Skip to content

ci: retry transient GHCR image inspections #45

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mahoshojoHCG merged 2 commits into from
Aug 31, 2026
Merged

ci: retry transient GHCR image inspections #45

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d2b4efc
ci: retry transient registry inspections
mahoshojoHCG Aug 31, 2026
6436132
fix: scope stable release retry helper
mahoshojoHCG Aug 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 38 additions & 6 deletions .github/workflows/container.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,6 +203,22 @@ jobs:
VERSION: ${{ needs.metadata.outputs.version }}
run: |
set -euo pipefail
inspect_image() {
local attempt
local output
for attempt in 1 2 3 4; do
if output=$(docker buildx imagetools inspect "$@"); then
printf '%s' "$output"
return 0
fi
if [ "$attempt" -eq 4 ]; then
echo "Failed to inspect the image after $attempt attempts" >&2
return 1
fi
echo "::warning::Image inspection attempt $attempt failed; retrying" >&2
sleep $((attempt * 5))
done
}
test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
[[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
[[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]
Expand Down Expand Up @@ -255,7 +271,7 @@ jobs:
;;
esac

manifest=$(docker buildx imagetools inspect "${IMAGE_REPOSITORY}@${IMAGE_DIGEST}" --raw)
manifest=$(inspect_image "${IMAGE_REPOSITORY}@${IMAGE_DIGEST}" --raw)
resolved_digest="sha256:$(printf '%s' "$manifest" | sha256sum | cut -d ' ' -f1)"
if [ "$resolved_digest" != "$IMAGE_DIGEST" ]; then
echo "Resolved digest $resolved_digest differs from $IMAGE_DIGEST" >&2
Expand All @@ -276,7 +292,7 @@ jobs:
validate_image_identity() {
local digest="$1"
local image_configs
image_configs=$(docker buildx imagetools inspect \
image_configs=$(inspect_image \
"${IMAGE_REPOSITORY}@${digest}" --format '{{json .Image}}')
jq -e --arg source "$SOURCE_SHA" --arg version "$VERSION" '
type == "object" and
Expand Down Expand Up @@ -576,6 +592,22 @@ jobs:
SOURCE_SHA: ${{ needs.metadata.outputs.commit_sha }}
run: |
set -euo pipefail
inspect_image() {
local attempt
local output
for attempt in 1 2 3 4; do
if output=$(docker buildx imagetools inspect "$@"); then
printf '%s' "$output"
return 0
fi
if [ "$attempt" -eq 4 ]; then
echo "Failed to inspect the image after $attempt attempts" >&2
return 1
fi
echo "::warning::Image inspection attempt $attempt failed; retrying" >&2
sleep $((attempt * 5))
done
}
[[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
[[ "$IMAGE_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
current_sha=$(git ls-remote --exit-code --heads origin "refs/heads/$DEFAULT_BRANCH" | cut -f1)
Expand All @@ -585,18 +617,18 @@ jobs:
exit 0
fi

manifest=$(docker buildx imagetools inspect "${IMAGE_REPOSITORY}@${IMAGE_DIGEST}" --raw)
version_manifest=$(docker buildx imagetools inspect "$IMAGE_TAG" --raw)
manifest=$(inspect_image "${IMAGE_REPOSITORY}@${IMAGE_DIGEST}" --raw)
version_manifest=$(inspect_image "$IMAGE_TAG" --raw)
if [ "$version_manifest" != "$manifest" ]; then
echo "$IMAGE_TAG no longer resolves to the published digest" >&2
exit 1
fi

