From 8063ba81b82bdd1e2732760e4fd8f0973f0a7909 Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Tue, 27 Oct 2026 18:59:54 -0400
Subject: [PATCH] fix(ci): the apk drift check defaults to a Docker Hub mirror
 when the engine configures none
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

47cfb21 made refresh-apk-pins.sh pull the runtime image's Go base from the
engine's configured HTTPS mirror. A GitHub-hosted runner configures none, so
on the one host that runs this weekly the script still pulled docker.io, and
from the runners' shared IPs Docker Hub answers `toomanyrequests` often enough
that apk-pin-drift would go red about a rate limit instead of about drift.

With no engine mirror, the default is now mirror.gcr.io; DOCKER_HUB_MIRROR
overrides both. The reference is pinned by digest, so the mirror serves the
identical bytes, and Docker's ordered fallback through the original reference
is unchanged when the mirror pull fails.

Proven by execution: engine with a mirror (exit 0, mirror.gcr.io used);
DOCKER_HUB_MIRROR=https://mirror.invalid (pull fails, fallback resolves all six
pins, exit 0); a docker shim whose `info` reports no mirror (this script pulls
mirror.gcr.io/library/golang@sha256:895e…; main's script under the same shim
never touches a mirror).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .github/scripts/refresh-apk-pins.sh | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/scripts/refresh-apk-pins.sh b/.github/scripts/refresh-apk-pins.sh
index ffe6ed9..ed255a3 100755
--- a/.github/scripts/refresh-apk-pins.sh
+++ b/.github/scripts/refresh-apk-pins.sh
@@ -50,7 +50,15 @@ base="$(sed -n 's/^ARG GO_IMAGE=\(.*\)$/\1/p' "$DOCKERFILE" | head -1)"
 # Direct registry references cannot express an HTTP mirror's transport policy,
 # so leave those to Docker. If the direct pull fails, Docker also retains its
 # normal ordered mirror/origin fallback through the original reference.
-mirror="$(docker info --format '{{range .RegistryConfig.Mirrors}}{{println .}}{{end}}' | head -1)"
+#
+# An engine with no mirror configured — a GitHub-hosted runner, where this runs
+# weekly — would otherwise pull docker.io directly, and from the runners' shared
+# IPs Docker Hub answers `toomanyrequests` often enough that the check would go
+# red about a rate limit instead of about drift. So the default is a public
+# Docker Hub mirror; the digest is unchanged, so it serves the identical bytes.
+# DOCKER_HUB_MIRROR overrides both.
+mirror="${DOCKER_HUB_MIRROR:-$(docker info --format '{{range .RegistryConfig.Mirrors}}{{println .}}{{end}}' | head -1)}"
+[[ -n "$mirror" ]] || mirror="https://mirror.gcr.io"
 if [[ "$mirror" == https://* && "$base" == golang:*@sha256:* ]]; then
   mirror="${mirror#https://}"
   mirrored="${mirror%/}/library/$base"