Skip to content

Pin the release builder, and fail closed when checking for a published version #7

Open
#8
Open
Pin the release builder, and fail closed when checking for a published version#7
#8
Labels
stage:executeBeing builttrack:quickClear and one step: brief, execute, reviewtype:choreMaintenance with no change in behavior

Description

@ABilenduke
ABilenduke
opened on Oct 11, 2026

Found while working on Reference-Systems-Lab/commerce-storefront#2 (qa): the same two problems were found and fixed in the storefront's release workflow, which mirrors this one.

Status

Stage Track Next action Branch PR
execute quick S1 — —

Appetite: 30m active · Estimate: 20m · Active so far: see the time comment

Brief

Idea: "Do the two commerce-backend fixes" (@ABilenduke, 2026-10-11).

Problem and audience: both are in .github/workflows/release.yml.

  • The builder runs an unpinned image. docker/setup-buildx-action (:133-135) has no driver-opts, so it starts BuildKit from moby/buildkit:buildx-stable-1, a moving tag. That privileged builder receives the job's write-scoped token and writes the SBOM and provenance that get attested. It's the one unpinned image in the release.
  • The "already published?" check fails open. At :126-131, any imagetools inspect failure counts as "not published": GHCR 5xx, rate limits, DNS or authentication errors. A rerun after such an error rebuilds and pushes :X.Y.Z again. With SBOM and provenance the digest differs, so the published tag moves, which ADR 0001 says never happens.

Outcome: the release builds with a pinned BuildKit, and only "not found" (or a package with no versions yet) lets a release push.

Acceptance:

  • setup-buildx-action shall pass driver-opts: image=moby/buildkit:v0.33.1@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea, and the README shall list it among the pins bumped by hand. Dependabot can't see images in with: inputs.
  • If imagetools inspect fails for any reason other than "not found", the job shall fail and push nothing.
  • The README's release notes shall say both.
  • actionlint shall pass.

S1: edit release.yml and the README, then open the PR · Estimate 20m · Basis: the storefront's equivalent fix (commerce-storefront e12ab4f)

Approved: @ABilenduke 2026-10-11 ("Do the two commerce-backend fixes")

Links

Activity

  1. ABilenduke
    added
    type:choreMaintenance with no change in behavior
    track:quickClear and one step: brief, execute, review
    stage:executeBeing built
    on Oct 11, 2026
  2. github-project-automation
    added this to commerce workon Oct 11, 2026
  3. github-project-automation
    moved this to Todo in commerce workon Oct 11, 2026
  4. ABilenduke
    linked a pull request that will close this issuePin the release builder, and fail closed when checking for a published version #8on Oct 11, 2026

  5. ABilenduke commented on Oct 11, 2026

    @ABilenduke
    ABilenduke
    on Oct 11, 2026
    ContributorAuthor

    S1: Pin the release builder, and fail closed on the publish checks

    I edited release.yml and the README, then opened #8.

    • The builder is pinned (driver-opts: image=moby/buildkit:v0.33.1@sha256:cec9f139…3dea, the newest BuildKit release older than 7 days).
    • The image check fails closed: only "not found", "manifest unknown" or "name unknown", or a 404 on /orgs/Reference-Systems-Lab/packages/container/commerce-backend, lets the job go on.
    • The SDK check fails closed on anything but E404.
    • The README says both, and lists the builder as bumped by hand.

    Findings:

    • Two failures, different stakes. The SDK's check failed open too, but GitHub Packages refuses to republish an npm version, so its failure was safe. The image's wasn't, because GHCR tags can move.
    • Time attribution. A storefront fix, the open-redirect hardening in its // redirect (commerce-storefront e20dfa7), was made while this step was open, so a few minutes of that work are counted here.
    Iteration Checks run Result Fix
    1 make lint go: not found (this shell's PATH) Ran with ~/.local/go/bin
    2 make lint Pass: Go lint, boundaries, hadolint, actionlint, action and image pins, the spec, no breaking change None

    Commit: 56727e0 · Status: Complete (awaiting review and merge)

    workflow · claude-code · 2026-10-11 10:41

  6. github-project-automation
    moved this from Todo to In Progress in commerce workon Oct 11, 2026

  7. ABilenduke commented on Oct 11, 2026

    @ABilenduke
    ABilenduke
    on Oct 11, 2026
    ContributorAuthor

    Time: issue-7

    Generated by worklog render from time.jsonl. Do not edit by hand.

    Step Estimate Started Finished Wall Active Sessions
    S1 20m 2026-10-11 10:36 2026-10-11 10:41 5m 5m 96f0480c (claude-code)
    Total 20m 5m 5m

    Active time counts agent turns plus up to 5 minutes of each wait for a person, and no single gap
    counts more than 30 minutes. — means nothing was recorded.

    workflow · claude-code · 2026-10-11 10:41

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    stage:executeBeing builttrack:quickClear and one step: brief, execute, reviewtype:choreMaintenance with no change in behavior

    Type

    No type

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions