shellcheck caught a real SC2295 quoting bug) and nix run with representative inputs for all three diff states (no baseline / unchanged / changed) plus the comment assembly. Testing also caught a real logic bug predating this refactor: the cached baseline carries a '# version:' header line that the current build's manifest never has, so every comparison showed a spurious 1-line diff removing it, even with zero real changes. Strip the header from both sides before diffing. manifest-snapshot.sh stays a plain script (not a nix package): it runs inside the AMI/container being snapshotted, which has no nix. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
PostgreSQL Extension Dependency Analysis: PR #2447
SummaryNo extensions had dependencies with MAJOR version updates. Full Analysis ResultsPostgreSQL 15 Extension DependenciesPostgreSQL 17 Extension DependenciesOrioleDB 17 Extension Dependencies |
PostgreSQL Package Dependency Analysis: PR #2447
SummaryNo packages had MAJOR version updates. Full Analysis ResultsPostgreSQL 15 Dependency ChangesExtracting PostgreSQL 15 dependencies...
Runtime Closure Size
Raw Dependency ClosurePostgreSQL 17 Dependency ChangesExtracting PostgreSQL 17 dependencies...
Runtime Closure Size
Raw Dependency Closure |
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…m/supabase/postgres into martonboros/manifest-diff-tooling
Package version diff: none (aarch64-linux, x86_64-linux) |
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This reverts commit 58469f2.
This comment has been minimized.
This comment has been minimized.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This comment has been minimized.
This comment has been minimized.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
brainrake
marked this pull request as ready for review
October 27, 2026 19:40
mmlb
requested changes
Oct 27, 2026
| mv /tmp/manifest.new /tmp/manifest.txt | ||
| echo "value=$(sha256sum /tmp/manifest.txt | cut -d' ' -f1)" >> "$GITHUB_OUTPUT" | ||
|
|
||
| - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 |
Collaborator
There was a problem hiding this comment.
hmm I figured the github actions would not allow this anymore now that we are using gha lockfiles but looks like thats not the case. Please run gh actions-lock to update this and others.
brainrake
marked this pull request as draft
October 27, 2026 19:54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Captures a filesystem manifest of the AMI and the Docker images, caches it on publish, and diffs it against each PR build in one PR comment per target.
bsdtar --format=mtree(path, mode, owner, hash) plus units, users, groups, nft, and sysctl. Capture istestinfra/manifest-snapshot.sh, run by a Packer provisioner for the AMI anddocker runfor images.ami-release-nix.ymlanddockerhub-release-matrix.yml(arm64) save the manifest withcache-manifest. The key is<prefix>-<sha256 of the manifest>.testinfra-ami-build.ymlanddocker-image-test.ymlrestore the newest entry for the prefix and diff withdiff-manifest. Unchanged lines collapse to... N unchanged.nix run .#manifest-diffand.#manifest-comment.Temporary: the "TEMP seed baseline" step in
testinfra-ami-build.ymlseeds the cache from this PR's build. Remove it before merge.MPG-117