rmdepcheck: publish messages (and hence report results) by update #561
Labels
No labels
area/installability
area/jenkins
area/rpmdeplint
area/rpminspect
area/STI
area/STI-compat
area/Testing Farm
area/tmt
area/Zuul CI
blocked
bug
discussion
feature
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Type
Help
Type
Incident
UX
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Status/Blocked
Status/Discuss
Type
Bug
Type
Feature
Type
Task
No milestone
No project
No assignees
3 participants
Notifications
Due date
No due date set.
Blocks
#562 Stop publishing .ci. messages?
ci/tickets
Reference
ci/tickets#561
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Currently, when testing updates, the pipeline publishes messages by NVR. This means we get as many messages (and hence resultsdb results) as there are builds in the update; for a 500-package update we get 500 messages and 500 results. This looks a bit goofy on the Automated Tests tab:
and so on.
Since rmdepcheck is a test of the update, and it's not possible to definitively associate rmdepcheck failures with any specific package in the update, we should send messages and thus report results for the update as a whole, not for each individual NVR.
It looks like, in order to do this, we want to make the pipeline's
sendMessagecalls hit FedoraUpdateMessageBuilder not RpmBuildMessageBuilder. To achieve that, we have to fiddle with what the pipeline passes asartifactIdand/oradditionalArtifactIds.Looking closely at the pipeline library code, it looks like this path expects something it calls a "composite artifact ID", which I think looks something like this:
So we'd have to massage the pipeline into sending that?
Or I guess we could say that's kinda crazy, and we could rewire FedoraUpdateMessageBuilder to work more sensibly. To me it'd make sense if, for updates, we called:
i.e. the artifact ID is the advisory ID, the additional artifact IDs are the NVRs. Then the message builder could easily construct the message in the intended form:
It feels to me like maybe the FedoraUpdateMessageBuilder design is very old and possibly predates the
additionalArtifactsconcept or something? Do we know if anything actually uses that path ATM?After that, we'd have to look at the thing that converts CI messages to resultsdb results - ci-resultsdb-listener. It currently seems to make some assumptions that are only valid for RPM build type messages - just look at the main message body constructor:
so I suspect it cannot currently report results for update type messages. So we'd also need to fix that.
Quick note, if you have a python-based approach or ideas for one, that would be preferred as we can migrate it to packit. I can figure out the missing bits of getting that into jenkins and hooking into the pipeline.
That would also bring us closer to the other ticket on exposing specific subtests also.
Approach to which bit? Publishing messages? Like, rewrite the
sendMessagestuff as a standalone Python script or something? I mean, sure, we can do that, but it's rather beyond the scope of this ticket I think?I don't have one handy, because we send the openQA messages out of openQA itself, so it's done in perl, as a custom openQA plugin that extends the upstream AMQP plugin.
Yeah, but
Oh well, let's see if hacking in the java thing is not a nightmare. Last time I looked at it, my tab did not remain open for long, but let's see if enough tea and this breakdown will help with that. What is the message schema expected on
resultdbside?When I checked it, it just concatenated those two and the current logic is to loop over
additionalArtifactIds. Maybe better would be to add a separate logic forbodhiUpdatethat overrides it.Well, when we make enable rpminspect on it, it would be just as spammy 😅, but at least there it should have different results shown.
Honestly I think I can work on this, I mostly filed the ticket as a notice of intent / research and to flag up the question I asked: do we work with the format
FedoraUpdateMessageBuildercurrently expects, or change it to expect a less-weird format?I'd prefer to change it, but if there's something that actually uses the current format, that would be an argument for keeping it the way it is. I suspect there isn't, though. Today I intended to poke about a bit and try to find out.
resultsdb inherently has almost no expectations; iirc the only actual rules are you have to provide some kind of "test name" and you have to provide an outcome that's within the set the resultsdb instance knows of. Outside of that everything is in the air.
I made up some expectations, though, in the form of a Python project called resultsdb_conventions which encodes some opinions about what results for various types of artifact should look like. openQA uses that project and so its results are in the format it expects/enforces. It seems sensible to me that
ci-resultsdb-listenershould follow the same format, even if we don't make it literally use resultsdb_conventions. The format isn't particularly complex for update results. It doesn't currently include / expect the list of NVRs tested, but if we found it useful we could add that, I guess.If you're looking at
sendMessage, yeah, that's correct. It currently is hardwired to (attempt to) publish a message for every single artifact ID, including all the ones inadditionalArtifactIds. But of course we could change that fairly easily. Or there's other ways to slice the cat - if we decide it's OK to rewrite the update path, I will just figure out whatever looks best to me as I go along.@adamwill wrote in #561 (comment):
There is an OSCI elephant lurking behind you. Yeah, they are pulling that one 🤷. As long as it's an additive interface it should be fine though, and they are locking specific git commits anyway.
Hmm, but there must be some format that is then consumed by bodhi to display it right? Main reason for the schema question is that I find it easier to visualize an example payload from it (in retrospect I might have spent way too much time writing json schemas 😅).
Yeah, indeed. Bodhi's requirement is simply that the result's
typeis"bodhi_update"and itsitemis the advisory ID:github.com/fedora-infra/bodhi@7e598c7d9b/bodhi-server/bodhi/server/models.py (L2327)The format we use for openQA update results (produced by resultsdb_conventions) is not complicated, here's a sample message. The only bits of that which actually matter for Bodhi are the outcome, the testcase, the type, the item, and the scenario. Oh, and maybe the logs link?
