Repository navigation
fix: no build env var shares a name with a secret id (1.39.4, RT#1550) - #121
Conversation
podman 4.9 on the runner mounts --secret id=X from $X when such a variable exists, ignoring src=; the build step exported RHSM_ACTIVATION_KEY, so id=RHSM_ACTIVATION_KEY mounted empty and the ubi10 mariadb/postgres builds failed with 'Must specify an activation key'. Reproduced and fix confirmed on quay.io/podman/stable:v4.9.3. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01R7Y1jh5QhdxRuFKyWVev5h
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| with: | ||
| repository: crunchtools/constitution | ||
| ref: v1.39.3 | ||
| ref: v1.39.4 |
There was a problem hiding this comment.
HIGH (Constitution): The self-validation workflow now checks out the candidate v1.39.4 validator. The constitution requires this repo's required check to pin validate.yml to the last release so a PR is not judged by the validator it changes.
Suggestion: Keep the checkout pinned to the previous release while this change is under review; update it to v1.39.4 after that release, as required by the self-validation process.
Evidence:
ref: v1.39.4
There was a problem hiding this comment.
not a bug: this repo's required self-check is .github/workflows/constitution.yml, which calls [email protected], a past release, so this PR is not judged by the validator it changes. The ref: literal inside validate.yml is the release that file belongs to: callers pinning [email protected] must check out the v1.39.4 validator, and tests hold that literal equal to the version. v1.39.2 and v1.39.3 shipped the same way.
Summary
--secret id=Xempty when an env var named X exists, ignoringsrc=. The build step exportedRHSM_ACTIVATION_KEY, so everyid=RHSM_ACTIVATION_KEYbuild (ubi10 mariadb/postgres trio) failed with "Must specify an activation key".Test plan
🤖 Generated with Claude Code
https://claude.ai/code/session_01R7Y1jh5QhdxRuFKyWVev5h