Backport reproducibility fixes to release/6.x (#7610)

achamayou · web-flow · commit 1de85ad40aab · 2026-01-23T11:53:11.000Z
diff --git a/.github/workflows/bencher.yml b/.github/workflows/bencher.yml
@@ -23,7 +23,7 @@ jobs:
           tdnf -y update
           tdnf -y install ca-certificates git
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -65,7 +65,7 @@ jobs:
     name: Benchmark SNP
     runs-on: [self-hosted, 1ES.Pool=gha-c-aci-ci]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/ci-containers-ghcr.yml b/.github/workflows/ci-containers-ghcr.yml
@@ -20,7 +20,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Log in to the Container registry
         uses: docker/login-action@v3
diff --git a/.github/workflows/ci-verification.yml b/.github/workflows/ci-verification.yml
@@ -35,7 +35,7 @@ jobs:
           tdnf -y update
           tdnf -y install ca-certificates git
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install TLC dependencies
         run: |
           tdnf install -y jre wget
@@ -64,7 +64,7 @@ jobs:
         working-directory: tla
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install TLC dependencies
         run: |
           sudo apt update
@@ -84,7 +84,7 @@ jobs:
         working-directory: tla
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install TLC dependencies
         run: |
           sudo apt update
@@ -117,7 +117,7 @@ jobs:
           tdnf -y update
           tdnf -y install ca-certificates git
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install TLC dependencies
         run: |
           tdnf install -y jre wget
@@ -144,7 +144,7 @@ jobs:
         working-directory: tla
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install TLC dependencies
         run: |
           sudo apt update
@@ -177,7 +177,7 @@ jobs:
           tdnf -y update
           tdnf -y install ca-certificates git
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -32,7 +32,7 @@ jobs:
           tdnf -y update
           tdnf -y install ca-certificates git
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -61,7 +61,7 @@ jobs:
           tdnf -y update
           tdnf -y install ca-certificates git
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -97,7 +97,7 @@ jobs:
           tdnf -y update
           tdnf -y install ca-certificates git
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -157,7 +157,7 @@ jobs:
     needs: checks
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -229,7 +229,7 @@ jobs:
     needs: checks
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -44,7 +44,7 @@ jobs:
           tdnf -y update
           tdnf -y install ca-certificates git tar
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/containers-ghcr.yml b/.github/workflows/containers-ghcr.yml
@@ -30,7 +30,7 @@ jobs:
             run_js: true
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Log in to the Container registry
         uses: docker/login-action@v3
diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml
@@ -22,7 +22,7 @@ jobs:
 
       - run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/long-test.yml b/.github/workflows/long-test.yml
@@ -29,7 +29,7 @@ jobs:
           tdnf -y update
           tdnf -y install ca-certificates git
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -83,7 +83,7 @@ jobs:
           tdnf -y update
           tdnf -y install ca-certificates git
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -137,7 +137,7 @@ jobs:
           tdnf -y update
           tdnf -y install ca-certificates git
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -193,7 +193,7 @@ jobs:
           tdnf -y update
           tdnf -y install ca-certificates git
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -250,7 +250,7 @@ jobs:
           tdnf -y update
           tdnf -y install ca-certificates git
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -304,7 +304,7 @@ jobs:
           tdnf -y update
           tdnf -y install ca-certificates git
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/long-verification.yml b/.github/workflows/long-verification.yml
@@ -33,7 +33,7 @@ jobs:
           tdnf -y update
           tdnf -y install ca-certificates git
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install TLC dependencies
         run: |
           tdnf install -y jre wget
@@ -66,7 +66,7 @@ jobs:
           tdnf -y update
           tdnf -y install ca-certificates git
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install TLC dependencies
         run: |
           tdnf install -y jre wget
@@ -92,7 +92,7 @@ jobs:
         working-directory: tla
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - run: |
           sudo apt update
           sudo apt install -y default-jre wget
diff --git a/.github/workflows/npm.yml b/.github/workflows/npm.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: actions/setup-node@v4
         with:
           node-version: 24
diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Get release number from git tag (release) or latest (branch)
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -19,7 +19,7 @@ jobs:
     name: SBOM Generation
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 1
       - name: "Install SBOM tool"
@@ -45,7 +45,7 @@ jobs:
     name: Release Notes
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 1
       - name: "Check Release Notes"
@@ -66,20 +66,28 @@ jobs:
 
   image_digest:
     runs-on: [self-hosted, 1ES.Pool=gha-vmss-d16av5-ci]
+    name: Snapshot Build Image Digest and SOURCE_DATE_EPOCH
     outputs:
       image_digest: ${{ steps.digest.outputs.digest }}
+      SOURCE_DATE_EPOCH: ${{ steps.set_epoch.outputs.SOURCE_DATE_EPOCH }}
     steps:
       - id: digest
         run: |
           set -ex
           docker pull $IMAGE
           echo "digest=$(docker inspect --format='{{index .RepoDigests 0}}' $IMAGE)" >> "$GITHUB_OUTPUT"
 
