Add AXIOM check gating to workflow by vrokad · Pull Request #34 · qualcomm-linux/debusine-action

Vedant Rokad (vrokad) · 2026-06-03T05:32:56Z

Add AXIOM_Check job bound to the AXIOM_CHECK environment, which sits between build and release and is auto-approved by the service account once AXIOM tests pass.
Make the gate opt-in per caller repo via the AXIOM_ENABLE variable: set to 'true' to enforce AXIOM_Check, unset or 'false' to skip it and fall back to the existing Production manual review only for the AXIOM disable targets.

Robie Basak (basak-qcom)

Overall this is in the shape I expect, thanks!

Is it possible to test this before landing into the main branch, please, so that we can be assured that we're not impacting Debusine CI in production until we've seen the integration working? For example, we could push this PR to a branch called enable-axiom and push a similar enable-axiom branch in one of the enabled pkg-* repositories with minor changes to .github/workflows/ in that pkg-* branch to call this enable-axiom branch instead of main. Then we could see the whole thing working end-to-end before landing it.

Should these be called Axiom, or Coral, as it's Coral that we're interacting with here?

The overall behaviour matches our plan I believe, but from the perpsective of a new developer familiar with GitHub Actions inspecting this code, this code would be quite confusing. Could you please explain concisely in comments the behaviour that would be surprising to somebody in that position? I suppose that's 1) Coral watches for this specific job by name (actually, does it any more?); 2) Coral will approve the environment deploy if Axiom reports passed; 3) the release job is intended to continue if Axiom isn't enabled.

Is this intended to apply only to the release flow, or additionally to dailies and PRs? For PRs, is there a race between the PR being filed and this new job running where the PR will appear to pass without the Coral check appearing yet? If so, maybe we should address that by explicitly adding the check in advance?

Robie Basak (basak-qcom) · 2026-06-09T08:07:55Z


+  AXIOM_Check:
+    name: AXIOM_Check
+    if: ${{ inputs.release && vars.AXIOM_ENABLE == '1' }}


If vars.AXIOM_ENABLE == 'true', then this won't enable Axiom. What's conventional in the GitHub Actions space to deal with this without surprises, please?

yes true, It's recommended and idle way to do this is using 'true' rather 1, as GitHub variable is string, I updated it to the 'true', Is it okay with that or should we keep both 'true' and '1' so it can enable based on anyone.

I'm fine with whatever is the established convention.

Vedant Rokad (vrokad) · 2026-06-15T15:52:03Z

#39

Please review this PR

This I have created with the enable-axiom branch as you suggested.

Vedant Rokad (vrokad) · 2026-06-17T06:14:31Z

I have tested the the Axiom and Production environment gates in below workflows with the pkg-android-platform-tools repo

Debusine Daily: https://github.com/qualcomm-linux/pkg-android-platform-tools/actions/runs/27607525489
Debusine Release: https://github.com/qualcomm-linux/pkg-android-platform-tools/actions/runs/27611242786

Vedant Rokad (vrokad) · 2026-06-24T22:05:32Z

Tested here:
Debusine Daily: https://github.com/qualcomm-linux/pkg-android-platform-tools/actions/runs/28074641374
Debusine Release: https://github.com/qualcomm-linux/pkg-android-platform-tools/actions/runs/27611242786

With the debusine-action@enable-axiom

Robie Basak (basak-qcom)

This looks good, thanks.

I'd like to see it all working end-to-end before landing though please. I was expecting to see check run results against the commit tested by Axiom. Is that side operational yet please?

Robie Basak (basak-qcom) · 2026-07-14T16:14:42Z

          debusine-action/lib/generate-step-summary

+  AXIOM_Check:
+    name: AXIOM_Check


Can this be just AXIOM Check as it's a user readable name that appears in the UI? The job ID can stay as AXIOM_Check of course.

Yes sure, I updated it.

Robie Basak (basak-qcom) · 2026-07-14T16:17:01Z


+  AXIOM_Check:
+    name: AXIOM_Check
+    if: ${{ inputs.release && vars.AXIOM_ENABLE == '1' }}


I'm fine with whatever is the established convention.

github-advanced-security · 2026-07-27T05:17:44Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

- Add AXIOM_Check job bound to the AXIOM_CHECK environment, which sits between build and release and is auto-approved by the service account once AXIOM tests pass. - Make the gate opt-in per caller repo via the AXIOM_ENABLE variable: set to 'true' to enforce AXIOM_Check, unset or 'false' to skip it and fall back to the existing Production manual review only for the AXIOM disable targets. Signed-off-by: Vedant Rokad <vrokad@qti.qualcomm.com>

Add workflow_kind input and gate AXIOM execution using workflow-specific enablement variables. This allows enabling/disabling AXIOM checks per service/workflow instead of applying a global setting. Signed-off-by: Vedant Rokad <vrokad@qti.qualcomm.com>

