fix(release): assert GHCR images are actually anonymously pullable - #220
Merged
Conversation
The smoke gate crashed on the first private package's 401 (curl -f plus JSON parse) before it could list which images af-stack init cannot pull. It would also have 404'd public OCI manifests after packages were made public, because the Accept header omitted vnd.oci.image.manifest. After each image push, try to set the GHCR package public. The REST API often 404s for org-owned containers — that is a one-time org-owner click in package settings, documented in docs/releasing.md. Signed-off-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Santosh kumar <santoshkumarradha@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release smoke on
main(e989626, run 33667714839) failed while asserting thataf-stack initcan pull the freshly published images with no registry login.Two bugs in that assert, plus the underlying GHCR default:
curl -fagainstghcr.io/tokenreturns 401 with an empty body for private packages, thenjson.loaddies (Expecting value) before the loop can list which images are private.af-stack-supportdesk-agent(already public, tag0.13.0) 404s unlessAcceptincludesapplication/vnd.oci.image.manifest.v1+json. After the three private packages were flipped public, the old check would still have failed.af-stack-runtime,af-stack-dashboard, andaf-stack-customer-appare still private. The REST API cannot change visibility for these org-owned container packages (PATCH 404). An org owner must set them Public once in the UI.This PR hardens the gate, tries to set visibility after each image push, and documents the one-time owner action.
Related issue
Unblocks the failed Release after #219 (
feat(init): scaffolded apps carry their own backend).Changes
scripts/assert-ghcr-public.sh— nocurl -f; lists every private package; OCI image-manifest Accept header.scripts/publish-ghcr-packages.sh— after push, try PATCHvisibility=public; print the package-settings URL on 404.continue-on-error; the anonymous-pull assert still fails closed).docs/releasing.md(GHCR visibility section) anddocs/branch-protection.md.Test plan
AF_STACK_VERSION=0.13.0 scripts/assert-ghcr-public.sh supportdesk-agent→ HTTP 200scripts/publish-ghcr-packages.shreports the public agent OK and prints the runtime settings URLscripts/apply-branch-protection.sh403s for this token). A repo admin should run that script.Notes for reviewers
Do not drop the anonymous-pull assert or mark it
continue-on-error.af-stack inithas nodocker login. A green Release with private images would ship a CLI whose scaffolds cannot boot.fix(release):will re-trigger Release after merge (range still includes the #219 feat, so the version stays 0.13.0 untilv0.13.0exists). That retry is useful only after the three packages are public — or if ActionsGITHUB_TOKENcan PATCH visibility (it could not from this environment).af-stack-supportdesk-agentis already public.