fix(release): promote exact beta image manifests - #929
Conversation
dc0bf66 to
ebf9354
Compare
|
@codex review @miravoss26 please review exact head |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ebf9354efa
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
ebf9354 to
4977234
Compare
|
@codex review @miravoss26 please re-review exact head |
There was a problem hiding this comment.
💡 Codex Review
ftw/go/cmd/ftw-updater/env_pin.go
Line 94 in 4977234
Preserve .env ownership and mode when pinning tags
When .env was created by the host operator with restrictive permissions or non-root ownership, the updater's root-run detached helper writes a new temporary file using its default umask and then replaces .env with mv. This commonly changes a 0600 operator-owned file to 0644 owned by root, exposing values such as FTW_API_TOKEN to other local users and preventing the operator from editing the file normally after any successful update. Preserve the original file's mode and ownership on the replacement before moving it into place.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
4977234 to
8922a61
Compare
|
Addressed the Codex P2 from the review of @codex review @miravoss26 please re-review exact head |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Formal human review requested for exact head Gate evidence: all required GitHub checks pass; local |
8922a61 to
7ca3d11
Compare
|
@codex review Exact head 7ca3d11 is rebased on master 4b7ad49. It keeps the four promotion patches range-diff identical and adds the release-auth fix for checkout v7: persist-credentials is false and each push phase proves exactly one effective Authorization header. Independent review found no P0/P1/P2. Full make verify and the exact-promotion contract pass. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7ca3d116f0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review @miravoss26 please re-review exact head |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
3d22d11 to
742b2ad
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 742b2ad693
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| matrix: | ||
| include: |
There was a problem hiding this comment.
When either matrix leg fails after the other reaches the alias loop, this workflow has already moved the successful component's stable/version/latest tags while the failed component remains on the previous release. Because lines 321-323 identify Core and updater as a paired control plane, a transient validation or registry failure can leave new installations pulling mismatched releases until someone notices and reruns the workflow. Validate both source manifests first and publish both components' aliases from one serialized job, as the beta channel does.
Useful? React with 👍 / 👎.
| var svc struct { | ||
| Environment map[string]string `yaml:"environment"` | ||
| } | ||
| if err := node.Decode(&svc); err != nil { | ||
| return false, fmt.Errorf("parse %s service %s: %w", path, service, err) |
There was a problem hiding this comment.
When a legacy or customized Compose service uses the supported list form, such as environment: [FTW_IMAGE_TAG=${FTW_IMAGE_TAG:-}], decoding that sequence into map[string]string returns a YAML type error. releaseIdentityPinStep consequently skips both the .env pin and override creation, so a successful beta update is undone or misreported by a later plain docker compose up. This is a fresh failure mode beyond the previously fixed missing-mapping case: the mapping exists, but this detector cannot read it. Parse both environment forms documented by Docker Compose.
Useful? React with 👍 / 👎.
742b2ad to
cc27431
Compare
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Supersedes #925, which GitHub closed automatically when its stacked base #876 merged. This branch is now rebased directly on master.
What
source@digest; do not rebuild the validated containers.Verification
make verifypasses on exact headb667e9f9after the rebase to master: 167 optimizer tests, all Go and end-to-end tests, Compose migration branches, container boundaries, vet, and build.go test -race ./cmd/ftw-updater ./cmd/ftwpasses.scripts/test-exact-image-promotion.shpasses.This stays draft until fresh review and CI confirm the final master-based tree.