test: manifest diff demo (do not merge) by brainrake · Pull Request #2622 · supabase/postgres

brainrake · 2026-11-02T23:26:37Z

DO NOT MERGE. Exercises the AMI manifest diff comment from the manifest-diff tooling PR.

Stacked on that branch. Commit 1 seeds the baseline. Commit 2 adds a visible difference.

🤖 Generated with Claude Code

Runs as a stage2 provisioner (same pattern as ansible.log), deleted before the instance is imaged. Both legs read the resulting /tmp/ami-manifest.txt: testinfra-ami-build.yml uploads it as a build artifact, ami-release-nix.yml (amd64) caches it to S3 as the develop baseline. Replaces the prior SSH-based capture, which blew the existing 10-minute test timeout hashing the whole filesystem over a remote shell. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

mtree is the standard tool for a path/mode/owner/hash directory fingerprint. Also fixes a real bug: the old find+sha256sum loop never excluded /dev or /sys, so sha256sum would hang forever on /dev/zero or /dev/random. Verified end to end against ubuntu:24.04 (11s, libarchive-tools installed then purged, clean exit). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Key the S3 path by arch so amd64/arm64 don't clobber each other's latest.txt. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

The AMI build instance has no package index cache; install failed with 'Unable to locate package'. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Matches postgres#2450's version-diff pattern: per-leg diff artifact, one job downloads all of them, find-comment + create-or-update-comment instead of a new comment per push. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

6 legs x 20000 bytes exceeded the ~65536 char comment limit, silently dropping orioledb-17's two sections entirely. 6000/leg keeps the worst case (all legs differ) comfortably under it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Per review: GH-managed GC, no ARTIFACTS_BUCKET secret threading. restore-keys prefix match gets the latest develop-side save. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Co-authored-by: Manuel Mendez <708570+mmlb@users.noreply.github.com>

Drop unused github.sha from restore key (never hits, confusing). Explain always() on manifest-diff-comment. Fix diff description: baseline is the last built AMI, not develop HEAD (cache only updates on ami-release-nix runs). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

…st-diff-tooling

It was inside the ```diff fence, so GitHub rendered it as literal text, not a link. Close the fence first. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

No more '354k lines all added' when the cache is empty: short note instead, naming what publishes the baseline. Baseline version comes from a header line stamped into the manifest at save time, shown per-leg since each PG version/arch has its own. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Mixing a # with ${{ }} directly inside a quoted shell string broke actionlint's shellcheck pass. Use env: like every other step in this file. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

sed -i "1i # ..." still broke actionlint's shellcheck pass even through an env var, reproduced with actionlint directly, cause unclear; prepend via printf+cat instead. Also drop useless echo around cat (SC2005). Verified clean with actionlint against both files. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

cache-ami-manifest (develop-side save), diff-ami-manifest (PR-side restore+diff), post-ami-manifest-comment (assemble+post), matching the repo's existing .github/actions/ convention. Net -106 lines across the two workflow files. Verified with actionlint and a functional check of the parameterized annotate logic. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Rename cache/diff/post-ami-manifest-* to cache/diff/post-manifest, parameterized by key_prefix/publish_hint/marker/title/description instead of AMI-specific inputs, so docker builds can reuse them. Cache key is now sha256 of the annotated manifest, not the nix store path: the nix path only reflects the postgres package, so ansible or apt drift with the same package version would silently collide and skip saving a new baseline. Content hash catches any real change. manifest-snapshot.sh now installs bsdtar via apk when apt-get isn't present, for Alpine-based docker images. Verified on both ubuntu:24.04 and alpine:3.23. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Reuses manifest-snapshot.sh (via docker run, not a Packer provisioner) and the generalized cache/diff/post-manifest actions. - docker-image-test.yml (runs on every PR): snapshot + diff + comment, keyed by image name (e.g. docker-manifest-17). - dockerhub-release-matrix.yml (push to develop/release): snapshot + cache the baseline. Only the arm64 leg, since docker-image-test.yml only builds/tests arm64 per PR (large-linux-arm runner) — no amd64 leg to compare against. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

snapshot-docker-manifest replaces the copy-pasted docker run block in both docker-image-test.yml and dockerhub-release-matrix.yml. Raw ami-manifest/docker-manifest artifacts weren't consumed by anything downstream (only the diff artifacts are) — dropped. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

nix run .#manifest-diff / .#manifest-comment, following the repo's own image-size-analyzer/docker-image-test convention, instead of bash embedded in composite-action YAML. Verified for real: nix build (writeShellApplication's shellcheck caught a real SC2295 quoting bug) and nix run with representative inputs for all three diff states (no baseline / unchanged / changed) plus the comment assembly. Testing also caught a real logic bug predating this refactor: the cached baseline carries a '# version:' header line that the current build's manifest never has, so every comparison showed a spurious 1-line diff removing it, even with zero real changes. Strip the header from both sides before diffing. manifest-snapshot.sh stays a plain script (not a nix package): it runs inside the AMI/container being snapshotted, which has no nix. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>