Build builder image in CI when tag is missing#109
Merged
Conversation
The builder image is tagged by LIBKRUN_VERSION and only built by builder.yaml after merge to main. When a PR bumps LIBKRUN_VERSION (e.g. a Renovate update), the image for the new tag doesn't exist yet, so task build-runner fails pulling it. Add a registry check in the Build (Linux CGO) job: if the builder image tag exists, pull it as before; if not, build it locally via task builder-image-build so CI can verify the bump. Only triggers when LIBKRUN_VERSION actually changes (libkrunfw-only bumps reuse the existing tag). Force CONTAINER_RUNTIME=docker so the manifest check, local build, and build-runner all share storage.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Renovate PR that bumps
LIBKRUN_VERSION(#107 → v1.19.4) fails theBuild (Linux CGO)check with:The builder image is tagged by
LIBKRUN_VERSIONand only built bybuilder.yamlafter merge to main. When a PR bumpsLIBKRUN_VERSION, the image for the new tag doesn't exist yet, sotask build-runnerfails pulling it — a chicken-and-egg problem.Fix
Add a registry check in the
Build (Linux CGO)job:ghcr.io/stacklok/go-microvm-builder:<LIBKRUN_VERSION>exists → pull as before (fast path; applies to all normal PRs and libkrunfw-only bumps).task builder-image-buildso CI can verify the bump (only happens whenLIBKRUN_VERSIONactually changes).CONTAINER_RUNTIME=dockeris forced for the job so the manifest check, local build, andbuild-runnerall share the same container storage (GitHub runners have docker; the Taskfile default prefers podman, which would use separate storage).Scoping
This only triggers for libkrun version bumps, not libkrunfw bumps or unrelated PRs —
BUILDER_IMAGE_TAGis derived fromLIBKRUN_VERSIONonly (Taskfile.yaml:32), so libkrunfw-only PRs like #108 reuse the existing builder image and take the fast path.Follow-up to #106.