Skip to content

.circleci/config.yml: hash all blobs files in cache key to prevent dirty builds - #2183

Merged
tlaurion merged 1 commit into
linuxboot:masterfrom
tlaurion:fix-dirty-blobs-cache
Aug 7, 2026
Merged

.circleci/config.yml: hash all blobs files in cache key to prevent dirty builds#2183
tlaurion merged 1 commit into
linuxboot:masterfrom
tlaurion:fix-dirty-blobs-cache

Conversation

@tlaurion

@tlaurion tlaurion commented Aug 7, 2026

Copy link
Copy Markdown
Collaborator

Fixes #2182.

Bug

Since PR #2165 (July 31), every CircleCI build produces ROM artifacts with
the -dirty suffix. The ROM filename includes -dirty because
GIT_STATUS (Makefile line 4) evaluates to dirty via git diff --exit-code.

Root cause

CircleCI caches the blobs/ directory in a workspace. The cache key is
computed from only *.sh files under blobs/:

find ./blobs -type f -name "*.sh" | sort -h | xargs sha256sum

PR #2165 changed two tracked files (blobs/m900/README.md and
blobs/xx80/README.md) but the cache key did not change because the
READMEs are not *.sh. The stale workspace containing old README
content was restored on top of the fresh checkout. attach_workspace
overwrites tracked files, so git diff detects modifications and
sets GIT_STATUS=dirty.

Pipeline 1397 (commit 7f00d9b9aaa, pre-#2165) was the last clean
build. Pipeline 1400 (commit a605d043030, #2165 merge) is the
first dirty build. All subsequent pipelines inherited the stale cache.

Fix

Hash all files under blobs/ for the cache key, not just
*.sh. Any tracked blob file change now invalidates the cache,
preventing stale workspace content from overwriting fresh checkouts.

… dirty builds

PR linuxboot#2165 changed blobs/m900/README.md and blobs/xx80/README.md, but
the cache key only hashed *.sh files under blobs/.  The stale cache
contained old README content, and workspace attachment overwrote
the fresh checkout, making git diff detect modifications and set
GIT_STATUS=dirty.  This caused all subsequent CircleCI builds to
produce -dirty ROM artifacts.

Fix: hash all files under blobs/ for the cache key, not just *.sh,
so the cache invalidates whenever any tracked blob file changes.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Copilot AI lite review requested due to automatic review settings August 7, 2026 17:38

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the CircleCI “x86_blobs” cache key generation so blob cache invalidation reflects any change under blobs/, preventing stale cached blob content from being restored and causing subsequent builds to be marked -dirty.

Changes:

  • Expand the blobs cache-key digest input from blobs/**/*.sh to all files under blobs/.
  • Ensure README (and other non-.sh) updates under blobs/ invalidate the cache and avoid dirty workspace overwrites.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@tlaurion tlaurion changed the title .circleci/config.yml: include all blobs files in cache key to prevent dirty builds .circleci/config.yml: hash all blobs files in cache key to prevent dirty builds Aug 7, 2026
@tlaurion tlaurion added this to the reproduciblebuilds milestone Aug 7, 2026
@tlaurion
tlaurion merged commit b957543 into linuxboot:master Aug 7, 2026
9 of 16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CircleCI publishes dirty build for clean commit, hash mismatch vs local build

2 participants