Are you sure? I did a search for "fedora-update" in the fedora-ci org on GitHub and didn't turn up anything. I also looked through recent ci.* messages and didn't spot any update ones that didn't come from openQA. Is there definitely something using FedoraUpdateMessageBuilder ?
@adamwill wrote in #561 (comment):
Not
FedoraUpdateMessageBuilderper se, but ofjenkins-pipeline-libraryas a whole: https://github.com/fedora-ci/jenkins-pipeline-library/pull/100#issuecomment-4224117840oh sure, I was assuming plenty of things use the library. But if nothing is actually using FUMB ATM, I can rewrite that specific path to behave the way that makes sense to me, that's the point.
Yeah, I expect it should be fine modulo someone used it through some inheritance for some reason.
@adamwill wrote in #561 (comment):
Wish they didn't with the current state of maintenance 🥲. Well hopefully we can just pass the problem down to osci when we can finally drop Jenkins
I think I can provide some context here 😉
It's structured like this:
*-triggerpipelines understand the events that should be triggering CI -- this can be a new koji/module build, Pagure MR opened/updated/commented on, Bodhi update, ... triggers translate those events into pipeline params*-pipelineis what encapsulates the actual test. Tests expect certain type of artifact(s) on input, e.g. Koji build, Red Hat module. That's why -trigger doesn't pass for example Bodhi update id to the test, because the test doesn't know what to do with it.*-pipeline,ARTIFACT_IDparam is what will be tested and the results will be reported for this artifact, andADDITIONAL_ARTIFACT_IDSare just additional artifacts that should be present in the environment during testingSometimes, the trigger is a scratch build from Koji, so the
ARTIFACT_IDiskoji-build:1234, but this scratch build was created in a Pagure pull request and the result must be reported for the merge request (which didn't trigger the pipeline), otherwise Pagure listener won't catch the result. However, the actual test expects the Koji build on the input, because it doesn't know what to do with Pagure merge requests... And the solution for this problem is the weird(koji-build:1234)->fedora-dist-git:ff0abcsyntax. It basically means "test this artifact, but report results for that other artifact". All you need to do is to pass thisARTIFACT_IDparam from the trigger pipeline to the test pipeline. And the library should just correctly handle it.If it's written this way, the same test pipeline transparently handles many combinations of triggers and outputs, without various "if this artifact, but pull request in Fedora, then..." statements all over the place. And that's how it was initially running for Pagure pull requests, Koji builds, Bodhi updates, and tests/. Plus internally for Brew builds, modules, and composes.
However... most of those use cases don't exist anymore. Fedora replaced Fedora CI with Packit for pull requests, and if your only input is Bodhi update and you know that you will be only reporting results for Bodhi updates (Fedora-specific, not reusable downstream), then you don't need this. And I'd even consider bypassing messaging completely and just storing the results in ResultsDB directly...
Yep, that was the case back in 2020 as well: https://pagure.io/fedora-ci/general/issue/145
Nah... it's been working just fine for half a decade or more 😉 There wasn't really any noteworthy development around Greenwave/ResultsDB/messaging all those years...
@msrb wrote in #561 (comment):
👍for me if there is an easy way to do so.
Well, this has shifted somewhat over time, I guess. Also, it's possible for triggers to pass more than one thing to the pipeline, obviously. In this case, the trigger passes both the update ID and the NVRs to the pipeline. So we have both pieces of information to work with, at least on this path, and can do something like "if we have an update ID, use reporting path X; if we don't, use reporting path Y".
This also appears to have shifted, because we publish separate messages for everything in ADDITIONAL_ARTIFACT_IDS at present. edit: in fact, you wrote it that way. edit: well, I suppose this depends on what each pipeline passes in as
artifactIdand/oradditionalArtifactIds; the rmdepcheck one currently does not pass anartifactId, and passesARTIFACT_IDSasadditionalArtifactIds, so we report for each NVR.This idea keeps coming up, but I don't totally get it. We still ought to publish messages, because messages are useful. Someone might be listening for them. We can replace the message -> result thingy with an independent result publisher, sure, but is it actually worth the effort? The message -> result thingy is already built and works, so isn't it actually easier to just keep using it? If we were starting from a blank page I'd probably write separate message publishing / result reporting code, but given we have something that works...
I suppose the argument is "resultsdb publishes messages when you create a result anyway, so the CI messages are dupes"? I guess that's arguable. But we'd at least want a transition period for anyone using the current messages, I suppose...
@adamwill wrote in #561 (comment):
Oh I thought that the state was that
sendMessageis not using fedora_messaging to send to ResultsDB. If it does currently use, then I am also 👎 to changing it to send directly. Don't want to have to now deal with making sure that the connection to ResultsDB is healthy, do retries and all that jazz.I mean, yeah, AIUI this is how it works at present: the Jenkins pipelines call
sendMessageto publish messages, and then an instance of ci-resultsdb-listener that runs in infra consumes the message and turns it into a resultsdb report.IMBW, but that's how I've always understood it to be working.
I've sent a ci-resultsdb-listener PR that should allow for this (it should handle publishing a result if we start sending out messages by update rather than by build). But we might decide to do #562 instead, I guess? Let's talk it over at Flock.
So we decided in principle to stop publishing .ci. messages and start reporting directly to resultsdb instead. I guess we can do this pipeline by pipeline; I could start with rmdepcheck (as it's the newest), and make it report by update at the same time...