Why: Enterprise Linux 10 needs the same mock RPM CI
coverage already used for EL8/EL9 so packaging
regressions are caught before release.
Impact: PR CI now builds RPMs for epel-9 and epel-10,
and local platform lists include epel-10/rhel-10.
Before/After: Only epel-9 was exercised in package CI;
epel-10 is now a first-class mock target with EL10
BuildRequires name fixes.
Technical Overview:
- Add packaging/rpm/etc-mock/epel-10-x86_64.cfg using
upstream centos-stream-10 + epel-10 templates plus
Adiscon/Guardtime repo appends.
- Add packaging/rpm/etc-mock/rhel-10-x86_64.cfg based
on templates/rhel-10.tpl with project repos and the
same chroot_setup_cmd package append used by EL8/9.
- Register epel-10 and rhel-10 in packaging/rpm/config.sh
PLATOPTIONS.
- Matrix the run_checks.yml RPM job over epel-9-x86_64
and epel-10-x86_64; pass MOCK_CONFIG via step env.
- Replace mock symlink destinations before installing
custom configs so aliases are not overwritten.
- Update rsyslog-v8-stable.spec for EL10 package names:
libfastjson/liblognorm and mariadb-connector-c-devel.
Closes: https://github.com/rsyslog/rsyslog/issues/7447
Why:
Broaden daily-stable coverage to a musl-based mainstream distribution while preserving Alpine's native packaging policy.
Impact:
Maintainers can build, retain, publish, and verify signed Alpine 3.24 x86_64 packages from current rsyslog main.
Before/After:
Before: the shared archive automated APT and RPM families only.
After: it also supports an immutable, signed APK repository with clean-container installation verification.
Technical Overview:
Use Alpine's 3.24-stable rsyslog APKBUILD as the packaging baseline.
Generate ordered daily versions and signed APK packages plus an incremental APKINDEX.
Publish immutable packages and snapshots to the shared DigitalOcean Space.
Verify the exact published version in a clean Alpine 3.24 container.
Keep scheduling disabled until the first manual end-to-end publication succeeds.
Open or update an issue when a scheduled build, publish, or verification fails.
With the help of AI-Agents: Codex
Why:
DigitalOcean Spaces CDN keeps its one-hour edge TTL unless its
provider-specific max-age object metadata is present. This allowed signed
but stale repository metadata to reach verification clients.
Impact:
Daily package publishers now expose mutable metadata within 60 seconds.
Before/After:
Before, stale signed metadata passed readiness; after, exact EVR is required.
Technical Overview:
Set the Spaces max-age metadata on Debian, Ubuntu, and EL uploads.
Keep immutable package and snapshot objects cached for one year.
Require EL verification metadata to contain the expected rsyslog EVR.
Bind the downloaded primary metadata to signed repomd.xml checksums.
Install Python explicitly in every EL10 verification container.
Document the one-time purge needed for existing one-hour cache entries.
With the help of AI-Agents: Codex
Why:
Provide unattended current-main packages for the newest Enterprise Linux
generation without maintaining duplicate repositories for each clone.
Impact:
Adds a disabled-by-default daily EL10 build, publish, and install flow.
Before/After:
Before, the archive covered Debian and Ubuntu; after, it also covers EL10.
Technical Overview:
Use the current CentOS Stream 10 spec as the distro packaging baseline.
Build current rsyslog main with Mock for the EL10 x86_64 target.
Apply explicit policy for upstreamed patches and new build requirements.
Sign RPMs and repository metadata with the existing archive key.
Publish clone-neutral x86_64 and SRPM repositories to DigitalOcean Spaces.
Merge prior metadata so every immutable daily package version remains usable.
Verify exact signed installs on CentOS Stream, Rocky, Alma, and Oracle Linux.
Create or update a GitHub issue when an enabled scheduled run fails.
With the help of AI-Agents: Codex
Why:
Ubuntu users need current main builds that retain the target release's
native package definitions.
Impact:
Adds an opt-in Ubuntu 26.04 daily build, publish, and verification flow.
Before/After:
Before: daily stable packages targeted Debian 13 only.
After: Ubuntu 26.04 can publish into its own signed archive namespace.
Technical Overview:
Build current main with Ubuntu 26.04's source-package debian directory.
