.github/workflows/mirror.yaml

@@ -29,6 +29,7 @@ jobs:
         username: ${{ secrets.GITLAB_USERNAME }}
         ciskip: true
     - name: Trigger EICweb
+      if: github.event_name == 'pull_request'
       uses: eic/trigger-gitlab-ci@v2
       with:
         url: https://eicweb.phy.anl.gov

.gitlab-ci.yml

@@ -21,11 +21,6 @@ variables:
   GH_REGISTRY_USER: eic
   GH_PUSH: 1
 
-  ## TLS error resiliency: number of retries and second wait between tries 
-  ## (wait time is doubled with each attempt)
-  DOCKER_NTRIES: 5
-  DOCKER_WAIT_TIME: 5
-
   ## Number of jobs to start during container builds
   JOBS: 32
 
@@ -62,6 +57,8 @@ workflow:
   rules:
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
     - if: '$CI_PIPELINE_SOURCE == "web"'
+    - if: '$CI_PIPELINE_SOURCE == "webide"'
+    - if: '$CI_PIPELINE_SOURCE == "trigger"'
     - if: '$CI_COMMIT_BRANCH == "master"'
     - if: '$CI_COMMIT_BRANCH =~ /^v[0-9]+\.[0-9]+-(alpha|beta|stable)/'          ## main stable branch: vX.Y-stable
     - if: '$CI_COMMIT_BRANCH =~ /^v[0-9]+\.[0-9]+-[a-z]+-(alpha|beta|stable)/'   ## special stable branch: vX.Y-acadia-stable (etc)
@@ -271,7 +268,7 @@ jug_dev:
         - nightly
         BASE_IMAGE: debian_stable_base
         BUILD_IMAGE: jug_
-        PLATFORM: linux/amd64,linux/arm64/v8
+        PLATFORM: linux/amd64
         ENV:
         - dev
         - prod
@@ -372,7 +369,7 @@ jug_xl:default:
           - default
           BASE_IMAGE: debian_stable_base
           BUILD_IMAGE: jug_
-          PLATFORM: linux/amd64,linux/arm64/v8
+          PLATFORM: linux/amd64
           ENV:
           - dev
   script:
@@ -421,7 +418,7 @@ jug_xl:nightly:
           - nightly
           BASE_IMAGE: debian_stable_base
           BUILD_IMAGE: jug_
-          PLATFORM: linux/amd64,linux/arm64/v8
+          PLATFORM: linux/amd64
           ENV:
           - dev
   script:

containers/jug/dev.Dockerfile

@@ -71,7 +71,7 @@ spack compiler find --scope site
 spack config blame compilers
 EOF
 
-## Setup eics3 buildcache mirrors
+## Setup buildcache mirrors
 ## - this always adds the read-only mirror to the container
 ## - the write-enabled mirror is provided later as a secret mount
 ARG S3_ACCESS_KEY=""
@@ -79,12 +79,14 @@ ARG S3_SECRET_KEY=""
 RUN --mount=type=cache,target=/var/cache/spack <<EOF
 set -e
 if [ -n "${S3_ACCESS_KEY}" ] ; then
-  spack mirror add --scope site                                         \
+  spack mirror add --scope site --unsigned                              \
       --s3-endpoint-url https://eics3.sdcc.bnl.gov:9000                 \
       --s3-access-key-id "${S3_ACCESS_KEY}"                             \
       --s3-access-key-secret "${S3_SECRET_KEY}"                         \
       eics3 s3://eictest/EPIC/spack/${SPACK_VERSION}
 fi
+spack mirror add --scope site --signed spack-${SPACK_VERSION} https://binaries.spack.io/${SPACK_VERSION}
+spack mirror add --scope site --unsigned ghcr-${SPACK_VERSION} oci://ghcr.io/eic/spack-${SPACK_VERSION}
 spack mirror list
 EOF
 

mirrors.yaml.in

 mirrors:
   eicweb:
     url: oci://${CI_REGISTRY}/${CI_PROJECT_PATH}/spack-${SPACK_VERSION}
+    signed: false
     push:
       access_pair:
       - ${CI_REGISTRY_USER}
       - ${CI_REGISTRY_PASSWORD}
   ghcr:
     url: oci://ghcr.io/eic/spack-${SPACK_VERSION}
+    signed: false
     push:
       access_pair:
       - ${GITHUB_REGISTRY_USER}
       - ${GITHUB_REGISTRY_TOKEN}
   eics3rw:
+    signed: false
     fetch:
       url: s3://eictest/EPIC/spack/${SPACK_VERSION}
       access_pair:

spack-environment/packages.yaml

@@ -246,7 +246,7 @@ packages:
     - '@1.26.26'
   py-dask:
     require:
-    - '@2021.6.2'
+    - '@2023.4.1'
   py-deepdiff:
     require:
     - '@6.3.0'

spack.sh

@@ -25,6 +25,7 @@ c07ddf83c32b7129247fe90eed486dd844047087
 64cf67822471ec2d3df2625a6d713f80cbe7ff43
 7a0c4e8017033430e5f15ed628be6b539e935ba9
 48fcfda1e7c1781cab4cada6d099823b263ab0cc
+8c29e90fa9962f4a44f39f47217b46c85176af28
 ---
 ## Ref: https://github.com/spack/spack/commit/[hash]
 ## [hash]: [description]
@@ -45,3 +46,4 @@ c07ddf83c32b7129247fe90eed486dd844047087
 ## 64cf67822471ec2d3df2625a6d713f80cbe7ff43: py-torch: move patch before def patch
 ## 7a0c4e8017033430e5f15ed628be6b539e935ba9: acts: new versions 31.*
 ## 48fcfda1e7c1781cab4cada6d099823b263ab0cc: setup-env.sh: if exe contains qemu, use /proc/$$/comm instead
+## 8c29e90fa9962f4a44f39f47217b46c85176af28: Build cache: make signed/unsigned a mirror property