fix(ci): harden packit rpm source prep (#1182)

drew · web-flow · commit 6ce988dce062 · 2026-05-06T08:55:25.000-05:00
* fix(ci): harden packit rpm source prep

Signed-off-by: Drew Newberry &lt;anewberry@nvidia.com&gt;

* fix(ci): restrict packit version tag matching

Signed-off-by: Drew Newberry &lt;anewberry@nvidia.com&gt;

* fix(ci): collect local packit rpm artifacts

Signed-off-by: Drew Newberry &lt;anewberry@nvidia.com&gt;

---------

Signed-off-by: Drew Newberry &lt;anewberry@nvidia.com&gt;
diff --git a/.github/workflows/rpm-package.yml b/.github/workflows/rpm-package.yml
@@ -59,7 +59,16 @@ jobs:
         run: |
           set -euo pipefail
           mkdir -p artifacts
-          find ~/rpmbuild/RPMS/ -name '*.rpm' -exec cp {} artifacts/ \;
+          for rpm_dir in "$HOME/rpmbuild/RPMS" "$PWD/${{ matrix.arch }}"; do
+            if [ -d "$rpm_dir" ]; then
+              find "$rpm_dir" -type f -name '*.rpm' -exec cp {} artifacts/ \;
+            fi
+          done
+          if ! compgen -G 'artifacts/*.rpm' > /dev/null; then
+            echo "::error::No RPM artifacts found"
+            find "$PWD" -maxdepth 3 -type f -name '*.rpm' -print
+            exit 1
+          fi
           echo "=== Built RPMs ==="
           ls -lah artifacts/
 
diff --git a/.packit.yaml b/.packit.yaml
@@ -17,18 +17,21 @@ srpm_build_deps:
 
 actions:
   get-current-version:
-    # Derive version from the latest upstream tag on the current branch.
-    - 'bash -c "git describe --tags --match ''v*'' --abbrev=0 HEAD | sed ''s/^v//''"'
+    # Derive version from the latest SemVer upstream tag on the current branch.
+    # Avoid operational tags such as vm-dev; Packit normalizes that to m.dev,
+    # which is not a valid Cargo package version.
+    - 'bash -c "git describe --tags --match ''v[0-9]*.[0-9]*.[0-9]*'' --abbrev=0 HEAD | sed ''s/^v//''"'
 
   create-archive:
     # Step 1: Create source tarball from git working tree.
     # Uses git ls-files + tar instead of git archive so the tarball
     # reflects any patching that Packit may have done (e.g. version bumps).
     - 'bash -c "VERSION=${PACKIT_PROJECT_VERSION} && TMPDIR=$(mktemp -d) && DIR=openshell-${VERSION} && mkdir -p ${TMPDIR}/${DIR} && git ls-files -z | xargs -0 tar cf - | tar xf - -C ${TMPDIR}/${DIR}/ && tar -czf openshell-${VERSION}.tar.gz -C ${TMPDIR} ${DIR} && rm -rf ${TMPDIR}"'
     # Step 2: Create vendored Cargo dependencies tarball for offline RPM build.
-    - 'bash -c "VERSION=${PACKIT_PROJECT_VERSION} && cargo vendor --quiet && tar -cJf openshell-${VERSION}-vendor.tar.xz vendor/ && rm -rf vendor/"'
-    # Step 3: Return BOTH archive names. Packit maps each line to Source0, Source1, etc.
-    - 'bash -c "echo openshell-${PACKIT_PROJECT_VERSION}.tar.gz && echo openshell-${PACKIT_PROJECT_VERSION}-vendor.tar.xz"'
+    - 'bash -c "VERSION=${PACKIT_PROJECT_VERSION} && CARGO_HTTP_TIMEOUT=600 CARGO_NET_RETRY=5 cargo vendor --locked --quiet && tar -cJf openshell-${VERSION}-vendor.tar.xz vendor/ && rm -rf vendor/"'
+    # Step 3: Return the primary archive name. Packit expects create-archive
+    # to print one path for Source0; Source1 is patched explicitly below.
+    - 'bash -c "echo openshell-${PACKIT_PROJECT_VERSION}.tar.gz"'
 
   fix-spec-file:
     # Update Source0 to the generated tarball name