Apply an explicit zero-fuzz policy for known upstream package drift.
Publish immutable packages and snapshots below the Ubuntu archive path.
Verify signed metadata and exact package installation on Ubuntu 26.04.
Register build and publication phases for flake evidence and failure issues.
Keep scheduled publishing disabled until the first production run passes.
With the help of AI-Agents: Codex
Why:
The Debian container executes workflow run steps with sh by default. The
published-package verifier used Bash pipeline status syntax after its smoke
tests, so a successful install was reported as a workflow failure.
Impact:
Published Debian packages can complete the end-to-end verification gate,
while genuine install or smoke-test failures still fail the workflow.
Before/After:
Before: the exact package installed and validated, then sh rejected a Bash
array assignment.
After: the verifier explicitly uses Bash and records the pipefail result as
a scalar status.
Technical Overview:
Set the verifier job run shell to Bash and preserve the pipeline result
without an unnecessary array.
With the help of AI-Agents: Codex
Why:
Daily packages must combine current rsyslog source with the package
definitions shipped by the target Debian release. Using debian/latest
imported Testing and Unstable packaging into the Debian 13 build.
Impact:
Debian 13 daily packages now use Debian 13 maintained package layout
while retaining current main functionality and dependencies.
Before/After:
Before: the workflow cloned debian/latest and downgraded its compat level.
After: it obtains Debian 13 source package and applies explicit backport
policy for current main.
Technical Overview:
Fetch the rsyslog source package from the builder Debian repositories.
Record the selected Debian packaging baseline in the build summary.
Keep Debian 13 patch exceptions and current-source dependencies in a
version-specific policy.
Enforce zero-fuzz patch application and add current module install paths.
Use main as the scheduled daily-stable source.
Install all verification tools needed by the publication smoke test.
With the help of AI-Agents: Codex
Why:
The end-to-end Debian publisher cannot install awscli from Ubuntu 24.04
because that package has no installation candidate.
Impact:
DigitalOcean package publication can reach its upload and verification
jobs.
Before/After:
Before: publisher stopped during tool installation with apt exit 100.
After: publisher validates the AWS CLI v2 bundled with the hosted runner.
Technical Overview:
Remove awscli from the Ubuntu package installation list.
Require the hosted runner's aws command before archive work begins.
Print its version for diagnostic evidence.
Continue installing apt-utils, GnuPG, and xz support from Ubuntu.
With the help of AI-Agents: Codex
Why:
Pull requests should not consume a full Debian package-build runner when
workflow linting can cover archive automation changes cheaply.
Impact:
Debian archive packages now build only on daily or explicit manual runs.
Before/After:
Before: archive-related PRs built Debian 13 packages.
After: daily failures open an issue while PR package builds are omitted.
Technical Overview:
Remove the pull_request trigger and its PR source-ref handling.
Retain manual dispatch for bootstrap and recovery.
Restrict the operational failure issue to scheduled runs.
Include preflight status so early daily failures remain actionable.
Document the runtime policy and notification behavior.
With the help of AI-Agents: Codex
Why:
A successful upload should prove that Debian users can install and
validate the exact package exposed through the public archive.
Impact:
Publication now fails when the installed version or configuration is wrong.
Before/After:
Before: verification installed the package and printed its version.
After: it also checks dpkg provenance and validates the configuration.
Technical Overview:
Keep the smoke test in the post-publication Debian 13 container.
Compare dpkg-query output with the version produced by the build job.
Run rsyslogd -N1 to validate the installed default configuration.
Document that the public-CDN verification includes this smoke test.
With the help of AI-Agents: Codex
Why:
APT clients need anonymous access to package objects and source metadata must
be covered by publication verification.
Impact:
The Spaces-backed archive can be consumed through its CDN, and broken source
indexes fail the post-publication check.
Before/After:
Before, uploaded objects kept the private default ACL and verification covered
only Packages.xz. After, uploads are public-read and both signed indexes are
validated.
Technical Overview:
Set public-read on immutable and mutable S3 uploads, verify the signed
Sources.xz checksum and compression, and require the expected source version
for hosted publication checks.
With the help of AI-Agents: Codex
Why:
Failure evidence must only represent marked test phases, and repository
verification retries must not retain temporary files.
