This repository was archived by the owner on Sep 14, 2026. It is now read-only.
fix(ci): derive control base tags from control/Dockerfile - #64
Merged
Merged
Conversation
scripts/update-control-base-images.sh hardcoded `golang:1.26.6-alpine` both as the candidate to resolve and as a literal regex that control/Dockerfile had to match. Any reviewed tag bump therefore aborted the script with `unexpected Go build base reference`, which failed the "License and prose hygiene" and "Build, boot, persist, and scan candidate" jobs on every Docker dependency PR. #62 (golang 1.26.6-alpine -> 1.27.0-alpine) has been blocked on this since 2026-08-24. The script now reads the pinned tags out of control/Dockerfile and re-resolves their digests. The gate is unchanged in strength: the Go base must still be `golang:<version>-alpine` pinned by a canonical sha256 digest, and the runtime base must still be `alpine:<version>` pinned the same way. Unpinned or off-family references still exit 1. scripts/check-image-drift.sh defaulted to the same literal tag, so after a bump it would have reported permanent phantom drift against a tag the repository no longer builds from. Its defaults now come from control/Dockerfile too; the GHOSTLIGHT_*_BASE_CANDIDATE overrides are unchanged. Verified locally on this branch: - `bash scripts/test-image-safety.sh` passes. - `bash scripts/test-browser-update-workflow.sh` passes. - `bash scripts/check-repo-hygiene.sh` passes. - `shellcheck scripts/update-control-base-images.sh scripts/check-image-drift.sh` is clean. - With #62 merged into this branch, `bash scripts/check-image-safety.sh` and `bash scripts/test-image-safety.sh` both pass and the updater resolves `golang:1.27.0-alpine@sha256:4c9fe60...`. - Negative cases still fail: an unpinned `golang:1.27.0-alpine` and an off-family `golang:1.27.0-bookworm@sha256:...` both exit 1. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XpuXXVrWCZk3Tq5NRXejNP
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What broke
scripts/update-control-base-images.shhardcodedgolang:1.26.6-alpinein two places: as the candidate image to resolve, and as a literal regex thatcontrol/Dockerfilehad to match. Any Go tag bump made the script exit 1 withunexpected Go build base reference.That script runs inside
scripts/test-image-safety.sh, which the CI jobs License and prose hygiene and Build, boot, persist, and scan candidate both execute. So #62 (golang1.26.6-alpine -> 1.27.0-alpine) has been red since 2026-08-24 for a reason unrelated to the bump itself. Failing line from run 32691589249:scripts/check-image-drift.shdefaulted to the same literal tag. After a bump it would compare the 1.26.6 digest against a 1.27.0 pin and report drift forever.The change
The updater now reads the pinned tags out of
control/Dockerfileand re-resolves their digests. The gate keeps the same strength:^golang:[0-9]+\.[0-9]+(\.[0-9]+)?-alpine@sha256:[0-9a-f]{64}$^alpine:[0-9]+\.[0-9]+(\.[0-9]+)?@sha256:[0-9a-f]{64}$Unpinned tags and off-family images still exit 1.
check-image-drift.shtakes its defaults from the same file; theGHOSTLIGHT_GO_BASE_CANDIDATE/GHOSTLIGHT_ALPINE_BASE_CANDIDATEoverrides are untouched.How I verified
On this branch:
bash scripts/test-image-safety.shbash scripts/test-browser-update-workflow.shbash scripts/check-repo-hygiene.shshellcheck scripts/update-control-base-images.sh scripts/check-image-drift.shWith #62 merged into this branch locally,
scripts/check-image-safety.shandscripts/test-image-safety.shboth pass and the updater resolvesgolang:1.27.0-alpine@sha256:4c9fe60....Negative cases still fail as before: unpinned
golang:1.27.0-alpineexits 1, and off-familygolang:1.27.0-bookworm@sha256:...exits 1.Unblocks
#62.
🤖 Generated with Claude Code
https://claude.ai/code/session_01XpuXXVrWCZk3Tq5NRXejNP