From d18dae4fe9548fcc6a2ff77fe977b5d057ee895a Mon Sep 17 00:00:00 2001
From: Juan Antonio Osorio <ozz@stacklok.com>
Date: Thu, 9 Jul 2026 13:47:56 +0300
Subject: [PATCH] Build builder image in CI when tag is missing

The builder image is tagged by LIBKRUN_VERSION and only built by
builder.yaml after merge to main. When a PR bumps LIBKRUN_VERSION
(e.g. a Renovate update), the image for the new tag doesn't exist
yet, so task build-runner fails pulling it.

Add a registry check in the Build (Linux CGO) job: if the builder
image tag exists, pull it as before; if not, build it locally via
task builder-image-build so CI can verify the bump. Only triggers
when LIBKRUN_VERSION actually changes (libkrunfw-only bumps reuse
the existing tag). Force CONTAINER_RUNTIME=docker so the manifest
check, local build, and build-runner all share storage.
---
 .github/workflows/ci.yaml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 0fff0bb..dbac12e 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -91,10 +91,19 @@ jobs:
   build-cgo-linux:
     name: Build (Linux CGO)
     runs-on: ubuntu-latest
+    env:
+      # Force docker so the manifest check, local build, and build-runner
+      # all use the same container storage. GitHub runners have docker.
+      CONTAINER_RUNTIME: docker
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
 
+      - name: Source versions.env
+        run: |
+          source versions.env
+          echo "LIBKRUN_VERSION=${LIBKRUN_VERSION}" >> "$GITHUB_ENV"
+
       - name: Set up Task
         uses: arduino/setup-task@v3.0.0
         with:
@@ -108,6 +117,23 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      # The builder image is tagged by LIBKRUN_VERSION. When a PR bumps
+      # LIBKRUN_VERSION, the image for that tag doesn't exist yet (it's
+      # built by builder.yaml only after merge to main). Check the registry
+      # and build locally if missing so CI can verify the bump.
+      - name: Check if builder image exists
+        id: check-builder
+        run: |
+          if docker manifest inspect ghcr.io/stacklok/go-microvm-builder:${LIBKRUN_VERSION} >/dev/null 2>&1; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Build builder image locally
+        if: steps.check-builder.outputs.exists == 'false'
+        run: task builder-image-build
+
       - name: Build runner using builder container
         run: task build-runner