fix(ubuntu): one owner for :rolling, and pin consumers to noble 24.04 - #825
Open
funkypenguin wants to merge 2 commits into
Open
fix(ubuntu): one owner for :rolling, and pin consumers to noble 24.04#825funkypenguin wants to merge 2 commits into
funkypenguin wants to merge 2 commits into
Conversation
`ubuntu` ships three *stable* channels (noble, jammy, focal) and stable channels share a single package, so all three were pushing the same floating `ubuntu:rolling` tag — last build wins. On 2026-08-11 `rolling` was noble's build (b6f7450, 24.04); on 2026-08-12 the focal build overwrote it (dd5112a, 20.04). Renovate saw only "a digest changed", auto-merged, and kavita/openbooks/plextraktsync/resilio-sync/wireguard were rebuilt on Ubuntu 20.04 without anyone choosing that. ombi failed to build on it. Same bug class as 4a399fc (which fixed the *version lookup* for multi-stable-channel apps) but in the *tagging*. Two parts: - A stable channel now owns `:rolling` only if it opts in with "rolling": true, or if it is the app's only stable channel. When an app has >1 stable channel and doesn't have exactly one owner, the build fails loudly rather than silently racing. Declared in metadata.rules.cue (#Channels is a closed definition, so the field has to be schema'd) and set on ubuntu's noble channel. - The six consumers that pinned the floating tag now pin `ubuntu:noble-20260730.1` explicitly, restoring the 24.04 base they were on before 08-12. jellyfin stays on focal-20250404 — that pin is deliberate and self-consistent. Behaviour is unchanged for every other image: ubuntu is the only app in the estate (292 scanned, public + private overlay) with more than one stable channel, and single-stable apps keep publishing `:rolling` implicitly. Non-stable channels each get their own `${app}-${channel}` package and never collided. The GHCR security scan is unaffected — it prefers the per-channel versioned tag and only falls back to `:rolling`. Known limitation, commented at the call site: a metadata-only ownership change doesn't trigger a build (image-rebuild ignores metadata.json, because the build writes publishedVersion back into it and would loop), so `:rolling` stays on the old owner until the new one rebuilds. That applies to this commit too — `ubuntu:rolling` is still the focal image and needs a one-off "Release: Manual" run for ubuntu/noble with push=true. Consumers are unaffected either way now that they pin an explicit tag + digest. Validated locally: cue vet passes on all 274 public + 2 private metadata files; the workflow YAML parses; the tag-ownership logic and its failure guard were exercised against noble/jammy/focal, a single-stable app, and a non-stable channel. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The manual Release run (actions/runs/31696019320) rebuilt ubuntu/noble and handed :rolling back to it, so noble-20260730.1 now resolves to 7d06c5e6 rather than b6f7450. Pin the current build so the merged state matches the registry — b6f7450 was still noble 24.04 and would have worked, renovate would just have bumped it immediately. Verified: ubuntu:rolling == ubuntu:noble-20260730.1 == 7d06c5e6, labelled ubuntu (noble) / 24.04; focal-20250404 stays separate on dd5112a. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What broke
ubuntuships three stable channels (noble, jammy, focal), and stable channels share a single GHCR package — so all three were pushing the same floatingubuntu:rollingtag. Last build wins.ubuntu:rollingb6f7450(noble build)dd5112a(focal build)Renovate saw only "a digest changed", auto-merged, and run 31633965700 rebuilt kavita, openbooks, plextraktsync, resilio-sync and wireguard on Ubuntu 20.04.
ombifailed to build on it. Nobody chose that.Confirmed via the base image's own labels:
dd5112acarriesorg.opencontainers.image.base.title: "ubuntu (focal)"/image.version: 20.04.Same bug class as 4a399fc, which fixed the version lookup for multi-stable-channel apps — this is the same collision in the tagging.
The fix
1. One owner per floating tag. A stable channel publishes
:rollingonly if it opts in with"rolling": true, or if it's the app's only stable channel. If an app has more than one stable channel and doesn't have exactly one owner, the build fails loudly instead of silently racing. The field is declared inmetadata.rules.cue(#Channelsis a closed CUE definition, so it has to be schema'd) and set on ubuntu'snoble.2. Consumers pin an explicit tag. The six Dockerfiles that pinned the floating tag now pin
ubuntu:noble-20260730.1@sha256:b6f7450…, restoring the 24.04 base they were on before 08-12.jellyfinstays onfocal-20250404— that pin is deliberate and self-consistent.Blast radius
Nothing else changes.
ubuntuis the only app in the estate with more than one stable channel (292 scanned, public + private overlay). Single-stable apps keep publishing:rollingimplicitly; non-stable channels get their own${app}-${channel}package and never collided. The GHCR security scan is unaffected — it prefers the per-channel versioned tag and only falls back to:rolling.Validation
cue vetpasses on all 274 public + 2 private metadata filestagsblock checkedcodex-review --base mainpasses; both findings addressed (rebuild-on-ownership-change documented at the call site, non-owner tag expression hardened with|| '')Needed after merge
ubuntu:rollingcurrently points at the focal image and won't move on its own —image-rebuilddeliberately ignoresapps/**/metadata.json(the build writespublishedVersionback into it and would loop), and the scheduled fetch only builds on a version change. So this needs a one-off Release: Manual run withapp=ubuntu,channels=noble,push=trueto hand:rollingback to noble. Documented in a comment at the call site for future ownership moves.Consumers are unaffected either way now that they pin an explicit tag + digest.
🤖 Generated with Claude Code