Skip to content

CI: fix the zodlinc mirror step, which has never succeeded - #599

Open
LarryRuane wants to merge 1 commit into
masterfrom
fix/crane-mirror-creds
Open

CI: fix the zodlinc mirror step, which has never succeeded#599
LarryRuane wants to merge 1 commit into
masterfrom
fix/crane-mirror-creds

Conversation

@LarryRuane

Copy link
Copy Markdown
Collaborator

The Push to zodlinc step in docker_push has never succeeded. It failed at v0.5.4 with:

Error: unknown flag: --src-creds

crane copy has no --src-creds or --dst-creds. Those are skopeo's flags, and skopeo spells the second one --dest-creds, so the step was written against a different tool's interface.

It also failed at v0.5.2 and v0.5.3, there with crane: command not foundgo install writes to GOPATH/bin, which is not on PATH in this job. That was fixed after v0.5.3, and fixing it is what let the run get far enough to hit the flags. The net effect is that the mirror has been updated by hand after all three releases; zodlinc/lightwalletd:latest currently still points at v0.5.3.

The credentials the step was trying to pass turn out not to be needed. The only image it reads is electriccoinco/lightwalletd:<tag>, and that repository is public, so the docker login session conflict described in the old comment does not arise: authenticate as the destination org, then copy. The two source secrets leave the step's environment along with the flags.

This cannot be verified before merge. docker_push runs only on if: github.event_name == 'release', so the first real exercise is the next release publish. Worth watching that run rather than assuming it.

`crane copy` has no `--src-creds` or `--dst-creds`; those are skopeo's
flags, and skopeo spells the second one `--dest-creds`. The step failed
at v0.5.4 with `unknown flag: --src-creds`.

It also failed at v0.5.2 and v0.5.3, there with `crane: command not
found`, because `go install` writes to GOPATH/bin which is not on PATH
in this job. Addressing that uncovered the flags as the next error, so
the step has not once run to completion; the mirror has been updated by
hand after each release.

The credentials it was trying to pass are not needed. Only
`electriccoinco/lightwalletd:<tag>` is read, and that repository is
public, so the docker login session conflict the old comment worked
around does not arise: authenticate as the destination org and copy.
The two source secrets leave the step's environment with them.

This cannot be verified until the next release publishes, since
`docker_push` runs only on `github.event_name == 'release'`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015DeK7pepamvANHSUUZWBpm
@LarryRuane
LarryRuane requested a review from y4ssi August 27, 2026 18:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant