Repository navigation
Conversation
…-1486) The weekly image pin bump exits 1 because three pins in internal/compose/images.yaml had no entry in the bump policy. - auth-v14 and hasura-v14: patch track on their own minor (auth 0.36.x, hasura v2.44.x), same regex shape as auth and hasura. - valkey: patch track on ^(\d+).(\d+)-alpine$, so the tag is fixed at 8.1 and only the digest refreshes (matches redis and python). Add TestRepoPoliciesCoverEveryPin, which reads the real images.yaml and policy and fails when a non-plugin pin has no entry or its version does not match the entry's regex.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The weekly "Image pin bump" workflow fails on main (run 40320509149) with
imagebump: auth-v14|hasura-v14|valkey: no entry in the bump policy. Those three pins exist ininternal/compose/images.yamlbut not in.github/image-bump-policy.yaml.Policy choices (conservative, patch-only)
^(\d+)\.(\d+)\.(\d+)$, patch. Stays on 0.36.x; 0.43+ needs AUTH_ENCRYPTION_KEY, so no minor moves.^v(\d+)\.(\d+)\.(\d+)$, patch. Stays on v2.44.x.^(\d+)\.(\d+)-alpine$, patch. Two fixed groups, so the tag never moves and only the digest refreshes, same as redis and python.Test
TestRepoPoliciesCoverEveryPinreads the realimages.yamland the real policy. It fails when a non-plugin pin has no entry, or when its version does not match its entry's regex.Commands and results
go test -count=1 ./tools/imagebump: okgo vet ./tools/imagebump: clean;gofmt -l tools/imagebump: cleanauth-v14,hasura-v14andvalkey./Volumes/D5/tmpwas unavailable because/Volumes/D5is not mounted. The existingTestGoldenFixtureandTestDryRunWritesNothingcover dry-run behaviour.chore/image-pins. The workflow itself still needs a re-run after merge to confirm.🤖 Generated with Claude Code