Add step to build a "production" fedora build on pull requests by Mab879 · Pull Request #15090 · ComplianceAsCode/content

Mab879 · 2026-09-03T18:19:22Z

Description:

Add step to build a "production" fedora build on pull requests

Rationale:

To catch issues with packaging in upstream.

Review Hints:

Check that added job ran successfully.

packit-as-a-service · 2026-09-03T18:19:29Z

Failed to load packit config file:

Cannot parse package config. ValidationError({'jobs': {0: {'job': ['Not a valid string.'], 'trigger': ['Missing data for required field.']}}})

For more info, please check out the documentation or contact the Packit team. You can also use our CLI command config validate or our pre-commit hooks for validation of the configuration.

jan-cerny · 2026-09-04T06:37:17Z

+Version:	0.1.82
+Release:	1%{?dist}


I think it will build the version 0.1.82 forever.

In the other spec file, we have this:

# Version placeholder. Copr build version is determined by utils/version.sh. See .packit.yaml config Version: 0.0.1 Release: 0%{?dist}

Try to have this thing also in this spec file.

jan-cerny · 2026-09-04T06:37:32Z

/packit build

Mab879 · 2026-09-04T12:23:55Z

Just an FYI will have to switch up the names for the required builds due to this PR.

ggbecker · 2026-09-05T08:38:36Z

+%define cmake_defines_common -DSSG_SEPARATE_SCAP_FILES_ENABLED=OFF -DSSG_BASH_SCRIPTS_ENABLED=OFF -DSSG_BUILD_SCAP_12_DS=OFF
+%define cmake_defines_specific %{nil}
+%if 0%{?rhel} && ! %{defined eln}
+%define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE -DSSG_PRODUCT_RHEL%{rhel}:BOOLEAN=TRUE -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_ANSIBLE_PLAYBOOKS_PER_RULE_ENABLED:BOOL=ON


This seems to be yielding -DSSG_PRODUCT_RHEL46:BOOL=ON

%{rhel} is being set to 46 here according to: https://artifacts.dev.testing-farm.io/9c3be016-7b69-4e04-a739-6e5026e36de3/work-cixgdpip_f/plans/ci/execute/data/guest/default-0/static-checks/rpmbuild-ctest-1/output.txt

We probably need to hardcode the RHEL version here, or build all the products instead

Suggested change

%define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE -DSSG_PRODUCT_RHEL%{rhel}:BOOLEAN=TRUE -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_ANSIBLE_PLAYBOOKS_PER_RULE_ENABLED:BOOL=ON

%define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_ANSIBLE_PLAYBOOKS_PER_RULE_ENABLED:BOOL=ON

option(SSG_PRODUCT_DEFAULT "If enabled, all default release products will be built; otherwise only explicitly enabled products will be" TRUE)

No products seem to have been built

@ggbecker I don't know if I don't miss anything but I think your concern is orthogonal.

This new spec file is for the new jobs that have "mock" in their name. In these jobs I can see that all products are built.

For example, in the job rpm-build:fedora-rawhide-x86_64:mock we can see many products built in the logs: https://download.copr.fedorainfracloud.org/results/packit/ComplianceAsCode-content-15090-mock/fedora-rawhide-x86_64/10949421-scap-security-guide/builder-live.log.gz

-- Products: -- Amazon Linux 2023: ON -- Alibaba Cloud Linux 2: ON -- Alibaba Cloud Linux 3: ON -- AlmaLinux OS 9: ON -- Anolis OS 8: ON -- Anolis OS 23: ON -- Debian 11: ON -- Debian 12: ON -- Debian 13: ON -- Example: OFF -- EKS: ON -- Fedora: ON -- Firefox: ON -- Hummingbird: ON -- Kylin Server V10: ON -- KylinSec Server 6: ON -- OCP4: ON -- RHCOS4: ON -- Oracle Linux 7: ON -- Oracle Linux 8: ON -- Oracle Linux 9: ON -- Oracle Linux 10: ON -- OpenEmbedded: ON -- openEuler 22.03 LTS: ON -- openSUSE: ON -- RHEL 8: ON -- RHEL 9: ON -- RHEL 10: ON -- RHV 4: ON -- SLES 12: ON -- SLES 15: ON -- SLES 16: ON -- SLE Micro 5: ON -- SLE Micro 6: ON -- TencentOS Server 4: ON -- Ubuntu 22.04: ON -- Ubuntu 24.04: ON -- Ubuntu 26.04: ON

If we find changes are needed here we to consider coping them Fedora. This the spec file (sans changelog) is from Fedora.

