Repository navigation
feat(release): move micromasters to the release-resource workflow - #6248
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
The coordinated cross-repository prerequisites remain incomplete, and the generated pipeline description still documents the legacy workflow.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Migrates MicroMasters to the shared release-resource workflow used by the pipeline generator and release bot.
Changes:
- Enables the modern release workflow for MicroMasters.
- Updates ruleset documentation to reflect the opt-in.
| File | Description |
|---|---|
src/bridge/settings/apps.py |
Enables release-resource workflow and updates registry documentation. |
src/ol_infrastructure/saas/github/repositories/rulesets.py |
Updates release-bot bypass documentation. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
blarghmatey
approved these changes
Oct 7, 2026
feoh
added a commit
that referenced
this pull request
Oct 7, 2026
* fix(k8s_apps): build release-workflow images with OUTPUT_OCI The release-resource workflow's image jobs (_build_image_job and _build_release_image_job) were missing the OUTPUT_OCI fix that #5722 added to the legacy path. Images built FROM mitodl/ol-python-base carry zstd layers from the DHI base; oci-build-task's default Docker-format tarball labels them gzip, so the registry-image put's implicit get fails with "gzip: invalid header". This broke micromasters' first build after #6248 and learn-ai's release image build. Set OUTPUT_OCI and push the image/image layout directory, keeping the tarball only when uploading Sentry source maps, as the legacy path does. * test(k8s_apps): guard the source-map tarball exception on release builds A release image build that uploads Sentry source maps must skip OUTPUT_OCI and push image/image.tar, since the upload reads the unpacked rootfs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What are the relevant tickets?
Part of the release-workflow rollout under https://github.com/mitodl/hq/issues/7185.
Description (What does it do?)
Sets
release_resource_workflow=Trueon micromasters insrc/bridge/settings/apps.py. That one field switches both control surfaces:k8s-apps-metaregeneratesmicromasters-pipelinein the release-resource shape, and the release bot stops answering/doofcommands in #product-micromasters with "still on the legacy release-candidate/release pipeline".After this merges, micromasters releases the way ol-analytics-api and learn-ai do:
/doof release micromasterscutsreleases/<calver>, builds the RC image and deploys QA with a release issue; closing the issue deploys production and merges the branch back tomaster. Therelease-candidate->releaseflow and Doof stop applying.Do not merge until
uv.lockto the release number, anduv sync --lockedin micromasters CI then fails onmaster.Implementation details
release_workflow_repos(),_required_checks_bypass) now list micromasters. The ruleset bypass for the release GitHub App already covers it, since it is derived from all ofAPPS.VERSION-file app (version_file="VERSION", read bysettings.py). Its baseline tagv0.254.0is semver, so the first release'sbump-versiongoes through the transition script, usingsemver_tag_fallback.masteris 1 commit ahead of that tag.How can this be tested?
Pipeline generated locally with the flip (
uv run python -c ... build_app_pipeline(app_name='micromasters')):build-micromasters-image-from-master,build-micromasters-release-image,abandon-micromasters-release,deploy-ol-application-micromasters-{ci,qa,production}.main->master, it differs from ol-analytics-api's generated pipeline only inrefresh_stack: false,TARGET: production(micromasters' build target) and two extra Pulumi trigger paths (src/bridge/secrets/fastly.yaml,src/bridge/secrets/vector).bump-versiontransition script run against a checkout of micromastersmasterwith fix(mit-learn): drop the dead /src/django_media Granian static mount #5565 applied changes onlyVERSIONandcurrent_version, anduv lock --checkstays clean; a second bump withbump-my-version==1.3.0behaves the same.ruff checkandruff format --checkpass onsrc/bridgeand the touched file.After merge:
create-micromasters-pipelineshould fire, sinceapps.pyis ink8s-apps-meta's trigger paths.fly -t odl-inf get-pipeline -p micromasters-pipeline | grep -c NEEDS_SEEDshould then be non-zero.pulumi-release-bot) has to be closed before the bot accepts micromasters commands./doof release micromastersis the end-to-end check; thebump-versionoutput should showUpdated VERSION (replaced 0.254.0).Additional Context
Not verified: that ol-release-bot is installed on mitodl/micromasters (it needs app-level credentials; the 2026-09-11 check recorded all eight app repos as installed) and that the bot has been invited to #product-micromasters; the earlier bot notification outage came from missing channel membership.
The micromasters
releaseandrelease-candidatebranches (both at thev0.254.0tag content) and theprotected-release-branchesrepo ruleset are left for cleanup after the first release succeeds.