Skip to content

feat(v1.3): make release artifacts and images reproducible - #9235

Merged
mengw15 merged 3 commits into
release/v1.3from
backport/8812-make-release-artifacts-and-images-reprod-v1.3
Nov 1, 2026
Merged

mengw15 merged 3 commits into
release/v1.3from
backport/8812-make-release-artifacts-and-images-reprod-v1.3

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

What changes were proposed in this PR?

Automated backport of #8812 to release/v1.3.

Source: d79ac16 · automation run

Any related issues, documentation, discussions?

Backport of #8812. Originally linked #8809.

How was this PR tested?

Release-branch CI runs on this branch once the conflicts are resolved and this PR is marked ready for review.

Was this PR authored or co-authored using generative AI tooling?

No.

### What changes were proposed in this PR?
Previously, a variety of things caused Texera images built
from the same source to not have the same binary output from
invocation to invocation. Having this kind of binary
build reproducibility is a requirement when performing
Apache releases not on developer-owned hardware, because the
release has to be verified on developer owned hardware by
rebuilding it and getting the exact same artifact.

This change allows all release artifacts to be binary
reproducible with effectively one piece of information,
though in two different formats. These build arguments
contain the date: SOURCE_DATE_EPOCH and PACKAGE_SNAPSHOT.
The first sets a uniform timestamp wherever a timestamp
is present, and the second sets the snapshot of the apt
repositories used in image builds.

One other piece of information is implicit, but important
in practice. Binary reproducibility is inherently dependent
on the versions of tools used to produce said binaries.
Most of them are pinned within the container build files, but
the container builder itself is another piece of necessary
information (e.g. buildah vs. buildx) for reproducing
a build from its source and time.

### Any related issues, documentation, discussions?
Closes #8809. Discussion: #8807.

### How was this PR tested?
`bin/README.md` documents what is pinned and how to rebuild an image;
the vote email gives voters the command that rebuilds both tarballs.

Meng and I went back and forth, building all of the release images on
each of our machines (an ARM Mac, and a x86 Linux machine) and compared
the hashes each of us got. We eventually got all of them to line up.

### Was this PR authored or co-authored using generative AI tooling?
Yes, Claude Opus 5.5

---------

(backported from commit d79ac16)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor Author

The cherry-pick conflicted and was committed with conflict markers. Resolve the conflicts on this branch, then mark this PR ready for review.

Conflicting files:

  • .github/workflows/create-release-candidate.yml
  • amber/src/main/resources/cache.ccf

@github-actions github-actions Bot added engine dependencies Pull requests that update a dependency file frontend Changes related to the frontend GUI ci changes related to CI docs Changes related to documentations infra common platform Non-amber Scala service paths labels Oct 30, 2026
@github-actions

Copy link
Copy Markdown
Contributor Author

Automated Reviewer Suggestions

Based on the git blame history of the changed files, we recommend the following reviewers:

  • Committers with relevant context: @parshimers
    You can request their reviews formally with /request-review @parshimers.

  • Contributors with relevant context: @bobbai00, @mengw15, @Ma77Ball
    You can notify them by mentioning @bobbai00, @mengw15, @Ma77Ball in a comment.

@codecov-commenter

codecov-commenter commented Oct 30, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.11%. Comparing base (8b661db) to head (58a468c).
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@                Coverage Diff                 @@
##             release/v1.3    #9235      +/-   ##
==================================================
- Coverage           94.11%   94.11%   -0.01%     
+ Complexity           4811     4810       -1     
==================================================
  Files                1194     1194              
  Lines               48648    48657       +9     
  Branches             5868     5868              
==================================================
+ Hits                45784    45792       +8     
  Misses               1410     1410              
- Partials             1454     1455       +1     
Flag Coverage Δ
access-control-service 81.00% <ø> (ø)
agent-service 99.32% <ø> (ø)
amber 90.11% <ø> (-0.01%) ⬇️
computing-unit-managing-service 73.67% <ø> (ø)
config-service 87.00% <ø> (ø)
file-service 87.75% <ø> (ø)
frontend 96.89% <100.00%> (+<0.01%) ⬆️
notebook-migration-service 79.31% <ø> (ø)
pyamber 98.18% <ø> (ø)
workflow-compiling-service 77.19% <ø> (ø)

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@mengw15

mengw15 commented Oct 30, 2026

Copy link
Copy Markdown
Contributor

@parshimers Thanks for resolving this. One more thing: release/v1.3 has no bin/observability/ (#5377 is main-only), so the observability lines in create-release-tarballs.sh fail there (fatal: pathspec 'bin/observability/' did not match any files), along with the matching checks in test_create_release_tarballs.sh. They cherry-pick cleanly, so they weren't in the conflict list; could you drop them here? Also, cache.ccf ended up one blank line short of release/v1.3's; restoring it keeps that file out of this PR.

