Publish updated wmf/next container when deploying config backport or security patch
Closed, ResolvedPublicFeature
Actions

Assigned To

Authored By

	bd808
	Jul 7 2025, 9:07 PM

Description

Adopt the behavior described in the design agreements that came out of T379683: [FY24-25 WE6.2.6] Create design document for Pretrain (née Group -1) deployment.

Deployment of both MediaWiki configuration (operations/mediawiki-config.git) and security patches done via scap from a deployment server will also trigger new pretrain deployments. These deployments will not happen in-process with the other wiki updates. Instead they will trigger an asynchronous build and deployment workflow. We may choose to de-duplicate triggering events so that we only deploy pretrain once as the result of a typical backport or security window.

This first step is only concerned with publishing an updated container. We will be working on actually deploying this container in a future hypothesis.

Details

Related Changes in GitLab:

Title	Reference	Author	Source Branch	Dest Branch
config.py: Reenable build_mw_next_container_image	repos/releng/scap!936	dancy	master-Iea03955c84676a9bac90b9dc00b4af385409e72a	master
kubernetes: Use separate image repo for single version image build	repos/releng/scap!935	dancy	master-I2107eb9d4c1e5eee389662547598eec702ff3169	master
config.py: Disable build_mw_next_container_image	repos/releng/scap!929	dancy	master-I6cff04283e850b595c8fff0af5716ed71b2b83c2	master
AbstractSync: Build "next" image when building regular images	repos/releng/scap!925	dancy	master-I2aeb31d412a7268bda538ccd4dcc77f8d135e3c0	master

Customize query in GitLab

Related Objects
Search...

Status	Subtype	Assigned	Task
Resolved		Lferreira	T215217 deployment-prep (beta cluster): Code stewardship request
Open	Goal	None	T369112 Pretrain (née Group -1) QTE validation environment
Resolved	Goal	dancy	T398868 [FY25-26 WE6.1.1] Move image build to deployment server and update for backports
Resolved	Feature	dancy	T398875 Publish updated wmf/next container when deploying config backport or security patch

Event Timeline

bd808 created this task.Jul 7 2025, 9:07 PM

bd808 triaged this task as High priority.

bd808 changed the subtype of this task from "Task" to "Feature Request".

dancy opened https://gitlab.wikimedia.org/repos/releng/scap/-/merge_requests/925

sync: Build "next" image when building regular images

dancy merged https://gitlab.wikimedia.org/repos/releng/scap/-/merge_requests/925

AbstractSync: Build "next" image when building regular images

Maintenance_bot removed a project: Patch-For-Review.Jul 30 2025, 10:31 PM

Mentioned in SAL (#wikimedia-operations) [2025-07-31T16:21:13Z] <dancy@deploy1003> Started scap sync-world: Testing T398875

Mentioned in SAL (#wikimedia-operations) [2025-07-31T16:24:56Z] <dancy@deploy1003> Finished scap sync-world: Testing T398875 (duration: 03m 43s)

This change is live!

The impact of building the next image during build-and-push-container-images is not noticeable:

16:21:36 Started build-and-push-container-images
16:21:36 K8s images build/push output redirected to /home/dancy/scap-image-build-and-push-log
16:21:36 K8s images build/push output redirected to /home/dancy/scap-image-build-and-push-log.next
16:21:55 Finished build-and-push-container-images (duration: 00m 18s)

(that was from a scap sync-world with no changes)

Should something go wrong, set build_mw_next_container_image to False in scap.cfg to disable this functionality.