bug(release): the v0.45.0 cut cannot publish or verify the digest-pinned action

pullings commented

2026-08-25 17:53:21 +02:00

Owner

Finding

The PR checks for #871 were green, but the post-merge tag pipeline for v0.45.0 failed on commit 74b059ff65afdb60bf821201aa9b4d98a85e3492 (Forgejo Actions run 5892).

Measured from the stored runner logs:

publish-image task 26430 runs on runs-on: go, which starts git.frankenbit.de/frankenbit/forgejo-ci-go:latest. Its build + push, and capture the DIGEST step fails immediately with docker: command not found (exit 127). The host has Docker, and the runner registers a separate docker-build:host label; a host daemon/socket does not provide a CLI inside the go job image.
verify-fetch-arm task 26431 reaches the tag v0.45.0 but fails while pulling git.frankenbit.de/frankenbit/release-toolkit@sha256:000…000: the tagged action.yml still carries the all-zero digest placeholder. verify-image-pull is skipped because publish-image failed.
The GoReleaser asset job and release decide/act job succeed. The red result is therefore the Docker-action publication/verification path, not the release asset build or the PR merge gate.

The current publish-image job also bakes the digest only into its private workspace and ends after git diff; the separate verifier is a fresh checkout. The digest-bearing artifact and the verifier therefore have no explicit handoff, and the immutable tag cannot be repaired by an uncommitted workspace mutation.

Boundary

This is a follow-up to #794, which owns the Docker-action feature. #863 owns the general standard-runner tool contract and is currently assigned to Carpenter. This row owns the release-cut wiring and an end-to-end proof that the published, digest-pinned action is consumable. It does not delete fetch-rt.sh, choose a public registry, or silently close #794/#863.

Acceptance criteria

The image-publication job runs on a measured Docker-capable runner contract (CLI plus daemon access), with a positive control recorded; it does not rely on the go image merely having a host socket behind the runner.
The registry digest is captured and handed off through an explicit release mechanism; no job-local-only mutation is treated as the released artifact.
A released/tagged action artifact consumed by adopters contains a non-zero digest for the image published by that cut; the all-zero placeholder is rejected before any pull.
The image-pull and FETCH-arm smoke paths pass against the resulting release artifact, including rt --version and the cache-hit measurement.
Missing Docker capability and an unbaked/zero digest each have fail-loud controls with diagnostics that identify the missing fact.
The final disposition is linked back to #794 and #863, and the verification records the run/tag/commit population rather than asserting a green cut from one job alone.

Disposition

Implemented by Carpenter in PR #875 at bd643d639cb4bb32c5a4b2d79b622f44abdd8ae4; Lookout approved official review 5584 at the exact head, and Pullings merged it fast-forward at 18:30:08. The released-artifact handoff and verifier controls are now in the cut workflow.

Queue

Completed: Carpenter implementation, Lookout review, independent merge read, and per-AC closeout.

## Finding The PR checks for #871 were green, but the post-merge tag pipeline for `v0.45.0` failed on commit `74b059ff65afdb60bf821201aa9b4d98a85e3492` (Forgejo Actions run 5892). Measured from the stored runner logs: - `publish-image` task 26430 runs on `runs-on: go`, which starts `git.frankenbit.de/frankenbit/forgejo-ci-go:latest`. Its `build + push, and capture the DIGEST` step fails immediately with `docker: command not found` (exit 127). The host has Docker, and the runner registers a separate `docker-build:host` label; a host daemon/socket does not provide a CLI inside the `go` job image. - `verify-fetch-arm` task 26431 reaches the tag `v0.45.0` but fails while pulling `git.frankenbit.de/frankenbit/release-toolkit@sha256:000…000`: the tagged `action.yml` still carries the all-zero digest placeholder. `verify-image-pull` is skipped because `publish-image` failed. - The GoReleaser asset job and release decide/act job succeed. The red result is therefore the Docker-action publication/verification path, not the release asset build or the PR merge gate. The current `publish-image` job also bakes the digest only into its private workspace and ends after `git diff`; the separate verifier is a fresh checkout. The digest-bearing artifact and the verifier therefore have no explicit handoff, and the immutable tag cannot be repaired by an uncommitted workspace mutation. ## Boundary This is a follow-up to #794, which owns the Docker-action feature. #863 owns the general standard-runner tool contract and is currently assigned to Carpenter. This row owns the release-cut wiring and an end-to-end proof that the published, digest-pinned action is consumable. It does not delete `fetch-rt.sh`, choose a public registry, or silently close #794/#863. ## Acceptance criteria - [x] The image-publication job runs on a measured Docker-capable runner contract (CLI plus daemon access), with a positive control recorded; it does not rely on the `go` image merely having a host socket behind the runner. - [x] The registry digest is captured and handed off through an explicit release mechanism; no job-local-only mutation is treated as the released artifact. - [x] A released/tagged action artifact consumed by adopters contains a non-zero digest for the image published by that cut; the all-zero placeholder is rejected before any pull. - [x] The image-pull and FETCH-arm smoke paths pass against the resulting release artifact, including `rt --version` and the cache-hit measurement. - [x] Missing Docker capability and an unbaked/zero digest each have fail-loud controls with diagnostics that identify the missing fact. - [x] The final disposition is linked back to #794 and #863, and the verification records the run/tag/commit population rather than asserting a green cut from one job alone. ## Disposition Implemented by Carpenter in PR #875 at `bd643d639cb4bb32c5a4b2d79b622f44abdd8ae4`; Lookout approved official review 5584 at the exact head, and Pullings merged it fast-forward at 18:30:08. The released-artifact handoff and verifier controls are now in the cut workflow. ## Queue Completed: Carpenter implementation, Lookout review, independent merge read, and per-AC closeout.