No products seem to have been built

I pulled the RPMs from the copr job, they seem to is data streams.

@ggbecker To which CI job do you link to?

It was one that built and run the static-checks/rpmbuild-ctest-1, I don't know if it is failing anymore.

I pointed out that {rhel} variable was being expanded with version of Fedora and was causing that specific test to not build any product, and on a recently introduced test, if there was no product being built, it threw an error. Previously, I believe there was no error when no product was being built, because ctest would not fail in any way.

I'm not sure if this is still valid after you reiterated here in this pull request.

the mock job seems to be building a very old version of scap-security-guide: scap-security-guide-v0.1.61-1

https://dashboard.packit.dev/jobs/copr/3938414

I'm not sure if that is relevant.

@ggbecker The issue with building RHEL 45 in static-checks job is an issue in contest: RHSecurityCompliance/contest#674 It's a pre-existing issue, not caused by this PR.

jan-cerny · 2026-09-10T15:06:26Z

/packit build

Mab879 · 2026-09-24T20:24:14Z

@jan-cerny What is needed to move this forward?

jan-cerny · 2026-09-29T07:31:59Z

@Mab879 It currently waits on @ggbecker , I will ping him.

ggbecker · 2026-09-29T08:53:56Z

/packit build

ggbecker · 2026-09-29T09:03:25Z

@Mab879 It currently waits on @ggbecker , I will ping him.

To be honest I don't know all the details of how the fedora is being built here and I don't know if the current solution is good enough.

I also see some expected checks from the CI are not being run rpm-build:centos-stream-*-x86_64.

I also replied inline, please check it.

ggbecker · 2026-09-29T09:35:42Z

I also noticed that the 0.1.61 is being fetched by packit here:

https://dashboard.packit.dev/jobs/srpm/689073

2026-09-29 08:55:37.981 repo.py           DEBUG  Parsing git remote URL 'https://github.com/ComplianceAsCode/content' and converting it to https-like URL.
2026-09-29 08:55:37.981 repo.py           DEBUG  Provided input 'https://github.com/ComplianceAsCode/content' is an url.
2026-09-29 08:55:37.981 actions_handler.py DEBUG  Running ActionName.post_upstream_clone hook.
2026-09-29 08:55:37.981 actions_handler.py DEBUG  Running ActionName.post_upstream_clone.
2026-09-29 08:55:37.981 actions_handler.py INFO   Using user-defined script for ActionName.post_upstream_clone: [['bash', '-c', 'cp tests/scap-security-guide_fedora.spec.in scap-security-guide.spec']]
2026-09-29 08:55:37.981 commands.py       DEBUG  Command: bash -c cp tests/scap-security-guide_fedora.spec.in scap-security-guide.spec
2026-09-29 08:55:38.010 upstream.py       DEBUG  No ref given or is not glob pattern
2026-09-29 08:55:38.010 upstream.py       DEBUG  We're about to get latest matching tag in the upstream repository /tmp/tmprp_nbawp.
2026-09-29 08:55:38.010 commands.py       DEBUG  Command: git tag --list --sort=-creatordate --merged=master
2026-09-29 08:55:38.027 logging.py        DEBUG  v0.1.61
2026-09-29 08:55:38.027 logging.py        DEBUG  v0.1.60
2026-09-29 08:55:38.027 logging.py        DEBUG  v0.1.59
2026-09-29 08:55:38.027 logging.py        DEBUG  v0.1.58

ggbecker · 2026-09-29T09:36:40Z

+   targets:
+   - fedora-all-x86_64
+   actions:
+     post-upstream-clone:


Suggested change

post-upstream-clone:

get-current-version:

- bash utils/version.sh

post-upstream-clone:

Also add the get-current-version on this step as well

Mab879 · 2026-10-02T12:41:45Z

I also see some expected checks from the CI are not being run rpm-build:centos-stream-*-x86_64.

That is expected, as I had the change the names of the jobs. We will have adjust names as I mentioned in #15090 (comment).

I can adjust as suggested above.

jan-cerny · 2026-10-07T08:34:07Z

@Mab879 please rebase

packit-as-a-service · 2026-10-08T20:47:21Z

Failed to load packit config file:

Please correct data and retry.

For more info, please check out the documentation or contact the Packit team. You can also use our CLI command config validate or our pre-commit hooks for validation of the configuration.

