From ab33dfe88f8f90b60de4c8f06e5ff38a695d57d3 Mon Sep 17 00:00:00 2001
From: Chris Barber <chris@harperdb.io>
Date: Tue, 27 Oct 2026 10:03:45 -0500
Subject: [PATCH 1/2] Fall back across registries when pulling the musl image

ECR Public returned "toomanyrequests: Data limit exceeded" to the x64 musl
runner, an anonymous per-IP quota shared with every other tenant on that runner IP.
Pull the pinned digest from mirror.gcr.io, ECR Public, then Docker Hub, and tag it
locally so later steps do not depend on which registry served it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/build.yml | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index bbfd9be..d5e40cd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -475,10 +475,10 @@ jobs:
     runs-on: ${{ matrix.platform.runner }}
     env:
       VCPKG_ROOT: ${{ github.workspace }}/vcpkg
-      # ECR Public mirrors Docker Hub's official images without Docker Hub's anonymous-pull token
-      # endpoint, whose timeouts failed both musl legs at once. Pinned so the musl toolchain changes
-      # only by a reviewed bump.
-      MUSL_IMAGE: public.ecr.aws/docker/library/alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
+      # Pinned so the musl toolchain changes only by a reviewed bump. The digest is the same on every
+      # registry the pull step tries, so a fallback cannot change what is built.
+      MUSL_IMAGE_DIGEST: sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 # alpine 3.24.2
+      MUSL_IMAGE: rocksdb-musl-build
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -561,10 +561,17 @@ jobs:
       - name: Pull musl build image
         if: ${{ matrix.platform.target == 'linux-x64-musl' || matrix.platform.target == 'linux-arm64-musl' }}
         shell: bash
+        # Each registry has failed anonymous pulls from shared runner IPs on its own: Docker Hub's
+        # token endpoint timed out, and ECR Public returned "Data limit exceeded".
         run: |
-          for attempt in 1 2 3 4 5; do
-            docker pull "$MUSL_IMAGE" && exit 0
-            echo "docker pull failed (attempt $attempt); retrying in $((attempt * 15))s"
+          for attempt in 1 2 3; do
+            for repo in mirror.gcr.io/library/alpine public.ecr.aws/docker/library/alpine docker.io/library/alpine; do
+              if docker pull "$repo@$MUSL_IMAGE_DIGEST"; then
+                docker tag "$repo@$MUSL_IMAGE_DIGEST" "$MUSL_IMAGE"
+                exit 0
+              fi
+              echo "docker pull from $repo failed (attempt $attempt)"
+            done
             sleep $((attempt * 15))
           done
           exit 1

From 442d32d8f203f6f61b1657591a6051c001f94775 Mon Sep 17 00:00:00 2001
From: Chris Barber <chris@harperdb.io>
Date: Tue, 27 Oct 2026 10:03:45 -0500
Subject: [PATCH 2/2] Bump the musl build image to alpine 3.24.3

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d5e40cd..c8263ac 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -477,7 +477,7 @@ jobs:
       VCPKG_ROOT: ${{ github.workspace }}/vcpkg
       # Pinned so the musl toolchain changes only by a reviewed bump. The digest is the same on every
       # registry the pull step tries, so a fallback cannot change what is built.
-      MUSL_IMAGE_DIGEST: sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 # alpine 3.24.2
+      MUSL_IMAGE_DIGEST: sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a # alpine 3.24.3
       MUSL_IMAGE: rocksdb-musl-build
     steps:
       - name: Checkout