Repository navigation
ci: pin the artifacts catalog on docker image bumps - #6744
Merged
Merged
Conversation
The workload catalog sync opened one branch and PR per service, so a slim-services release train produced a PR per workload. Every dispatch now rebuilds one shared `sync/stack-workload-catalog` branch as develop plus the pins already pending on it plus its own pin, pushes with a lease on the head it read, and recomposes when a concurrent run for another service moved it first. The PR is opened once and then only updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011xm6NLFBFUSFXYrEc7Cp5c
The mirror dispatch should not open a pull request that pins Artifacts.ts. A later workflow will own that catalog update.
avallete
changed the title
Dependabot's Dockerfile pull request is the image bump. Commit the matching slim pins onto that branch so the docker tag, slim image, and native archive stay on one version.
avallete
changed the title
OrioleDB tags have no slim image. Leave them on docker.io and keep pinning the other Dockerfile services. Read those services with the manifest parser instead of a second FROM reader.
avallete
marked this pull request as ready for review
September 23, 2026 14:31
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🤖 AI Review
The new sync can rewrite unrelated catalog pins, including a PostgreSQL downgrade, and can advance tag-only pins without checking publication. Skipped pins do not fail the job or receive a later publication-triggered refresh. Its generated commit does not trigger fresh pull request CI. The claimed regctl manifest head output bug is refuted by the repository’s existing mirror implementation and tests.
Findings
| Severity | Location | Category | Sources | Claim |
|---|---|---|---|---|
| 🟠 MAJOR | .github/workflows/sync-artifacts-catalog.yml:90 |
ci-trigger |
claude+codex | The catalog commit is pushed with the checkout’s GITHUB_TOKEN, so it does not trigger fresh pull request CI for the rewritten catalog. |
| 🟠 MAJOR | .github/scripts/sync-artifacts-catalog.ts:206 |
correctness |
claude | One Dockerfile bump can rewrite unrelated catalog pins and move a pin backwards. |
| 🟠 MAJOR | .github/scripts/sync-artifacts-catalog.ts:227 |
publication-check |
claude+codex | Tag-only catalog entries can advance before their slim image or native release is published. |
| 🟠 MAJOR | .github/scripts/sync-artifacts-catalog.ts:292 |
error-handling |
claude | A mapped Dockerfile pin that cannot be applied only produces a warning, allowing the sync job to succeed with a partial or missing catalog update. |
| 🟠 MAJOR | docs/adr/0026-slim-artifact-mirrors.md:16 |
release-coverage |
claude | Removing the publication dispatch consumer leaves the additional PostgreSQL 15.x catalog line and same-version digest republishes without an automatic sync path. |
| 🟠 MAJOR | .github/workflows/sync-artifacts-catalog.yml:16 |
workflow-trigger |
codex | A digest pin skipped while publication is pending has no automatic refresh when that slim manifest appears later. |
| 🟡 MINOR | .github/workflows/sync-artifacts-catalog.yml:85 |
formatting |
claude | The generated catalog is committed without formatting, so a version-length change can leave Artifacts.ts failing fmt:check. |
| 🟡 MINOR | .github/scripts/sync-artifacts-catalog.test.ts:187 |
test-coverage |
claude+codex | The real-catalog test does not verify that every mapped Dockerfile alias has a catalog entry. |
| 🟡 MINOR | .github/workflows/sync-artifacts-catalog.yml:33 |
registry-access |
claude | Digest lookups rely on anonymous GHCR access, and authentication or network failures are treated as missing manifests. |
| 🟡 MINOR | .github/workflows/github-scripts-ci.yml:12 |
ci-coverage |
claude+codex | Changes to the new script’s shared parser or slim-image mapping do not trigger its dedicated GitHub-scripts CI workflow. |
| 🟡 MINOR | .github/workflows/sync-artifacts-catalog.yml:90 |
concurrency |
claude | If the Dependabot branch moves after the head check but before the push, the sync job fails instead of retrying or exiting cleanly. |
| ⚪ NIT | .github/scripts/sync-artifacts-catalog.ts:135 |
consistency |
claude | The digest-prefetch pass silently ignores an invalid version that the planning pass then rejects. |
| ⚪ NIT | .github/scripts/sync-artifacts-catalog.ts:207 |
observability |
claude | An OrioleDB image on an alias with no slim mapping is still reported as a skipped catalog pin. |
Refuted findings (kept for transparency, not posted as review comments)
.github/scripts/sync-artifacts-catalog.ts:253(correctness): Digest-pinned entries are skipped because regctl manifest head outputs fields rather than a bare digest.
Refuted: The trusted default-branch mirror implementation uses the same regctl manifest head command and compares its trimmed stdout directly with a sha256 digest (trusted/.github/scripts/mirror-slim-image.ts:105-114). Its matching-head test supplies a bare digest as stdout (trusted/.github/scripts/mirror-slim-image.test.ts:101-109). The finding’s asserted fields-output contract conflicts with this existing repository command contract.
Stats
Claude findings: 12 · Codex findings: 6 · Confirmed: 13 · Refuted: 1 · Uncertain: 0
Models: claude-opus-5 + gpt-6-sol · Trigger: auto · Workflow run
This review runs once per PR. A maintainer can request another with a /ai-review comment.
A Dependabot bump was rewriting every slim pin, including a PostgreSQL downgrade, and the catalog push did not trigger CI.
The old catalog script was the only external caller, so the export failed knip.
jgoux
approved these changes
Sep 23, 2026
avallete
enabled auto-merge
September 23, 2026 15:39
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Sep 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
packages/stack/src/Artifacts.ts.