Repository navigation
fix(compose): keep default images pinned after a weekly pin bump - #628
Merged
Merged
Conversation
… bump ImageRef treated any version other than the lock version as a user override. Config defaults and nself setup .env files carry the pre-lock version (legacy_ref's tag), so a weekly pin bump (cli#617) turned the default hasura and auth images into unpinned tags in lock mode. The legacy_ref version now resolves to the locked digest too. legacy_ref stays frozen, as Image-Lock.md says and tools/imagebump does; TestLockIsSound checks the repository instead of requiring legacy_ref == repo:version.
…as the default Image-Lock.md now states the one rule the tool, test and resolver share: a pin bump moves version only. The config default sites say why they do not move with a bump.
Comments under internal/config trip the doc-sync env-var rule. The rule they described lives in Image-Lock.md and TestConfigDefaultVersionsStayPinned.
acamarata
force-pushed
the
fix/image-pin-defaults-from-lock
branch
from
October 11, 2026 01:13
bbb9d63 to
b5398e1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unblocks the weekly image-pin bump (#617). Found by an independent second-opinion review: with #617's lock,
internal/composefailsTestLockIsSoundandTestGeneratedImagesLockModeEqualsLockedRef, and lock mode emitshasura/graphql-engine:v2.44.0andnhost/hasura-auth:0.36.0with no digest.Cause
compose.ImageReftreated every version other than the lock version as a user override and emitted it unpinned. The config defaults (HASURA_VERSION,AUTH_VERSION,ELASTICSEARCH_VERSION) and the.envfiles thatnself setupwrites still carry the pre-lock versions. So any bump of those pins turned the shipped default into an unpinned tag.The preferred fix, deriving the config defaults from
compose.LockedRef, is not possible:composeimportsconfig, soconfigimportingcomposewould be an import cycle. It would also miss theHASURA_VERSION=v2.44.0lines already written into users'.envfiles.Fix
ImageRef: in lock mode, thelegacy_reftag (the pre-lock default) also resolves torepository:version@digest. Legacy mode is unchanged. Any other version is still an unpinned override.legacy_ref: it stays frozen, and a bump movesversiononly. That is whatImage-Lock.mdalready said and whattools/imagebumpalready does.TestLockIsSoundnow checks thatlegacy_refnames the same repository with a tag, instead of requiringlegacy_ref == repo:version.TestImageForAfterPinBumpcovers a synthetic bumped entry in both modes.TestConfigDefaultVersionsStayPinnedchecks that every documented*_VERSIONdefault and everyApplyDefaultsversion for hasura, auth and elasticsearch resolves to the locked ref in lock mode.Image-Lock.md(Overrides, How pins move) explains the rule. The config defaults are untouched: they equal thelegacy_reftags, andTestConfigDefaultVersionsStayPinnedguards them.Verification
go test ./internal/compose/ ./tools/imagebump/...passes, plus./internal/config/... ./internal/backup/... ./tools/...,go vet, andNSELF_V15=1compose.images.yamlandimages.lock.jsonoverlaid on this branch,internal/compose,internal/config,tools/imagebumpandtools/imagelockpass andimagelock -checkis current.images_lock.goand its test failsTestLockIsSoundandTestGeneratedImagesLockModeEqualsLockedRef, as reported.Once this merges, rerun
image-pin-bump.ymlsochore/image-pinsregenerates on the new main.