Fix CI base image and add libsodium#172
Merged
Merged
Conversation
buildpack-deps:buster can no longer apt-get install anything since buster was archived off deb.debian.org, breaking every job. Move to bookworm and bump the asdf cache key so ruby is rebuilt against bookworm's OpenSSL. Also install libsodium in all jobs, ahead of rake_github gaining secrets tasks that need rbnacl.
There was a problem hiding this comment.
Pull request overview
Updates the CircleCI environment to unblock failing jobs caused by the archived Debian buster apt repositories, while preparing CI for upcoming secrets tooling that requires libsodium.
Changes:
- Switched CircleCI base image from
buildpack-deps:bustertobuildpack-deps:bookworm. - Bumped the asdf cache key version (
v2→v3) to avoid restoring buster-built Ruby/OpenSSL artifacts. - Added a CI step (and new script) to install
libsodium-devforrbnaclsupport.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| scripts/ci/common/install-libsodium.sh | Adds a reusable CI script to install libsodium-dev via apt. |
| .circleci/config.yml | Moves CI to bookworm, adds libsodium installation step, and bumps asdf cache key version. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Every CircleCI job currently fails at
install-slack-deps.sh: Debian buster was archived offdeb.debian.org, soapt-get updateonbuildpack-deps:busternow 404s.What
buildpack-deps:bookworm.v2→v3) so Ruby is recompiled against bookworm's OpenSSL 3 rather than restored from a buster-built cache linking the removed OpenSSL 1.1.libsodium-devin all jobs, ahead of the upcomingsecretstask groups which needrbnacl(libsodium sealed-box encryption of GitHub secret values).Verification
Verified locally in docker on arm64 (matching the
arm.mediumresource class): apt on bookworm resolves and installslibsodium-dev, providinglibsodium.so. The branch-filtered workflow only runs onmain/dependabot*, so the real verification is the pipeline run after merge — this PR should be merged and observed green (through prerelease) before the task-groups PR lands.