From 95f7c46b9331541f1593d37da267efb6aec5f47d Mon Sep 17 00:00:00 2001 From: Sebastian Mendel Date: Tue, 15 Sep 2026 16:58:53 +0200 Subject: [PATCH] fix(lint-compose): validate against current compose, not the runner's The job ran `docker compose config` with whatever version the runner image happens to ship. That is v2.38 today, while compose is at v5.5.1, and the gap is not cosmetic: v2.38 rejects `pre_start` with "additional properties not allowed", although it is the documented way to model init containers and current compose accepts it. So the lint reported a valid file as broken, and the repository it fired in worked around the lint by removing the construct - the check made the code worse rather than better. Validating against an older parser than the one deployments actually run is the wrong way round. docker/setup-compose-action now pins the version being validated against, defaulting to latest, with a `compose-version` input for callers that want a fixed one. The input is forwarded through docker-image-ci.yml. Blast radius measured before changing this: two repositories reference the workflow, plus callers of the docker-image-ci meta. A newer compose accepts a superset of what the old one did, so files that pass today keep passing. Assisted-by: claude-code:claude-opus-5 Agent-Session: https://claude.ai/code/session_01FRHeDxbgUnv868eNhVCCsr Agent-Host: 32116e Signed-off-by: Sebastian Mendel --- .github/workflows/docker-image-ci.yml | 5 +++++ .github/workflows/lint-compose.yml | 19 +++++++++++++++++++ 2 files changed, 24 insertions(+) diff --git a/.github/workflows/docker-image-ci.yml b/.github/workflows/docker-image-ci.yml index c429e85..8dbf773 100644 --- a/.github/workflows/docker-image-ci.yml +++ b/.github/workflows/docker-image-ci.yml @@ -102,6 +102,10 @@ on: description: "Space-separated compose files to validate (forwarded to lint-compose)." type: string default: "compose.yml" + compose-version: + description: "Docker Compose version to validate against (forwarded to lint-compose)." + type: string + default: "latest" env-substitutions: description: "Newline-separated KEY=VALUE placeholder pairs for compose validation (forwarded to lint-compose)." type: string @@ -214,6 +218,7 @@ jobs: contents: read with: compose-files: ${{ inputs.compose-files }} + compose-version: ${{ inputs.compose-version }} env-substitutions: ${{ inputs.env-substitutions }} build: diff --git a/.github/workflows/lint-compose.yml b/.github/workflows/lint-compose.yml index ee72cea..f488e0e 100644 --- a/.github/workflows/lint-compose.yml +++ b/.github/workflows/lint-compose.yml @@ -60,6 +60,14 @@ on: description: "Copy `.env.example` to `.env` (when the example file exists) before validating, so committed placeholders resolve." type: boolean default: true + compose-version: + description: >- + Docker Compose version to validate against, e.g. "v5.5.1" or + "latest". The runner's preinstalled version lags behind and rejects + keys that current compose accepts, so validation would otherwise + fail on files that are in fact valid. + type: string + default: "latest" env-substitutions: description: >- Newline-separated KEY=VALUE pairs. For each pair, an empty @@ -149,6 +157,17 @@ jobs: rm -f "$subs_file" fi + # The runner image ships whatever compose version it happens to carry + # (v2.38 as of writing), which rejects keys that current compose + # accepts - `pre_start` among them. Validating against an older parser + # than the one deployments run would report valid files as broken, so + # this pins the version being validated against instead of inheriting + # the runner's. + - name: Set up Docker Compose + uses: docker/setup-compose-action@4eb059ff7f16592f9c84d5ca339c53cb7c5064e2 # v2.3.0 + with: + version: ${{ inputs.compose-version }} + - name: Validate compose configuration env: COMPOSE_FILES: ${{ inputs.compose-files }}