ci(distroless): require explicit tag input + validate Cargo.toml matches#133
Open
BimaPangestu28 wants to merge 1 commit into
Open
ci(distroless): require explicit tag input + validate Cargo.toml matches#133BimaPangestu28 wants to merge 1 commit into
BimaPangestu28 wants to merge 1 commit into
Conversation
Bug post-mortem: an unguarded `workflow_dispatch` allowed `:latest` to be reassigned to whatever HEAD was checked out, even when that HEAD's Cargo.toml version did not match a published v* tag. We hit this when a deployer pinning resolved `:latest` to an old v0.4.49 build that had been silently retagged on top of v0.5.x, surfacing as a "warmup auto-adopt is broken on Fargate" red-herring debug session. Changes: - workflow_dispatch now requires an `inputs.tag` matching `v<MAJOR>.<MINOR>.<PATCH>`, and the workflow checks out that exact tag (no more "build from whatever HEAD happens to be"). - New "Validate Cargo.toml version matches tag" step refuses to push if Cargo.toml version != tag version. Stops mismatched builds from ever owning the `:latest` tag. - concurrency group now keys on tag so two dispatches for different tags don't fight each other; cancel-in-progress disabled to prevent silent overwrites of an in-flight build.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Harden the
publish-distrolessworkflow so a stale build can never own the:latesttag.Why
Post-mortem from a 1.5-hour debug session: a Fargate deploy pinned
ghcr.io/greenticai/greentic-start-distroless@sha256:57c381e…thinking it was v0.5.18. Extracting the binary and running--versionshowed it was actually greentic-start 0.4.49 (built April 10) — the warmup auto-adopt code didn't even exist in that build. Meanwhile:v0.5.18resolved to a different digest with the correct binary.Root cause:
workflow_dispatchhad no inputs and no validation. Anyone (or any automation) could trigger the workflow on an old branch, themetadata-actionwould emittype=raw,value=latestregardless, and the resulting build would silently take ownership of:latest. The deployer'sDEFAULT_GHCR_OPERATOR_IMAGEconstant was effectively pointing at whatever was last manually dispatched, not whatever was last released.Changes
workflow_dispatchnow requires aninputs.tagthat must match^v\d+\.\d+\.\d+([+-].+)?$. The workflow checks out that exact tag rather thangithub.ref(which on dispatch is the branch the dispatch ran from, not the release tag).Cargo.toml.version≠ tag's stripped version, the workflow fails before pushing. Stops mismatched builds from ever owning:latest.concurrency.groupnow keys on tag (and dispatch input) so two dispatches for different tags don't fight;cancel-in-progress: falseso an in-flight build can't be silently overwritten by a later dispatch.Test plan
python3 -c "import yaml; yaml.safe_load(...)")tag=v0.5.18from main with Cargo.toml at 0.5.x → succeedtag=v0.4.49from main with Cargo.toml at 0.5.x → fail at validation step (this is the bug we're fixing)The third smoke test reproduces the exact failure mode that triggered this PR.