@github-actions

github-actions Bot commented Oct 30, 2026 •

Copy link
Copy Markdown
Contributor Author

⚠️ Benchmark changes need a look

🟢 2 better · 🔴 5 worse · ⚪ 8 noise (<±5%) · 0 without baseline

Compared against main 8b661db benchmarked on this same runner, so the delta is largely free of cross-runner hardware noise. The "7d avg" column still reflects the gh-pages dashboard. Treat <±5% as noise unless repeated.

Dashboard · Run

config throughput MB/s latency max Δ latest / 7d
🔴 bs=10 sw=10 sl=64 435 0.265 22,622/27,464/27,464 us 🟢 -24.3% / 🔴 +91.9%
⚪ bs=100 sw=10 sl=64 966 0.59 102,630/119,214/119,214 us ⚪ within ±5% / 🔴 +19.7%
🔴 bs=1000 sw=10 sl=64 1,131 0.691 879,122/1,025,886/1,025,886 us 🔴 +9.2% / 🔴 +7.1%
Baseline details

Latest main 8b661db from same runner

config metric PR latest main 7d avg Δ latest Δ 7d
bs=10 sw=10 sl=64 throughput 435 tuples/sec 464 tuples/sec 863.45 tuples/sec -6.3% -49.6%
bs=10 sw=10 sl=64 MB/s 0.265 MB/s 0.283 MB/s 0.527 MB/s -6.4% -49.7%
bs=10 sw=10 sl=64 p50 22,622 us 20,040 us 11,790 us +12.9% +91.9%
bs=10 sw=10 sl=64 p95 27,464 us 36,303 us 14,459 us -24.3% +89.9%
bs=10 sw=10 sl=64 p99 27,464 us 36,303 us 17,630 us -24.3% +55.8%
bs=100 sw=10 sl=64 throughput 966 tuples/sec 949 tuples/sec 1,138 tuples/sec +1.8% -15.1%
bs=100 sw=10 sl=64 MB/s 0.59 MB/s 0.579 MB/s 0.694 MB/s +1.9% -15.0%
bs=100 sw=10 sl=64 p50 102,630 us 103,044 us 92,850 us -0.4% +10.5%
bs=100 sw=10 sl=64 p95 119,214 us 124,759 us 99,554 us -4.4% +19.7%
bs=100 sw=10 sl=64 p99 119,214 us 124,759 us 114,049 us -4.4% +4.5%
bs=1000 sw=10 sl=64 throughput 1,131 tuples/sec 1,133 tuples/sec 1,167 tuples/sec -0.2% -3.1%
bs=1000 sw=10 sl=64 MB/s 0.691 MB/s 0.691 MB/s 0.712 MB/s 0.0% -3.0%
bs=1000 sw=10 sl=64 p50 879,122 us 878,742 us 915,630 us +0.0% -4.0%
bs=1000 sw=10 sl=64 p95 1,025,886 us 939,443 us 958,207 us +9.2% +7.1%
bs=1000 sw=10 sl=64 p99 1,025,886 us 939,443 us 1,006,078 us +9.2% +2.0%
Raw CSV
config_idx,batch_size,schema_width,string_len,num_batches,total_ms,total_tuples,total_bytes,tuples_per_sec,mb_per_sec,lat_p50_us,lat_p95_us,lat_p99_us
0,10,10,64,20,460.11,200,128000,435,0.265,22621.71,27464.13,27464.13
1,100,10,64,20,2069.85,2000,1280000,966,0.590,102630.46,119214.17,119214.17
2,1000,10,64,20,17676.17,20000,12800000,1131,0.691,879121.97,1025885.57,1025885.57

@parshimers
parshimers marked this pull request as ready for review October 30, 2026 23:27
@parshimers

Copy link
Copy Markdown
Member

Ah good catch. The auto merge isn't so good. Lemme fix that.

@github-actions github-actions Bot removed the engine label Oct 31, 2026

@mengw15 mengw15 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks for addressing the comments

@mengw15
mengw15 enabled auto-merge November 1, 2026 13:22
@mengw15
mengw15 added this pull request to the merge queue Nov 1, 2026
Merged via the queue into release/v1.3 with commit aaed39b Nov 1, 2026
63 of 65 checks passed
@mengw15
mengw15 deleted the backport/8812-make-release-artifacts-and-images-reprod-v1.3 branch November 1, 2026 13:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ci changes related to CI common dependencies Pull requests that update a dependency file docs Changes related to documentations frontend Changes related to the frontend GUI infra platform Non-amber Scala service paths

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants