Repository navigation
fix(ci): key the arm64 smoke job on "published an image", not "is a PR" - #215
Merged
Merged
Conversation
The dry run added in #214 failed arm64-smoke, and the failure was correct: IMAGE_REF: ghcr.io/calnode/calnode@ ##[error]build produced no digest, so there is nothing to verify A dry-run dispatch builds without pushing, so it has no digest to pull, but the job's conditions were written as "pull unless this is a pull request". A dispatch is not a pull request, so it took the pull path with an empty digest. After #214 the only event that publishes an image is a push (branch or tag), so gate on that instead: pull the published digest on a push, and build natively for anything else (pull request or dry-run dispatch). The resolver that picks the ref is switched the same way. This is the dry run doing its job: it found a bug in the release path's assumptions before a tag could.
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes
- arm64 smoke gating keyed on
push—Log in to GHCR, the digest pull, and the image resolve now key offgithub.event_name == 'push', with the native local build on!= 'push', so a PR and a dry-run dispatch both build locally and a branch/tag push verifies the exact published digest.
The new predicate is exactly aligned with the unchanged push: ${{ github.event_name == 'push' }} on docker/build-push-action, so it matches precisely when needs.build.outputs.digest is populated. I confirmed the reported failure against run 41550048890 (dispatch): build succeeded, arm64-smoke failed on the empty digest; and the PR run 41550561340 (pull_request) skips the pull and takes the local-build path. The workflow parses as valid YAML, and ns8-module.yml has no workflow_dispatch trigger, so this bug class does not recur there.
deepseek-v4.1-flash ｜ 𝕏
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The release dry run added in #214 immediately failed
arm64-smoke, and it was right to:A dry-run dispatch builds without pushing (that is the point), so there is no digest. But the job's conditions were written as "pull, unless this is a pull request", and a dispatch is not a pull request, so it took the pull path with an empty digest. Before #214, "not a pull request" was a fair proxy for "published an image"; now it is not.
Change
Key on the thing that actually matters: only a
pushpublishes an image.event != pull_requestevent == pushevent != pull_requestevent == pushevent == pull_requestevent != pushevent == pull_request? local : digestevent == push? digest : localSo a pull request and a dry-run dispatch both build and verify locally; a branch push and a tag both pull the exact digest they published.
Note
This bug is worth pointing at: the dry run found an incorrect assumption in the release path before a tag could, which is exactly why it was added.
download-artifact@v8itself passed in that same run.