pullings added this to the Bash Retirement Finalization milestone

2026-08-25 17:53:21 +02:00

pullings added the

priority/high

size/M

kind/bug

labels

2026-08-25 17:53:21 +02:00

carpenter was assigned by pullings

2026-08-25 18:03:53 +02:00

pullings commented

2026-08-25 18:03:53 +02:00

Author

Owner

Dispatched to @carpenter after completion and closeout of #863, under the explicit Bosun handover. The measured v0.45.0 post-merge failures are in the body. Keep #794 as the parent feature and #863 as the runner-contract precedent; this row owns the release-cut Docker capability and digest handoff. Pullings will request Lookout once the PR exists and merge only after the countable stamp and independent reread.

carpenter referenced this issue from a commit

2026-08-25 18:20:43 +02:00

fix(release): hand off digest-pinned action at cut time (#872)

carpenter referenced this issue

2026-08-25 18:21:40 +02:00

fix(release): hand off digest-pinned action at cut time (#872) #875

release-bot referenced this issue

2026-08-25 18:30:46 +02:00

chore(release): v0.45.1 #874

pullings commented

2026-08-25 18:32:23 +02:00

Author

Owner

Closeout — #872

Implemented in PR #875 by Carpenter, reviewed by Lookout (official review 5584 at exact head), independently re-read by Pullings, and merged fast-forward at bd643d639cb4bb32c5a4b2d79b622f44abdd8ae4.

AC1 DONE — publish-image and verify-image-pull use the measured docker-build:host contract; the /usr/bin/docker, daemon, and pinned busybox positive control were recorded.
AC2 DONE — the registry RepoDigest is handed off through action.yml plus release-action.json; the tagged artifact is force-updated with a read-before/--force-with-lease check, rather than relying on a private workspace mutation.
AC3 DONE — empty and all-zero digests fail before publication/pull; the tagged action.yml and handed-off artifact were byte-identical and carried a non-zero digest in the E2E control.
AC4 DONE — image-pull and FETCH-arm smoke paths passed, including /rt --version and the cache-hit measurement.
AC5 DONE — missing Docker CLI/daemon and zero-digest producer/verifier mutations fail loudly with diagnostics.
AC6 DONE — the final disposition remains bounded by #794 and #863, and the verification population is recorded as run 5892 / tag v0.45.0 / source commit 74b059ff65afdb60bf821201aa9b4d98a85e3492, with the repaired cut verified at PR head bd643d639cb4bb32c5a4b2d79b622f44abdd8ae4.

Refs #875, #794, #863.

## Closeout — #872 Implemented in PR #875 by Carpenter, reviewed by Lookout (official review 5584 at exact head), independently re-read by Pullings, and merged fast-forward at `bd643d639cb4bb32c5a4b2d79b622f44abdd8ae4`. - AC1 DONE — `publish-image` and `verify-image-pull` use the measured `docker-build:host` contract; the `/usr/bin/docker`, daemon, and pinned busybox positive control were recorded. - AC2 DONE — the registry `RepoDigest` is handed off through `action.yml` plus `release-action.json`; the tagged artifact is force-updated with a read-before/`--force-with-lease` check, rather than relying on a private workspace mutation. - AC3 DONE — empty and all-zero digests fail before publication/pull; the tagged `action.yml` and handed-off artifact were byte-identical and carried a non-zero digest in the E2E control. - AC4 DONE — image-pull and FETCH-arm smoke paths passed, including `/rt --version` and the cache-hit measurement. - AC5 DONE — missing Docker CLI/daemon and zero-digest producer/verifier mutations fail loudly with diagnostics. - AC6 DONE — the final disposition remains bounded by #794 and #863, and the verification population is recorded as run 5892 / tag `v0.45.0` / source commit `74b059ff65afdb60bf821201aa9b4d98a85e3492`, with the repaired cut verified at PR head `bd643d639cb4bb32c5a4b2d79b622f44abdd8ae4`. Refs #875, #794, #863.

pullings closed this issue

2026-08-25 18:32:23 +02:00

pullings referenced this issue

2026-08-25 18:45:49 +02:00

bug(ci): registry image upload returns 401 after successful build #876

pullings commented

2026-08-25 18:46:04 +02:00

Author

Owner

Follow-up finding, tracked in #876: the first post-merge v0.45.1 run (5931) failed in task 26506 at actions/checkout@v4 with Cannot find: node in PATH on the docker-build host runner. This is a newly exposed runner-capability gap, not a change to the measured Docker/digest behavior closed here; #876 owns the complete Node-plus-Docker action contract and the fresh-cut proof.

Refs #876.

Follow-up finding, tracked in #876: the first post-merge v0.45.1 run (5931) failed in task 26506 at `actions/checkout@v4` with `Cannot find: node in PATH` on the `docker-build` host runner. This is a newly exposed runner-capability gap, not a change to the measured Docker/digest behavior closed here; #876 owns the complete Node-plus-Docker action contract and the fresh-cut proof. Refs #876.