Skip to content

Build CI orchestration from the trusted base checkout #18905

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
roshanasingh4 wants to merge 2 commits into
base: main
Choose a base branch
from
+48 −30
Open

Build CI orchestration from the trusted base checkout #18905

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cc04e09
ci: build magician from trusted base checkout
roshanasingh4 Sep 5, 2026
4cea4e5
docs(ci): clarify trusted launcher placement
roshanasingh4 Sep 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
78 changes: 48 additions & 30 deletions .ci/gcb-pr-downstream-generation-and-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,23 +41,41 @@ steps:
args:
- checkout
- origin/$_BASE_BRANCH

# Build the CI orchestration binary before merging the proposed changes. Keep
# the resulting binary and launcher in a separate pre-merge path so files from
# the head branch cannot replace the orchestration used by later steps.
- name: 'gcr.io/graphite-docker-images/build-environment'
id: build-magician-binary
entrypoint: bash
args:
- -c
- |
set -euo pipefail
mkdir -p /workspace/.trusted-magician
cd /workspace/.ci/magician
go build -o /workspace/.trusted-magician/magician_binary
cat > /workspace/.trusted-magician/exec.sh <<'EOF'
#!/bin/bash
set -e
cd /workspace/.ci/magician
exec /workspace/.trusted-magician/magician_binary "$$@"
EOF
chmod 0555 /workspace/.trusted-magician/exec.sh

- name: 'gcr.io/cloud-builders/git'
id: merged
waitFor: ["build-magician-binary"]
args:
- merge
- --no-ff
- head/$_HEAD_BRANCH

- name: 'gcr.io/graphite-docker-images/build-environment'
entrypoint: '/workspace/.ci/scripts/go-plus/magician/exec.sh'
id: build-magician-binary
waitFor: ["merged"]

- name: 'gcr.io/graphite-docker-images/build-environment'
entrypoint: '/workspace/.ci/scripts/go-plus/magician/exec.sh'
entrypoint: '/workspace/.trusted-magician/exec.sh'
id: remove-label
secretEnv: ["GITHUB_TOKEN_MAGIC_MODULES"]
waitFor: ["build-magician-binary"]
waitFor: ["merged"]
env:
- BASE_BRANCH=$_BASE_BRANCH
args:
Expand All @@ -66,10 +84,10 @@ steps:
- 'awaiting-approval'

- name: 'gcr.io/graphite-docker-images/build-environment'
entrypoint: '/workspace/.ci/scripts/go-plus/magician/exec.sh'
entrypoint: '/workspace/.trusted-magician/exec.sh'
id: tpg-head
secretEnv: ["GITHUB_TOKEN_DOWNSTREAMS"]
waitFor: ["build-magician-binary"]
waitFor: ["merged"]
env:
- BASE_BRANCH=$_BASE_BRANCH
args:
Expand All @@ -80,10 +98,10 @@ steps:
- $_PR_NUMBER

- name: 'gcr.io/graphite-docker-images/build-environment'
entrypoint: '/workspace/.ci/scripts/go-plus/magician/exec.sh'
entrypoint: '/workspace/.trusted-magician/exec.sh'
id: tpg-base
secretEnv: ["GITHUB_TOKEN_DOWNSTREAMS"]
waitFor: ["build-magician-binary"]
waitFor: ["merged"]
env:
- BASE_BRANCH=$_BASE_BRANCH
args:
Expand All @@ -94,10 +112,10 @@ steps:
- $_PR_NUMBER

- name: 'gcr.io/graphite-docker-images/build-environment'
entrypoint: '/workspace/.ci/scripts/go-plus/magician/exec.sh'
entrypoint: '/workspace/.trusted-magician/exec.sh'
secretEnv: ["GITHUB_TOKEN_DOWNSTREAMS"]
id: tpgb-head
waitFor: ["build-magician-binary"]
waitFor: ["merged"]
env:
- BASE_BRANCH=$_BASE_BRANCH
args:
Expand All @@ -108,10 +126,10 @@ steps:
- $_PR_NUMBER

- name: 'gcr.io/graphite-docker-images/build-environment'
entrypoint: '/workspace/.ci/scripts/go-plus/magician/exec.sh'
entrypoint: '/workspace/.trusted-magician/exec.sh'
id: tpgb-base
secretEnv: ["GITHUB_TOKEN_DOWNSTREAMS"]
waitFor: ["build-magician-binary"]
waitFor: ["merged"]
env:
- BASE_BRANCH=$_BASE_BRANCH
args:
Expand All @@ -122,10 +140,10 @@ steps:
- $_PR_NUMBER

- name: 'gcr.io/graphite-docker-images/build-environment'
entrypoint: '/workspace/.ci/scripts/go-plus/magician/exec.sh'
entrypoint: '/workspace/.trusted-magician/exec.sh'
id: tgc-head
secretEnv: ["GITHUB_TOKEN_DOWNSTREAMS"]
waitFor: ["build-magician-binary"]
waitFor: ["merged"]
env:
- BASE_BRANCH=$_BASE_BRANCH
args:
Expand All @@ -136,10 +154,10 @@ steps:
- $_PR_NUMBER

