feat(ci): add lock for Swift slot preemption

.github/workflows/Image.yaml

@@ -173,6 +173,12 @@ jobs:
           ./src/uploads/requirements.sh
           pip install -r src/image/requirements.txt -r src/uploads/requirements.txt
 
+      - name: Upload the lockfile for the image
+        id: swift-lock
+        run: |
+          ./src/uploads/swift_lockfile_lock.sh \
+            ${{ needs.prepare-build.outputs.oci-img-name }}
+
       # Here starts the critical section, have to be executed in sequence outside of matrix.
       - name: Get next revision number
         id: get-next-revision
@@ -222,6 +228,26 @@ jobs:
           done
 
       # Here leaves the critical section.
+      # The lock will be removed even the steps above failed,
+      # or the workflow is cancelled.
+      - name: Remove the lockfile for the image
+        # Runs if the previous steps failed, or the workflow is cancelled.
+        # However, failing to lock the swift container can mean there are
+        # multiple workflows trying to upload the same image at the same time.
+        # Therefore we should not remove the lockfile if the swift lock failed.
+        if: ${{ always() && steps.swift-lock.outcome != 'failure' }}
+        env:
+          OS_USERNAME: ${{ secrets.SWIFT_OS_USERNAME }}
+          OS_TENANT_NAME: ${{ secrets.SWIFT_OS_TENANT_NAME }}
+          OS_PASSWORD: ${{ secrets.SWIFT_OS_PASSWORD }}
+          OS_REGION_NAME: ${{ secrets.SWIFT_OS_REGION_NAME }}
+          OS_STORAGE_URL: ${{ secrets.SWIFT_OS_STORAGE_URL }}
+          IMAGE_NAME: ${{ needs.prepare-build.outputs.oci-img-name }}
+          SWIFT_CONTAINER_NAME: ${{ vars.SWIFT_CONTAINER_NAME }}
+        run: |
+          ./src/uploads/swift_lockfile_unlock.sh \
+            ${{ needs.prepare-build.outputs.oci-img-name }}
+
       # The revision files have to be sanitised before merging,
       # since the `track` field should not be present.
       - name: Sanitise revision files

src/uploads/swift_lockfile_lock.sh

@@ -0,0 +1,35 @@
+#!/bin/bash -e
+
+# Source Swift config
+source $(dirname $0)/../configs/swift.public.novarc
+
+set -x
+
+IMAGE_NAME=$1
+# Timeout and sleep time in seconds
+TIMEOUT=${2:-300}
+SLEEP_TIME=5
+
+staging_area=$(mktemp -d)
+
+mkdir -p "${staging_area}/${IMAGE_NAME}"
+
+touch "${staging_area}/${IMAGE_NAME}/lockfile.lock"
+
+pushd "${staging_area}"
+
+# check if the ${IMAGE_NAME}/lockfile.lock exists in the swift container
+# if it does, wait until the timeout is reached and emit an error
+# if it does not, upload the lockfile.lock to the swift container
+# and exit
+while [ $TIMEOUT -gt 0 ]; do
+    swift list $SWIFT_CONTAINER_NAME -p $IMAGE_NAME | grep "lockfile.lock" && sleep $SLEEP_TIME || break
+    TIMEOUT=$(( $TIMEOUT - $SLEEP_TIME ))
+    if [ $TIMEOUT -eq 0 ]; then
+        echo "Timeout reached while waiting for lockfile.lock to be removed from the swift container"
+        exit 1
+    fi
+done
+
+# SWIFT_CONTAINER_NAME comes from env
+swift upload "$SWIFT_CONTAINER_NAME" "${IMAGE_NAME}"

src/uploads/swift_lockfile_unlock.sh

@@ -0,0 +1,17 @@
+#!/bin/bash -e
+
+# Source Swift config
+source $(dirname $0)/../configs/swift.public.novarc
+
+set -x
+
+IMAGE_NAME=$1
+
+# check if the ${IMAGE_NAME}/lockfile.lock exists in the swift container
+# if it does, remove it
+# if it does not, emit an error
+# SWIFT_CONTAINER_NAME comes from env
+LOCKFILE="${IMAGE_NAME}/lockfile.lock"
+swift list $SWIFT_CONTAINER_NAME -p $IMAGE_NAME | grep "$LOCKFILE" && \
+    (swift delete $SWIFT_CONTAINER_NAME "$LOCKFILE" && echo "Lock file removed successfully.") || \
+    echo "Lock file does not exist."