moving_tag="${IMAGE_REPOSITORY}:prerelease-latest"
docker buildx imagetools create --tag "$moving_tag" "${IMAGE_REPOSITORY}@${IMAGE_DIGEST}"
moving_manifest=$(docker buildx imagetools inspect "$moving_tag" --raw)
moving_manifest=$(inspect_image "$moving_tag" --raw)
if [ "$moving_manifest" != "$manifest" ]; then
echo "$moving_tag does not resolve to the published manifest" >&2
exit 1
fi
docker buildx imagetools inspect "$moving_tag"
inspect_image "$moving_tag"
44 changes: 38 additions & 6 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,6 +137,22 @@ jobs:
VERSION: ${{ needs.metadata.outputs.version }}
run: |
set -euo pipefail
inspect_image() {
local attempt
local output
for attempt in 1 2 3 4; do
if output=$(docker buildx imagetools inspect "$@"); then
printf '%s' "$output"
return 0
fi
if [ "$attempt" -eq 4 ]; then
echo "Failed to inspect the image after $attempt attempts" >&2
return 1
fi
echo "::warning::Image inspection attempt $attempt failed; retrying" >&2
sleep $((attempt * 5))
done
}
test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
[[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
[[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
Expand Down Expand Up @@ -196,7 +212,7 @@ jobs:
exit 1
fi

manifest=$(docker buildx imagetools inspect "${IMAGE_REPOSITORY}@${IMAGE_DIGEST}" --raw)
manifest=$(inspect_image "${IMAGE_REPOSITORY}@${IMAGE_DIGEST}" --raw)
Comment thread
mahoshojoHCG marked this conversation as resolved.
resolved_digest="sha256:$(printf '%s' "$manifest" | sha256sum | cut -d ' ' -f1)"
if [ "$resolved_digest" != "$IMAGE_DIGEST" ]; then
echo "Resolved digest $resolved_digest differs from $IMAGE_DIGEST" >&2
Expand All @@ -217,7 +233,7 @@ jobs:
validate_image_identity() {
local digest="$1"
local image_configs
image_configs=$(docker buildx imagetools inspect \
image_configs=$(inspect_image \
"${IMAGE_REPOSITORY}@${digest}" --format '{{json .Image}}')
jq -e --arg source "$SOURCE_SHA" --arg version "$VERSION" '
type == "object" and
Expand Down Expand Up @@ -446,6 +462,22 @@ jobs:
VERSION: ${{ needs.metadata.outputs.version }}
run: |
set -euo pipefail
inspect_image() {
local attempt
local output
for attempt in 1 2 3 4; do
if output=$(docker buildx imagetools inspect "$@"); then
printf '%s' "$output"
return 0
fi
if [ "$attempt" -eq 4 ]; then
echo "Failed to inspect the image after $attempt attempts" >&2
return 1
fi
echo "::warning::Image inspection attempt $attempt failed; retrying" >&2
sleep $((attempt * 5))
done
}
[[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
[[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
[[ "$IMAGE_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
Expand All @@ -461,18 +493,18 @@ jobs:
exit 0
fi

manifest=$(docker buildx imagetools inspect "${IMAGE_REPOSITORY}@${IMAGE_DIGEST}" --raw)
version_manifest=$(docker buildx imagetools inspect "$IMAGE_TAG" --raw)
manifest=$(inspect_image "${IMAGE_REPOSITORY}@${IMAGE_DIGEST}" --raw)
version_manifest=$(inspect_image "$IMAGE_TAG" --raw)
if [ "$version_manifest" != "$manifest" ]; then
echo "$IMAGE_TAG no longer resolves to the published digest" >&2
exit 1
fi

moving_tag="${IMAGE_REPOSITORY}:latest"
docker buildx imagetools create --tag "$moving_tag" "${IMAGE_REPOSITORY}@${IMAGE_DIGEST}"
moving_manifest=$(docker buildx imagetools inspect "$moving_tag" --raw)
moving_manifest=$(inspect_image "$moving_tag" --raw)
if [ "$moving_manifest" != "$manifest" ]; then
echo "$moving_tag does not resolve to the published manifest" >&2
exit 1
fi
docker buildx imagetools inspect "$moving_tag"
inspect_image "$moving_tag"