fix(ci): pin ksail to v7.65.0 in system-test to avoid the 7.66.0 validate race#2184
Open
devantler wants to merge 1 commit into
Open
fix(ci): pin ksail to v7.65.0 in system-test to avoid the 7.66.0 validate race#2184devantler wants to merge 1 commit into
devantler wants to merge 1 commit into
Conversation
The system-test's ksail-cluster action installs the ksail binary with its
default `ksail-version: latest`, which currently resolves to 7.66.0. That
release has a non-deterministic race in `ksail workload validate`'s
in-process parallel Helm rendering: it corrupts the rendered manifest
stream at a random point and fails validation with varying YAML parse
errors ("mapping values are not allowed in this context", "could not find
expected ':'", "did not find expected key") on a different kustomization
(and a different line) each run. This intermittently fails the System
Test on k8s PRs (observed blocking #2180; reproduced locally — 7.66.0
fails, 7.65.0 passes 97/97 across ksail.yaml and ksail.prod.yaml).
Pin the installed binary to v7.65.0, matching the action ref already
pinned on this step. Reversible: drop the pin once a ksail release fixes
the race.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![botantler[bot]](https://avatars.githubusercontent.com/in/1025824?s=60&v=4){kind=small}
Contributor
Author
|
Upstream bug filed: devantler-tech/ksail#5362 — drop this pin once a ksail release ships the fix. |
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The System Test (
ksail workload validate) fails intermittently on k8s PRs — it blocked #2180. The failure is a YAML parse error in the rendered manifests, but the location and error type vary every run:line 73 / 91: mapping values are not allowed in this contextline 225 / 245 / 306: could not find expected ':' / did not find expected keyRoot cause
The
ksail-clusteraction on this step is pinned to v7.65.0, but it installs the ksail binary with its defaultksail-version: latest— currently 7.66.0. ksail 7.66.0 has a non-deterministic race inworkload validate's in-process parallel Helm rendering: it corrupts the rendered manifest stream at a random point, so validation fails on a random kustomization with a random YAML error each run. The varying line numbers/error types are the signature of the race (a real manifest defect fails at a fixed location).Verified locally with the exact CI version:
✔ 97 kustomizations validateddeterministically (bothksail.yamlandksail.prod.yaml, repeated).kubectl kustomizeof the same overlays passes (so it's the helm-render path, not the manifests).The affected overlays (
providers/{docker,hetzner}/infrastructure/controllers) aren't even touched by #2180 — confirming it's the tool, not the change.Fix
Pin the installed binary to
ksail-version: "7.65.0", matching the action ref already pinned on this step. Deterministic, and reversible — drop the pin once a ksail release fixes the race.Follow-up (separate, in the ksail repo)
The underlying bug is in ksail itself (
devantler-tech/ksail):workload validateshould serialize or isolate per-kustomization Helm rendering so concurrent renders can't corrupt each other's output. Worth a dedicated issue/fix there; this PR is just the platform-side unblock.🤖 Generated with Claude Code