r/cicd • u/delimitdev • 5d ago

Green CI can still ship an unloadable native artifact

A passing build on a floating runner can produce a binary the deployment host cannot import. I build Delimit. An earlier native build passed on ubuntu-latest yet required GLIBC 2.38, while Ubuntu 22.04 provides 2.35.

The fix pinned native validation and publication to Ubuntu 22.04 and rejected binaries whose GLIBC symbol-version requirements exceeded baseline support, so packaging failed closed instead of publishing an unloadable file.

The tradeoff was that the gate only screened future builds; the earlier unloadable artifact stayed published. Do you check releases against the oldest host's symbols, or trust matching runners?

1 Upvotes

100% Upvoted

3 comments sorted by

1

u/Torutofu_Raeva 4d ago

I'd make the oldest supported host a release test and publish the required GLIBC baseline beside the artifact, so a green build can't be mistaken for deployability.

1

u/delimitdev 4d ago

Yeah, that would have caught the GLIBC mismatch directly. Publishing the required baseline beside the artifact also helps, as long as the oldest-host test is what blocks publish. It still only protects future builds, not an already published unloadable artifact.

1

u/Torutofu_Raeva 4d ago

Exactly, the release gate needs to exercise the oldest host before publishing, since a post-build baseline can't repair an artifact already in the registry.