+      - name: Set SOURCE_DATE_EPOCH
+        id: set_epoch
+        run: |
+          set -ex
+          epoch=$(date +%s)
+          echo "SOURCE_DATE_EPOCH=$epoch" >> $GITHUB_OUTPUT
+          echo "$epoch"
+
   build_release:
     name: Build Release
     needs: [release_notes, image_digest]
-    outputs:
-      SOURCE_DATE_EPOCH: ${{ steps.set_epoch.outputs.SOURCE_DATE_EPOCH }}
     strategy:
       matrix:
         platform:
@@ -95,14 +103,12 @@ jobs:
       options: "--user root --publish-all --cap-add NET_ADMIN --cap-add NET_RAW --cap-add SYS_PTRACE"
 
     steps:
-      - name: Set SOURCE_DATE_EPOCH env variable
-        id: set_epoch
+      - name: "Set SOURCE_DATE_EPOCH"
+        shell: bash
         run: |
           set -ex
-          epoch=$(date +%s)
-          echo "SOURCE_DATE_EPOCH=$epoch" >> $GITHUB_ENV
-          echo "SOURCE_DATE_EPOCH=$epoch" >> $GITHUB_OUTPUT
-          echo "$epoch"
+          echo "Setting SOURCE_DATE_EPOCH env variable to ${{ needs.image_digest.outputs.SOURCE_DATE_EPOCH }}"
+          echo "SOURCE_DATE_EPOCH=${{ needs.image_digest.outputs.SOURCE_DATE_EPOCH }}" >> $GITHUB_ENV
 
       - name: "Checkout dependencies"
         shell: bash
@@ -112,7 +118,7 @@ jobs:
           tdnf --snapshottime=$SOURCE_DATE_EPOCH -y update
           tdnf --snapshottime=$SOURCE_DATE_EPOCH -y install ca-certificates git
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -127,6 +133,10 @@ jobs:
         run: |
           set -ex
           git config --global --add safe.directory /__w/CCF/CCF
+          # Ensure all files have timestamps strictly after SOURCE_DATE_EPOCH,
+          # otherwise rpmbuild will not clamp to SOURCE_DATE_EPOCH and the build
+          # will not be reproducible.
+          find . -type f -exec touch {} +
           mkdir build
           cd build
           cmake -GNinja -DCOMPILE_TARGET=${{ matrix.platform.name }} -DCLIENT_PROTOCOLS_TEST=ON -DCMAKE_BUILD_TYPE=Release ..
@@ -345,9 +355,9 @@ jobs:
         run: |
           set -ex
           gpg --import /etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY
-          tdnf --snapshottime=${{ needs.build_release.outputs.SOURCE_DATE_EPOCH }} -y update
-          tdnf --snapshottime=${{ needs.build_release.outputs.SOURCE_DATE_EPOCH }} -y install ca-certificates git
-      - uses: actions/checkout@v4
+          tdnf --snapshottime=${{ needs.image_digest.outputs.SOURCE_DATE_EPOCH }} -y update
+          tdnf --snapshottime=${{ needs.image_digest.outputs.SOURCE_DATE_EPOCH }} -y install ca-certificates git
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Download Prebuilt Packages
@@ -367,8 +377,12 @@ jobs:
         shell: bash
         run: |
           set -ex
-          tdnf install --snapshottime=${{ needs.build_release.outputs.SOURCE_DATE_EPOCH }} -y jq
+          tdnf install --snapshottime=${{ needs.image_digest.outputs.SOURCE_DATE_EPOCH }} -y jq
           git config --global --add safe.directory /__w/CCF/CCF
+          # Ensure all files have timestamps strictly after SOURCE_DATE_EPOCH,
+          # otherwise rpmbuild will not clamp to SOURCE_DATE_EPOCH and the build
+          # will not be reproducible.
+          find . -type f -exec touch {} +
           ./reproduce/reproduce_rpm.sh repro/reproduce-${{ matrix.platform.name }}.json
           RPM_NAMES=$(ls "$REPRO_DIR" || true)
           if [ -z "$RPM_NAMES" ]; then
@@ -398,7 +412,7 @@ jobs:
     name: Create Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 1
       - name: Download Packages
