Repository navigation
Fix GHCR version probe stalling on first release - #49
Merged
Merged
Conversation
The version-tag existence probe used --request HEAD, which changes only the method string. curl still waited for the Content-Length body of the registry's 404 reply, which a HEAD response never carries, so every first release stalled until the connection dropped and failed promotion with exit 18. Retries only repeated the stall. Use --head. A behavioral test runs the workflow's own probe command against a local registry stub for the 404 and 200 paths, with a control proving the old construct stalls, and a contract test rejects --request HEAD in the promotion workflow.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release run 35992778776 failed in Promote immutable image to version with curl exit 18 after about 8 minutes. The GHCR version-tag existence probe in
promote-container.ymlused:--request HEADonly changes the method string. curl still waits for the body advertised byContent-Length. On a first release, GHCR answers the probe with 404 and a 70-byteMANIFEST_UNKNOWNbody length but, correctly for HEAD, sends no body. curl stalls until the connection drops and exits 18. The--retry 3 --retry-all-errorsadded in #41 just repeats the stall four times. Reproduced locally:--request HEADwaits on "0 out of 70 bytes received", while--headreturns404immediately with exit 0.Changes
promote-container.yml:--request HEAD->--head(one line)tests/test_container_promotion_probe.py:Docker-Content-Digestheader, and checks the bearer token is sent.--request HEADform must stall on the same 404.--request HEAD/-X HEAD.CHANGELOG.md: corrects the v0.5.0 bullet that credited ci: harden GHCR promotion curl calls against transfer failures #41's retries with fixing a "token-fetch transfer failure"; the real cause was this probe.No version change; this still releases as 0.5.0.
Validation
compileall,git diff --checkderive 0.5.0->v0.5.0,prerelease: falseNot in scope
The release sequence can still strand an annotated tag if a later job fails. Reordering alone would instead strand an immutable version image, which is worse. That's tracked separately as a follow-up rather than redesigned here.