ci: run independent head-image setup steps in parallel#4045
Merged
Conversation
the publish head-images job installs go, just, qemu, buildx and cosign in sequence before goreleaser, though none depend on each other. backgrounding those installs and waiting on them before the build overlaps them, trimming setup time on every push to main. dependent ordering is preserved: the single registry login and goreleaser stay serial. actionlint has no schema yet for the parallel-steps keys (GA 2026-06-25), so a scoped ignore in .github/actionlint.yaml suppresses the two resulting messages for this one file until actionlint ships support. References DEVOPS-1029
E2E Ginkgo Tests
|
sydorovdmytro
approved these changes
Jul 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
/kind enhancement
Summary
The
build-head-imagesjob installs Go, just, QEMU, Buildx and Cosign one after another before goreleaser, though none of them depend on each other. This backgrounds those five installs and waits on them before the build so they overlap. Head images build on every push tomain, so the saving recurs far more often than on a release.Every real ordering is preserved: the single registry login and the goreleaser build stay serial, and the wait barrier guarantees all tools are on PATH before goreleaser runs.
Why background + wait (not parallel:)
This is the head-images counterpart to the release pilot (#4042) under DEVOPS-1029. It uses
background:+wait:rather than aparallel:block so actionlint keeps validating each step, including the action-pinning check; aparallel:block makes actionlint skip every nested step. Verified locally: withbackground:+wait:, a deliberately bad pin inside the group is still flagged.actionlint
actionlint (v1.7.x) has no schema for the parallel-steps keys (GA 2026-06-25). A scoped ignore in
.github/actionlint.yamlsuppresses exactly the two resulting messages, only for this file, until actionlint ships support; then it is removed.Validation
actionlintis clean locally with the scoped ignore (whole repo).main, so the parallel runtime is first exercised on the first head build after merge, not on this PR. Opening as draft, gated on the DEVOPS-1029 vcluster release pilot (ci: run independent release steps in parallel #4042) proving the approach on a real run first.E2E Tests
Additional test suites
References DEVOPS-1029
Note
Low Risk
CI-only workflow timing change with explicit wait barrier and unchanged serial login/build; temporary actionlint suppressions are narrowly scoped to one file.
Overview
Speeds up
build-head-imageson everymainpush by overlapping five independent tool installs (Go, just, QEMU, Buildx, Cosign) viabackground: truestep IDs and await:barrier before registry login and GoReleaser.Ordering is unchanged in practice: GHCR login and the image build still run serially; the wait step ensures all setup tools are ready first (login stays serial to avoid a
~/.docker/config.jsonrace).actionlint gets a file-scoped ignore in
.github/actionlint.yamlfor the two false positives frombackground:/ wait-only steps until actionlint supports the parallel-steps schema (DEVOPS-1029).Reviewed by Cursor Bugbot for commit aa433b9. Bugbot is set up for automated code reviews on this repo. Configure here.