Impact:
Hosted failure artifacts stay semantically accurate and repeated publication
checks do not accumulate stale verification state.
Before/After:
Before, any job failure could trigger flake evidence and failed verification
attempts leaked temporary directories. After, uploads are phase-scoped and
cleanup runs on every exit path.
Technical Overview:
Gate evidence uploads on explicit step outcomes, install a safely quoted EXIT
trap for verification scratch space, and clarify that PR builds package the PR
head without publishing.
With the help of AI-Agents: Codex
Why:
The minimal Debian 13 container lacks git and Python before the main
prerequisite step, and publication verification needs a log directory.
Impact:
Pull-request builds can record the source revision, and future publication
verification can preserve failure evidence reliably.
Before/After:
Before, hosted CI stopped at the source revision step. After, the container
bootstraps required tools and prepares the verification log path.
Technical Overview:
Install git and Python immediately after checkout and create the flake-evidence
log directory before piping installation output through tee.
With the help of AI-Agents: Codex
Why:
Daily stable packages need durable multi-version retention without using
GitHub Pages as an ever-growing package store.
Impact:
Debian 13 amd64 package builds can publish to a future Spaces archive.
Before/After:
Before, staging replaced a Pages repository. After, Actions maintains an
append-only signed APT archive with at least five years of retained builds.
Technical Overview:
Build and verify Debian 13 packages in Actions, incrementally merge signed
APT indexes, and publish immutable packages and snapshots to an S3-compatible
archive. Scheduled publishing stays disabled until DigitalOcean is ready.
With the help of AI-Agents: Codex
Why:
Custom oracle diagnostics and workflow-audit placement must be reliable.
Impact:
Oracle output is captured and invalid upload lookalikes fail lint.
Before/After:
Before: heredoc text or misplaced uploads could satisfy the audit.
After: step structure, condition, and placement are checked explicitly.
Technical Overview:
- Run the VictoriaMetrics oracle through the common capture wrapper.
- Restrict upload matching to valid workflow step-key indentation.
- Require failure-aware upload conditions for every evidence step.
- Require uploads to follow recognized test-command steps.
- Add focused regression coverage and align agent documentation.
With the help of AI-Agents: Codex
Why:
Fallback logs and upload coverage must not disappear silently when
storage fails or GitHub changes the job-log representation.
Impact:
CI evidence collection now fails closed without misclassifying setup.
Before/After:
Before: several evidence gaps could pass lint or lose fallback logs.
After: ZIP logs, storage errors, and workflow registration are covered.
Technical Overview:
- Decode GitHub job-log ZIP archives without extracting untrusted paths.
- Preserve the test command outcome while failing on logging errors.
- Audit active YAML upload steps and automatic harvester registration.
- Align artifact names, opt-out guards, and permission preparation.
- Document failure-aware uploads and add focused regression tests.
- Add required license headers to the new Python tooling.
With the help of AI-Agents: Codex
Why:
Workflow lint requires POSIX text-file termination.
Impact:
The Prometheus scrape workflow passes yamllint.
Before/After:
The workflow ended without a final newline.
Technical Overview:
Restore the final newline without changing the workflow behavior.
With the help of AI-Agents: Codex
Why:
Prometheus rejects raw rsyslog statistic names containing punctuation.
Impact:
Text exposition and Remote Write now use reversible safe identifiers.
Before/After:
Unsafe names were emitted raw or collided after underscore replacement.
Technical Overview:
Use U__ values-style escaping after full metric-name construction, preserve
safe names, and escape HELP metadata. Add testbench coverage and a live
Prometheus scrape workflow.
With the help of AI-Agents: Codex
Why:
Documentation examples can drift from accepted configuration syntax.
The old hand-copied test approach checked fixtures instead of the
rendered documentation source.
Impact:
Marked documentation samples are syntax-checked in docs CI and report
coverage through the docs-samples Codecov flag.
Before/After:
Before, doc examples relied on manual review or copied tests. After,
marked RST rsyslog blocks are extracted and checked by rsyslogd -C -N1.
Technical Overview:
Add a documentation sample validator that scans doc/source for
rsyslog-doc-sample markers and validates the following rsyslog code
block with the built rsyslogd.
Support metadata for plugin requirements and generated prepend/append
fixture lines.