- name: 'gcr.io/graphite-docker-images/build-environment'
entrypoint: '/workspace/.ci/scripts/go-plus/magician/exec.sh'
entrypoint: '/workspace/.trusted-magician/exec.sh'
id: tgc-base
secretEnv: ["GITHUB_TOKEN_DOWNSTREAMS"]
waitFor: ["build-magician-binary"]
waitFor: ["merged"]
env:
- BASE_BRANCH=$_BASE_BRANCH
args:
Expand All @@ -150,10 +168,10 @@ steps:
- $_PR_NUMBER

- name: 'gcr.io/graphite-docker-images/build-environment'
entrypoint: '/workspace/.ci/scripts/go-plus/magician/exec.sh'
entrypoint: '/workspace/.trusted-magician/exec.sh'
id: tf-oics-head
secretEnv: ["GITHUB_TOKEN_DOWNSTREAMS"]
waitFor: ["build-magician-binary"]
waitFor: ["merged"]
env:
- BASE_BRANCH=$_BASE_BRANCH
args:
Expand All @@ -164,10 +182,10 @@ steps:
- $_PR_NUMBER

- name: 'gcr.io/graphite-docker-images/build-environment'
entrypoint: '/workspace/.ci/scripts/go-plus/magician/exec.sh'
entrypoint: '/workspace/.trusted-magician/exec.sh'
id: tf-oics-base
secretEnv: ["GITHUB_TOKEN_DOWNSTREAMS"]
waitFor: ["build-magician-binary"]
waitFor: ["merged"]
env:
- BASE_BRANCH=$_BASE_BRANCH
args:
Expand All @@ -178,7 +196,7 @@ steps:
- $_PR_NUMBER

- name: 'gcr.io/graphite-docker-images/go-plus'
entrypoint: '/workspace/.ci/scripts/go-plus/magician/exec.sh'
entrypoint: '/workspace/.trusted-magician/exec.sh'
id: diff
secretEnv: ["GITHUB_TOKEN_DOWNSTREAMS", "GITHUB_TOKEN_MAGIC_MODULES"]
args:
Expand All @@ -193,7 +211,7 @@ steps:
- name: 'gcr.io/graphite-docker-images/go-plus'
id: tgc-test
allowFailure: true
entrypoint: '/workspace/.ci/scripts/go-plus/magician/exec.sh'
entrypoint: '/workspace/.trusted-magician/exec.sh'
secretEnv: ["GITHUB_TOKEN_MAGIC_MODULES"]
waitFor: ["tpgb-head", "tpgb-base", "tgc-head", "tgc-base"]
args:
Expand All @@ -204,7 +222,7 @@ steps:

- name: 'gcr.io/graphite-docker-images/go-plus'
id: tgc-test-integration
entrypoint: '/workspace/.ci/scripts/go-plus/magician/exec.sh'
entrypoint: '/workspace/.trusted-magician/exec.sh'
allowFailure: true
secretEnv: ["GITHUB_TOKEN_MAGIC_MODULES"]
waitFor: ["tpgb-head", "tpgb-base", "tgc-head", "tgc-base"]
Expand All @@ -225,7 +243,7 @@ steps:
- name: 'gcr.io/graphite-docker-images/go-plus'
id: tpgb-test
allowFailure: true
entrypoint: '/workspace/.ci/scripts/go-plus/magician/exec.sh'
entrypoint: '/workspace/.trusted-magician/exec.sh'
secretEnv: ["GITHUB_TOKEN_MAGIC_MODULES"]
waitFor: ["tpgb-head", "tpgb-base"]
args:
Expand All @@ -238,7 +256,7 @@ steps:
- name: 'gcr.io/graphite-docker-images/go-plus'
id: tpg-test
allowFailure: true
entrypoint: '/workspace/.ci/scripts/go-plus/magician/exec.sh'
entrypoint: '/workspace/.trusted-magician/exec.sh'
secretEnv: ["GITHUB_TOKEN_MAGIC_MODULES"]
waitFor: ["tpg-head", "tpg-base"]
args:
Expand All @@ -250,7 +268,7 @@ steps:

- name: 'gcr.io/graphite-docker-images/go-plus'
id: gcb-tpg-vcr-test
entrypoint: '/workspace/.ci/scripts/go-plus/magician/exec.sh'
entrypoint: '/workspace/.trusted-magician/exec.sh'
secretEnv: ["GITHUB_TOKEN_DOWNSTREAMS", "GITHUB_TOKEN_MAGIC_MODULES", "GOOGLE_BILLING_ACCOUNT", "GOOGLE_CHRONICLE_INSTANCE_ID", "GOOGLE_CUST_ID", "GOOGLE_IDENTITY_USER", "GOOGLE_MASTER_BILLING_ACCOUNT", "GOOGLE_ORG", "GOOGLE_ORG_2", "GOOGLE_ORG_DOMAIN", "GOOGLE_PROJECT", "GOOGLE_PROJECT_NUMBER", "GOOGLE_SERVICE_ACCOUNT", "SA_KEY", "GOOGLE_PUBLIC_AVERTISED_PREFIX_DESCRIPTION", "GOOGLE_VMWAREENGINE_PROJECT"]
waitFor: ["diff"]
env:
Expand All @@ -268,7 +286,7 @@ steps:
- "true"

- name: 'gcr.io/graphite-docker-images/go-plus'
entrypoint: '/workspace/.ci/scripts/go-plus/magician/exec.sh'
entrypoint: '/workspace/.trusted-magician/exec.sh'
secretEnv: ["GITHUB_TOKEN_MAGIC_MODULES"]
waitFor: ["diff"]
args:
Expand Down