Vedant Rokad (vrokad) · 2026-08-17T07:36:36Z

Base Commit: 74b81f5 (AXIOM Enable Globally for all the services: As discussed earlier)
new commit: 1e8170b (AXIOM Enable based on workflow-kind for service based enablement)

Tested Workflows:

Gated: https://github.com/qualcomm-linux/pkg-android-platform-tools/actions/runs/31419788506
Skipped: https://github.com/qualcomm-linux/pkg-android-platform-tools/actions/runs/31421102364

- Add the workflow kind parameter into master copy for AXIOM Enablement based on service Signed-off-by: Vedant Rokad <vrokad@qti.qualcomm.com>

Signed-off-by: Vedant Rokad <vrokad@qti.qualcomm.com>

Vedant Rokad (vrokad) requested a review from Robie Basak (basak-qcom) June 3, 2026 05:32

Abin Joseph (abinjose-qualcomm) suggested changes Jun 3, 2026

View reviewed changes

Comment thread .github/workflows/debusine.yml

Vedant Rokad (vrokad) requested a review from Abin Joseph (abinjose-qualcomm) June 4, 2026 04:07

Robie Basak (basak-qcom) reviewed Jun 9, 2026

View reviewed changes

Vedant Rokad (vrokad) force-pushed the main branch 3 times, most recently from 29fc44b to 3fbe6bc Compare June 15, 2026 15:13

Vedant Rokad (vrokad) force-pushed the main branch from 3fbe6bc to 456c8f3 Compare June 17, 2026 18:37

Vedant Rokad (vrokad) changed the title ~~ci: add AXIOM_Check gate between build and release~~ Add sources JSON generation and AXIOM check gating to workflow Jun 17, 2026

Vedant Rokad (vrokad) force-pushed the main branch 2 times, most recently from baabd8a to 2f7fe74 Compare June 17, 2026 18:43

Vedant Rokad (vrokad) force-pushed the main branch from 2f7fe74 to 44d1c89 Compare June 24, 2026 22:02

Vedant Rokad (vrokad) changed the title ~~Add sources JSON generation and AXIOM check gating to workflow~~ Add AXIOM check gating to workflow Jun 24, 2026

Vedant Rokad (vrokad) requested a review from Robie Basak (basak-qcom) June 30, 2026 04:25

Vedant Rokad (vrokad) force-pushed the main branch from 44d1c89 to 7029e3e Compare July 8, 2026 04:53

Robie Basak (basak-qcom) reviewed Jul 14, 2026

View reviewed changes

Robie Basak (basak-qcom) mentioned this pull request Jul 15, 2026

Add generation and upload of apt sources files and metadata #43

Open

Vedant Rokad (vrokad) force-pushed the main branch 2 times, most recently from c194773 to ebf0e4c Compare July 16, 2026 06:59

Vedant Rokad (vrokad) force-pushed the main branch from ebf0e4c to b5e57cb Compare July 27, 2026 05:17

Vedant Rokad (vrokad) force-pushed the main branch from b5e57cb to 8967b91 Compare August 1, 2026 04:43

Vedant Rokad (vrokad) force-pushed the main branch from 8967b91 to 1e8170b Compare August 17, 2026 07:15

Update the master copy of debusine workflow

a116e0b

- Add the workflow kind parameter into master copy for AXIOM Enablement based on service Signed-off-by: Vedant Rokad <vrokad@qti.qualcomm.com>

Add Specification and configuration changes for pkg-repo

1557bba

Signed-off-by: Vedant Rokad <vrokad@qti.qualcomm.com>

Uh oh!

Conversation

Vedant Rokad (vrokad) commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Robie Basak (basak-qcom) left a comment

Choose a reason for hiding this comment

Uh oh!

Robie Basak (basak-qcom) Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Vedant Rokad (vrokad) Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

Robie Basak (basak-qcom) Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Vedant Rokad (vrokad) commented Jun 15, 2026

Uh oh!

Vedant Rokad (vrokad) commented Jun 17, 2026

Uh oh!

Vedant Rokad (vrokad) commented Jun 24, 2026

Uh oh!

Robie Basak (basak-qcom) left a comment

Choose a reason for hiding this comment

Uh oh!

Robie Basak (basak-qcom) Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

Vedant Rokad (vrokad) Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

Robie Basak (basak-qcom) Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

github-advanced-security AI commented Jul 27, 2026

What Enabling Code Scanning Means:

Uh oh!

Vedant Rokad (vrokad) commented Aug 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Vedant Rokad (vrokad) commented Jun 3, 2026 •

edited

Loading

Robie Basak (basak-qcom) Jun 9, 2026 •

edited

Loading