fix(release): promote exact beta image manifests - #925
Conversation
Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v5...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>
|
@miravoss26 could you review this stacked draft? It binds stable to the exact Core and updater beta digests and closes the rerun, partial-state, migration, and runtime-identity gaps found in two independent passes. GitHub checks do not run while the PR targets the Dependabot branch because the workflows filter pull requests to @codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 30af2e9206
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
30af2e9 to
3f397e7
Compare
|
Both review findings are fixed on exact head @codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3f397e7d19
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Both latest P2 findings are fixed on exact head 19bef91. Automatic rollback keeps the prior immutable beta tag, and legacy Compose overrides now pass the selected tag into Core. Focused updater tests, full make verify, actionlint v1.7.12, and the exact-promotion contract pass. The PR remains stacked on #876, so normal master-targeted CI still waits for retargeting. @codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 19bef91aba
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Image string `yaml:"image"` | ||
| Environment map[string]string `yaml:"environment"` |
There was a problem hiding this comment.
For installations still using the previous standard Compose file, the image already contains ${FTW_IMAGE_TAG:-latest} but the service has no FTW_IMAGE_TAG environment mapping. prepareComponentImagePin therefore returns before this newly added environment override is created, so a beta update selects the correct image while Core sees an empty tag and reports the baked stable version. Generate the environment override whenever the merged service lacks the mapping, even if its image is already variable.
AGENTS.md reference: AGENTS.md:L118-L119
Useful? React with 👍 / 👎.
3899166 to
44a8c93
Compare
1 participant
Summary
Why
The current stable job rebuilds the containers from the same Git commit. That does not reproduce the tested bytes: the binary embeds its version, and base images and OS packages can move between builds. A direct retag of today's beta is also wrong because the binary and OCI labels still identify that beta.
This change gives beta one build-bound candidate tag while baking the future stable product version. The beta prerelease stores
ftw-image-digests.json. Stable createsftw-promotion-receipt.jsonbefore it writes any alias, then copies onlysource@recorded_digestfor Core and updater. Every later rerun must use the same receipt.Rerun and partial-state rules
latestRuntime identity
The Core binary accepts only its baked stable version or the exact beta tag bound at build time. The updater passes the immutable deployed tag through Compose and persists it in
.env. Linux, macOS, the modular-stack helper and both legacy migration paths carry the same value.Verification
make verifyactionlintfor beta, release and release-assets workflowsStack and merge order
This draft is based on the exact head of #876 because that PR has right of way in the three release workflow files. Merge or rebase #876 first, then retarget this PR to
masterand rerun the same checks. Draft #735 still ownstest.yml; this stack does not change that file, and #735's owner has been asked to confirm #876's order.#728 is not a dependency. No existing beta can be promoted with this contract; publish a new beta after this lands.