Repository navigation
fix(ci): unblock container publication and validate every main run - #619
Merged
Merged
Conversation
Docker may allocate a different ephemeral host port when a container started with `-p 127.0.0.1::8080` is restarted. The contract check captured the mapping once, so the post-restart health probe targeted a port nobody listened on and the Container image job failed on main (run 36236068303), which skipped the v0.36.117 release publication. Resolve the port mapping on every health attempt instead.
- Containerfile hardcoded x86_64-unknown-linux-musl, so the documented
`podman build` failed on arm64 hosts ("can't find crate for core").
Derive the musl target from the rust image host triple, matching the
demo Containerfile, and set the aarch64 linker alongside x86_64.
- The CI concurrency group cancelled the previous main run on every
release-plz push, so consecutive releases shipped without a completed
pipeline. Keep cancel-in-progress for PR refs only.
Destynova2
enabled auto-merge (squash)
September 27, 2026 10:57
Destynova2
added a commit
that referenced
this pull request
Sep 27, 2026
## 🤖 New release * `grob`: 0.36.117 -> 0.36.118 <details><summary><i><b>Changelog</b></i></summary><p> <blockquote> ## [0.36.118](v0.36.117...v0.36.118) - 2026-09-27 ### Fixed - *(ci)* unblock container publication and validate every main run ([#619](#619)) ### Other - fix private intra-doc links, drop dead code and duplicate defaults ([#620](#620)) </blockquote> </p></details> --- This PR was generated with [release-plz](https://github.com/release-plz/release-plz/).
Destynova2
added a commit
that referenced
this pull request
Sep 27, 2026
…h admin contract (#622) E2E has failed on main since v0.36.112 without anyone noticing, because the CI concurrency group cancelled most main runs (#619 fixed that) and the Container job failure masked the rest. Streaming (regression since #617): - Output DLP rejected text_delta events with no content_block_start and message_stop with an open block. Anthropic-compatible backends such as the E2E mock do exactly that, so every streaming response was cut after the first chunk. Missing block boundaries are now synthesised; the text is still checked as one complete block before release, and EOF with an open block still fails closed (a truncated block could split a secret). - /v1/chat/completions and /v1/responses swallowed mid-stream errors without a log line; they now log like /v1/messages does. Auth tests (contract change in #600, tests never updated): - POST /api/config/reload requires an admin credential; a tenant JWT is 403. Tests and advanced/fanout scripts use the server api_key. - The server api_key is accepted alongside JWT as an operator credential instead of being rejected with 401. E2E runner image downloads hurl/k6/age for TARGETARCH instead of hardcoded amd64, so the suite runs on arm64 hosts. ## Validation - Local E2E pod (podman, arm64): `make test-hurl` **9/9 suites** (was 5/9 on main since v0.36.112), `make test-advanced` 10/10, fanout F0 pass. - nextest 1882/1882 (new test `missing_block_boundaries_are_synthesised_and_text_still_checked`), clippy `-D warnings`, shellcheck on touched scripts. - The E2E job on the push to main after merge is the definitive check (it does not run on PRs).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
CI on
main(fa213a0, v0.36.117) failed in Container image (run 36236068303), which skipped Create Release, Homebrew tap and E2E. v0.36.117 is tagged but never published. The three previous main runs were cancelled.Root causes and fixes
scripts/ci/container-contract.shcaptured the host port once; Docker reallocates the ephemeral port of-p 127.0.0.1::8080afterrestart, so the post-restart health probe hit a dead port for 30 s. The mapping is now resolved on every attempt.Containerfilehardcodedx86_64-unknown-linux-musl; the documentedpodman buildfailed on arm64 hosts. The musl target now follows the rust image host triple (same approach asdeploy/demo/Containerfile).ci.ymlconcurrency cancelled the previousmainrun on each release-plz push, so releases shipped without a completed pipeline.cancel-in-progressnow applies to non-main refs only.Validation
podman build --target runtime -f Containerfileon Apple Silicon: builds,grob 0.36.117container-contract.shend-to-end under podman against both the compiled and prebuilt stages: passcargo fmt --check,clippy -D warnings,nextest1881/1881: pass