Wire the documentation workflow to build an instrumented rsyslogd, run
the validator, generate lcov output, and upload Codecov coverage under
the docs-samples flag.
Register the validator and its tests in the documentation dist list.
Extend local validation planning to build and run the validator when
marked documentation samples are present.
With the help of AI-Agents: OpenAI Codex
Why: The historic testbench failure-reporting backend no longer exists, so CI jobs should stop trying to post failures there.
Impact: CI failures no longer attempt outbound reports to the removed backend.
Before/After: CI exported RSYSLOG_STATSURL to a dead endpoint; CI now leaves it unset and diag.sh uses its local no-report path.
Technical Overview: Removed RSYSLOG_STATSURL from the regular container CI job, Elasticsearch matrix, Kafka distcheck lane, distro daily matrix, and impstats push workflow. The diag.sh helper remains unchanged so explicit local or future CI opt-ins can still provide a replacement URL. The devcontainer pass-through remains intact for manual users that intentionally set RSYSLOG_STATSURL.
With the help of AI-Agents: Codex
Why: macOS PR CI can run close to the job timeout, and hard job
timeouts do not leave enough room to upload failure evidence for the
flake collector.
Impact: macOS PR CI gets a 25 minute job cap and emits ci-failure
artifacts for test failures or bounded make-check timeouts.
Before/After: macOS failures relied on job logs only; now failures and
make-check timeouts publish the same short-lived evidence artifacts as
other lanes.
Technical Overview:
Raise the macos_CI job timeout from 15 to 25 minutes.
Wrap make check in a Python process-group watchdog capped at 20 minutes
so the workflow retains time for cleanup and artifact upload.
Record timeout results as a distinct run_tests status while preserving
ordinary failure handling.
Upload ci-failure artifacts with failed-tests, test-suite logs, per-test
logs, trs files, and config.log before the final failing diagnostic step.
With the help of AI-Agents: Codex
Why: the first manual staging runs exposed early workflow blockers before packages could be built for the trixie staging repository.
Impact: workflow_dispatch runs can generate versions and install trixie build dependencies from the fetched Debian packaging baseline.
Before/After: version generation depended on local Git HEAD and build-deps required unavailable debhelper compat 14; the workflow now uses GITHUB_SHA in Actions and applies a documented trixie control-file policy rewrite.
Technical Overview: Add a short_commit_sha helper that prefers a valid GITHUB_SHA and keeps git rev-parse as the local fallback.
Extend the Debian CI policy loader with control_replacements entries written as tab-separated pattern/replacement data.
Apply those replacements to the fetched Debian packaging control file before mk-build-deps evaluates Build-Depends.
Record the debhelper-compat policy in .github/debian-ci-policy.yml so the trixie staging drift remains explicit.
This fixes the failure recorded at https://github.com/rsyslog/rsyslog/issues/7302.
With the help of AI-Agents: Codex
Why: Fork pull_request jobs execute scripts from the PR checkout, so repository or organization Actions variables used for apt tuning must not be exposed to untrusted code.
Impact: Fork PR Ubuntu package jobs now run with default apt settings, while trusted in-repository PRs can still use configured apt proxy and mirror variables.
Before/After: Fork PRs received apt environment variables; now those variables are passed only when the PR head repository is the base repository.
Technical Overview:\nAdd an explicit repository-identity guard around each Ubuntu package apt tuning variable in run_checks.yml.\n\nKeep the existing Build Ubuntu package script invocation and variable names unchanged so trusted in-repository package CI remains configurable.\n\nDocument the guard beside the env block so future changes do not accidentally expose Actions variables to fork-controlled checkout scripts.\n\nLeave packaging/ubuntu/build-ubuntu.sh unchanged because it still needs to accept caller-provided local or trusted CI apt settings.\n\nWith the help of AI-Agents: Codex
Why: CI failures need enough test harness output for quick diagnosis.
Impact: CI make check jobs now print verbose Automake test details.
Before/After: Failed test logs were easier to miss; CI now requests verbose test output.
Technical Overview: Add VERBOSE=1 to direct make check invocations in the CI workflows. Apply the same setting in devtools/run-ci.sh so shared container-based CI paths inherit verbose Automake test logging. This keeps the change limited to diagnostic output and does not alter the selected tests.
With the help of AI-Agents: Codex
