Repository navigation
perf(#9251): skip the GitLab CLI download when the image matches the pin - #9447
Merged
Merged
Conversation
The GitLab poll, dispatcher, and agent jobs source install-fullsend-cli.sh, which downloaded the pinned release CLI on every run. The runner image rendered for a release pin (X.Y.Z) or an unset pin (latest) already carries that release's CLI, so the download was redundant. The poll job runs every five minutes per project, and the download writes to /usr/local/bin. In the release path, the script now runs `fullsend --version` and skips the download when the CLI on PATH reports exactly "fullsend version X.Y.Z" for the pinned vX.Y.Z. For an unset pin the latest tag is still resolved first, so a cached :latest image that predates the newest release still downloads it. A prerelease, dev build, missing, or broken binary also downloads. Branch and SHA pins keep the source build. CA trust and the CI_DEBUG_TRACE guard run in every path. Tests stub `fullsend --version` and the latest-release lookup to cover match, mismatch, latest, and SHA pins. The ResolveFullsendVersion comment and the GitLab guide's runner image section are updated. Note: pre-commit could not fetch its hook repos (TLS failure in the sandbox); the hooks were run directly instead. semgrep was skipped because its ruleset could not be downloaded. internal/cli TestStartFetchService_* and TestPostScriptEnv_NoSchemaAppended* fail in the sandbox with and without this change. Closes #9251 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
🤖 Finished Review · ✅ Success · Started 7:42 PM UTC · Completed 7:52 PM UTC Commit: Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $1.76 |
Site previewPreview: https://f9bb7a08-site.fullsend-ai.workers.dev Commit: |
|
Risk Assessment: moderate (2/5) DetailsFocused 4-file change with clear issue alignment and no protected path changes, moderated to score 2 by elevated git history churn and coupling across GitLab scaffold and documentation files alongside modifying existing script behavior without a toggle. |
|
Looks good to me Labels: PR changes the GitLab runner-image CLI install script and its guide. |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
fullsend-ai-review
Bot
added
ready-for-merge
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
ggallen
approved these changes
Nov 13, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The GitLab scaffold's
install-fullsend-cli.shnow skips the CLI download when the CLI already in the runner image reports exactly the pinned release. This applies to release pins and unset (latest) pins. Branch and SHA pins still build from source, and the private-CA trust step andCI_DEBUG_TRACEguard run in every case.Related Issue
#9251
Changes
internal/scaffold/fullsend-repo-gitlab/.gitlab/ci/scripts/install-fullsend-cli.sh: in thev*path, runfullsend --versionand skip the download/checksum/extract when the output equalsfullsend version X.Y.Zfor the pinnedvX.Y.Z. The comparison is exact, so a prerelease (0.55.0-rc1), adev-...build, a missing or broken binary, or unexpected output all fall through to the existing checksum-verified download. The existing download code is unchanged, just indented into theelsebranch.latest(unset pin): this is a match-only check. The script still resolves the latest tag through the GitHub API, as it does today, and then compares. A cached:latestimage that predates the newest release therefore still downloads it. The API lookup stays, but the per-run binary download goes away.internal/scaffold/gitlab_job_scripts_test.go: the stubfullsendcan report a chosen version (FULLSEND_STUB_VERSION) or fail (FULLSEND_STUB_FAIL), and the stubcurlcan answer the latest-release lookup (CURL_STUB_LATEST_TAG). New tests cover:latestmatching the image, andlatestwith an older imageinternal/scaffold/installfiles.go: updated theResolveFullsendVersioncomment, which said the before_script always overwrites the image binary.docs/guides/getting-started/configuring-gitlab.md: the "Runner image version" section now describes when the jobs skip the download.The comparison string was checked against a real build: with the runner image's ldflags (
buildinfo.version=0.55.0),fullsend --versionprintsfullsend version 0.55.0.Note: when the download is skipped, the job uses the image's own binary, which is built with
CGO_ENABLED=1 -tags ORT, instead of the static release tarball. Running the image's binary is what the issue asks for.Testing
go test ./internal/scaffold/... ./internal/repos/...passesmake lint:pre-commitcould not fetch its hook repos in the sandbox (TLS failure), so the applicable hooks were run directly instead. These passed: shellcheck (same args), gofmt, go vet, whitespace/EOF/line-ending checks, lint-docs-links, lychee, lint-broken-symlinks, and the secret scan. semgrep was not run because its ruleset download is blocked in the sandbox.internal/cliTestStartFetchService_*andTestPostScriptEnv_NoSchemaAppended*fail in the sandbox with and without this change (local socket permissions / environment), so they are unrelated.Checklist
!for breaking changes)🤖 Generated with Claude Code
Closes #9251
Post-script verification
agent/9251-skip-redundant-cli-reinstall)bc4f5fe240efa31276b22ccc901ee5dabe052c8c..HEAD)