ci: fix the ARM64 release smoke gate, which could never pass

Merged
RE
2mo ago
+19-1

Unblocks the v2.5.0 release. Without this, no release can publish at all.

The bug

sh -ec 'test "$(dpkg --print-architecture)" = arm64; command -v proxysql_binlog_reader; proxysql_binlog_reader -v'

-v prints the version and returns 1:

case 'v':
    std::cout << "proxysql_binlog_reader version " << BINLOG_VERSION << std::endl;
    return 1;

sh -e aborts on the first non-zero status, so the script fails on a perfectly
good image. publish needs arm64-smoke, so the gate blocks publishing.

This is what failed the v2.5.0 release: 17 jobs passed (including test-images
on all six distros), both arm64-smoke jobs failed, publish was skipped, and
the release was left with 8 package assets attached and no images.

The images are fine — both ubuntu24 and debian13 printed the correct
architecture and proxysql_binlog_reader version v2.5.0-0-gc4dc244. The
assertion was written against the wrong signal.

Introduced by 67885ad (ARM64 images, PR #47). v2.4.0 had no arm64-smoke
job at all, so this path has never been exercised by a successful release —
the gate meant to verify ARM64 publishing is the thing preventing it.

The fix

Pipe the version through grep, so the pipeline's status comes from grep
rather than from -v. The expected version is passed in through the
environment, which also strengthens the check: the smoke test now fails on a
stale binary in the image, which a bare exit-status check could never detect.

Regression guard

The existing contract test only asserted that the command mentions
proxysql_binlog_reader -v — which is precisely why the broken form passed
review. It now rejects a script ending in a bare -v and requires the version
assertion to be a pipeline, so this cannot silently come back.

Verification

  • release.yml parses as valid YAML.
  • Replicated all seven assertions of assert_release_arm64_smoke_contract in
    Python against the edited workflow: all pass, including the required
    proxysql_binlog_reader -v substring.
  • Confirmed the new guard rejects the old command and accepts the new one.
  • Confirmed the shell semantics against the real reader binary:
    proxysql_binlog_reader -v | grep -q "…" exits 0 on a version match and
    1 on a mismatch, despite -v itself returning 1.
  • ci-test.yml runs ruby test/verify-release-workflow.rb, so CI re-checks
    the contract itself.

Note on ordering

This must land before the release is re-cut, because the release workflow is
read from the tag's ref — re-running the failed jobs would reuse the broken
file and fail identically.

Summary by cubic

Fixes the ARM64 release smoke gate so releases can publish again. The gate ended with proxysql_binlog_reader -v, which prints the version and returns 1, so under sh -e it always failed on a good image—and since publish requires arm64-smoke, this blocked the v2.5.0 release entirely.

The smoke test now pipes -v through grep so the pipeline's status comes from grep, and asserts the expected release version from the environment, which also catches a stale binary in the image. The workflow contract test now rejects a script ending in a bare -v and requires the version assertion to be a pipeline, so the broken form cannot come back.

Summary by CodeRabbit

  • Bug Fixes
    • ARM64 release smoke tests now verify that the binary reports the expected release version, while retaining architecture and executable checks.
    • Release workflow checks now flag smoke tests that do not validate the reported version.