-
Notifications
You must be signed in to change notification settings - Fork 1.5k
[ACIX-1440] Only sign and notarize packages on nightly #49282
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Closed
Closed
Changes from all commits
Commits
Show all changes
76 commits
Select commit
Hold shift + click to select a range
5336f9e
sign on nightly instead of main
aiuto 8e85c0a
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto a41ced7
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 648e72f
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 1bd0a6c
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 1790e51
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto b6b4ef5
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto d14080a
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 2c0920f
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 2121931
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto a336077
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 4040491
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 0cea440
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 7d20ec8
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto daac748
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto f174c13
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto b0ee7a8
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 4d86a4f
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto ce2c899
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto d6acef1
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto d871964
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto bd0e712
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 3ae588a
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 5cf6877
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto e49320d
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto fcc8190
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 23f39b0
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 2c85cdd
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto a3b86a5
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 45ea058
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto b03eefd
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto e9ea5f1
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 272b04d
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 7e88ace
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 1ff0a81
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 96040a6
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 9baaa31
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto c1c4bbe
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto c99a09e
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto c5dc433
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 00059e3
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 79f436f
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto d9aedd7
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 2955e53
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 202b190
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 9363569
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto ddad6aa
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto e72e6e0
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 485de42
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto d01b40c
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 7cf5862
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto f0a4d51
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto b7ba47f
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto d37311e
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto e570c21
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto ecbe842
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto e445de5
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 1063220
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 19f843a
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto a967f8d
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 543f175
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 75527eb
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto b08c5df
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto c21a4ce
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 19c63da
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 2285a1b
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 574c8c0
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto f8328d8
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto c2eea67
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto b3fbe9b
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 6d1b22f
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 41f71b4
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 1a28b52
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto f932190
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto 13861d2
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto d904db0
Merge branch 'main' into aiuto/no_mac_sign_main
aiuto File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This rule switches signing to
CI_COMMIT_BRANCH == "nightly", but in this repo nightly runs are scheduled onmainand identified viaBUCKET_BRANCH(see.gitlab-ci.yml.if_scheduled_mainat lines 441-443 and.on_deploy_nightly_repo_branchat 591-595). In that common nightly context, this condition is false, soSIGN=trueis never set and DMG signing/notarization is skipped entirely until release branches.Useful? React with 👍 / 👎.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@codex is right.
I see the intent to limit Apple notarization to nightly builds, which makes sense from a cost/perf perspective. That said, since this has already been scoped down to only
mainand release branches through #45439, we’ve already moved away from Continuous Integration.At this point, I think it’s important we stop reducing coverage further, otherwise we risk missing issues earlier in the development cycle. Keeping notarization on
mainat least gives us a reasonable (frequent enough) safety net before releases.Instead please consider the following effort on optimization:
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I have been discussing this with Florent and the devx team.
We have all agreed this is sufficient.
It will both save CI time and reduce the number of fully signed images that we should never ship to customers.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think on-call engineers should be consulted when the safety net has weakened to the point where all changes made throughout the day get integrated at once, because that makes it harder to narrow down the source of any regression.
@codex is still right on the P1 issue it flagged.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
To use Codex here, create a Codex account and connect to github.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Let's discuss this off line.