Fix dbt docs deployment for new Ubuntu 24.04 runners #683
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dfsnow
approved these changes
Dec 17, 2024
Co-authored-by: Dan Snow <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Now that our GitHub runners are on Ubuntu 24.04, the Mermaid diagram generation in our dbt docs deployment pipeline is breaking due to an obscure AppArmor rule change that affects Puppeteer sandboxes. This PR implements the recommended solution from that issue by using
aa-execto confine the Mermaid process to a dedicated profile.Full disclosure: I don't totally understand what's going on with this AppArmor rule change, but I think the stakes are pretty low, since we're only using Puppeteer via mermaid to load diagrams and save them to SVG, meaning we shouldn't be browsing the public internet or running untrusted code anyway. This also seems to be the recommended solution according to a Mermaid maintainer, per the link above.
See this workflow run for evidence that this change resolves the problem.