Repository navigation
fix(ci): push the exported GCE disk to GHCR by relative path - #2524
Merged
Merged
Conversation
oras push rejects absolute file paths ("absolute file path detected"), so
the GHCR base-image publish failed after the disk download. Download into a
dedicated temporary directory and push the file by its relative name from
there, keeping ORAS's path validation on. The bootstrap consumer reads only the
layer's media type and digest, so the layer title changing is harmless.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
With #2514 the publish job now receives the exported disk URI, but
oras pushthen failed:Error: absolute file path detected. If it's intentional, use --disable-path-validation. The disk was downloaded to an absolutemktemppath underRUNNER_TEMP.<role>.tar.gz) from that directory.scripts/bootstrap/gcp_base_images.py) reads only the layer media type and digest, so the changed layer title is harmless.test_deploy_workflow.pynow asserts the relative push.Verification
test_gcp_base_image_publish_uses_gce_native_contract_and_protected_ref_gatepasses.Needed to republish the Claude-free
shifter-gce-kaliandshifter-gce-ubuntu(#2510). GHCR publication only runs fromdevormain.Refs #2463