Repository navigation
fix(ci): the apk drift check defaults to a Docker Hub mirror when the engine configures none - #158
Open
antoinetoussaint-byte wants to merge 1 commit into
Open
antoinetoussaint-byte wants to merge 1 commit into
antoinetoussaint-byte wants to merge 1 commit into
Conversation
… engine configures none 47cfb21 made refresh-apk-pins.sh pull the runtime image's Go base from the engine's configured HTTPS mirror. A GitHub-hosted runner configures none, so on the one host that runs this weekly the script still pulled docker.io, and from the runners' shared IPs Docker Hub answers `toomanyrequests` often enough that apk-pin-drift would go red about a rate limit instead of about drift. With no engine mirror, the default is now mirror.gcr.io; DOCKER_HUB_MIRROR overrides both. The reference is pinned by digest, so the mirror serves the identical bytes, and Docker's ordered fallback through the original reference is unchanged when the mirror pull fails. Proven by execution: engine with a mirror (exit 0, mirror.gcr.io used); DOCKER_HUB_MIRROR=https://mirror.invalid (pull fails, fallback resolves all six pins, exit 0); a docker shim whose `info` reports no mirror (this script pulls mirror.gcr.io/library/golang@sha256:895e…; main's script under the same shim never touches a mirror). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
antoinetoussaint-byte
changed the title
antoinetoussaint-byte
force-pushed
the
fix/apk-check-mirror-and-smoke-literal
branch
from
October 27, 2026 23:01
8a8a64c to
8063ba8
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rebased onto
e5455c2(v0.0.74) and reduced to the one hunk main does not already carry. The smoke-literal tightening this PR first proposed landed in #128's reconcile as a line-anchored regex (^…docker run … go version | grep -F 'go1.27.3'…$), which a comment cannot satisfy — superseded, dropped.What remains: the runner has no mirror
47cfb21maderefresh-apk-pins.shpull the Go base from the engine's configured HTTPS mirror (docker info … .RegistryConfig.Mirrors). A GitHub-hosted runner configures none, so on the one host that runs this weekly the script still pullsdocker.io— and from the runners' shared IPs that is thetoomanyrequestsclass:apk-pin-driftwould red on a rate limit rather than on drift, a check red about the wrong thing. With no engine mirror the default is nowmirror.gcr.io;DOCKER_HUB_MIRRORoverrides both. The reference is digest-pinned, so the mirror serves the identical bytes; Docker's ordered fallback through the original reference is unchanged.Proven by execution (exit codes read directly, no pipes)
mirror.gcr.io/library/golang@…DOCKER_HUB_MIRROR=https://mirror.invaliddockershim whoseinforeports no mirror (the runner case)mirror.gcr.io/library/golang@sha256:895e…, exit 0; main's script under the same shim never touches a mirror (0 mentions) →docker.ioClassification: fix at the owner (the script that resolves). Reuse:
47cfb21's mirror pull and fallback shape, unchanged; the digest already inARG GO_IMAGE. Deliberately not done: no change toapk-pin-drift.yml; no mirror forci.yml/runtime-image.yml's own BuildKit pulls (a different change).Not verified: a run on an actual GitHub runner; the no-mirror path was exercised through a shim, not a reconfigured engine.
🤖 Generated with Claude Code