To catch issues with packaging

jan-cerny · 2026-10-14T12:37:02Z

/packit build

jan-cerny · 2026-10-16T09:08:20Z

@Mab879 please try to wake up the packit by rebasing the PR on latest master branch

Mab879 · 2026-10-17T23:02:49Z

@Mab879 please try to wake up the packit by rebasing the PR on latest master branch

The rpm-build that are "pending" will never show up on this PR. Right before you merge this PR you will need turn off these required builds as I had to rename them to get this to work so they always so as pending.

jan-cerny · 2026-10-19T07:22:25Z

@Mab879 How did you rename them and what are their new names?

Mab879 · 2026-10-19T20:48:03Z

New name: rpm-build:centos-stream-{8,9,10}-x86_64:main

Changed due to the adding of:
https://github.com/Mab879/content/blob/6e7d3c821bd18897a65f79a0410badaf2b669930/.packit.yaml#L17

It's needed so the we can have two copr jobs.

Mab879 added this to the 0.1.83 milestone Sep 3, 2026

Mab879 force-pushed the add_prod_fedora_build branch 4 times, most recently from bea3ac0 to f2d43ca Compare September 3, 2026 19:07

Mab879 requested review from jan-cerny, matusmarhefka and vojtapolasek as code owners September 3, 2026 19:07

Mab879 force-pushed the add_prod_fedora_build branch 5 times, most recently from fd7dcc8 to 4ac1fb8 Compare September 3, 2026 20:30

jan-cerny reviewed Sep 4, 2026

View reviewed changes

jan-cerny self-assigned this Sep 4, 2026

ggbecker reviewed Sep 5, 2026

View reviewed changes

ggbecker reviewed Sep 29, 2026

View reviewed changes

Mab879 force-pushed the add_prod_fedora_build branch from 4ac1fb8 to 41094cc Compare October 4, 2026 20:09

openshift-ci Bot added the needs-rebase Used by openshift-ci bot. label Oct 6, 2026

Mab879 force-pushed the add_prod_fedora_build branch from 41094cc to 923eeda Compare October 8, 2026 20:47

openshift-ci Bot removed the needs-rebase Used by openshift-ci bot. label Oct 8, 2026

Mab879 force-pushed the add_prod_fedora_build branch from 923eeda to e79c021 Compare October 8, 2026 20:48

Add step to build a "production" fedora build on pull requests

6e7d3c8

To catch issues with packaging

Mab879 force-pushed the add_prod_fedora_build branch from e79c021 to 6e7d3c8 Compare October 8, 2026 20:50

jan-cerny approved these changes Oct 21, 2026

View reviewed changes

jan-cerny merged commit 4f350f0 into ComplianceAsCode:master Oct 21, 2026
78 of 81 checks passed

Mab879 deleted the add_prod_fedora_build branch October 21, 2026 16:13

	%define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE -DSSG_PRODUCT_RHEL%{rhel}:BOOLEAN=TRUE -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_ANSIBLE_PLAYBOOKS_PER_RULE_ENABLED:BOOL=ON
	%define cmake_defines_specific -DSSG_PRODUCT_DEFAULT:BOOLEAN=FALSE -DSSG_SCIENTIFIC_LINUX_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_CENTOS_DERIVATIVES_ENABLED:BOOL=OFF -DSSG_ANSIBLE_PLAYBOOKS_PER_RULE_ENABLED:BOOL=ON

Conversation

Mab879 commented Sep 3, 2026

Description:

Rationale:

Review Hints:

Uh oh!

packit-as-a-service Bot commented Sep 3, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jan-cerny commented Sep 4, 2026

Uh oh!

Mab879 commented Sep 4, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mab879 Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jan-cerny commented Sep 10, 2026

Uh oh!

Mab879 commented Sep 24, 2026

Uh oh!

jan-cerny commented Sep 29, 2026

Uh oh!

ggbecker commented Sep 29, 2026

Uh oh!

ggbecker commented Sep 29, 2026

Uh oh!

ggbecker commented Sep 29, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Mab879 commented Oct 2, 2026

Uh oh!

jan-cerny commented Oct 7, 2026

Uh oh!

packit-as-a-service Bot commented Oct 8, 2026

Uh oh!

jan-cerny commented Oct 14, 2026

Uh oh!

jan-cerny commented Oct 16, 2026

Uh oh!

Mab879 commented Oct 17, 2026

Uh oh!

jan-cerny commented Oct 19, 2026

Uh oh!

Mab879 commented Oct 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Mab879 Sep 8, 2026 •

edited

Loading