fix(docker): make the full image buildable, and fail the release when it is not - #193
Merged
Merged
Conversation
… it is not docker/Dockerfile copies scripts/ and tests/ — that image exists for local development and cross-version testing via start.sh — but .dockerignore excluded both, so the build died at the first COPY: COPY --chown=root:root --chmod=755 scripts/ scripts/ ERROR: failed to compute cache key: "/scripts": not found Broken since 6ef36c5 (2026-03-22, "tighten .dockerignore"). ghcr.io/dbdiff/dbdiff :full and :full-<version> return 404 — the full image has never been published, while :latest and the versioned slim tags are fine. It went unnoticed because the push steps are continue-on-error, which is right for a registry outage but also swallowed a build that could not succeed at all: every release reported success. Two changes: - .dockerignore no longer excludes scripts/ or tests/. Dockerfile.slim copies neither, so this costs it only build context. - both images are now built without pushing, before any push step, and those validation steps are NOT continue-on-error. A broken Dockerfile fails the release loudly. Layers go to the gha cache, so the push steps reuse them rather than rebuilding. Verified locally with podman: the full image builds, contains scripts/, tests/ and src/ as the Dockerfile intends, and runs; the slim image is unaffected. actionlint clean. Co-Authored-By: Claude <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The problem
docker/Dockerfile(the full image) copiesscripts/andtests/— that image exists for local development and cross-version testing viastart.sh— but.dockerignoreexcluded both:Dockerfile.slimcopies neither, which is why only the full image failed.How long, and what it cost
Broken since
6ef36c5(2026-03-22, "tighten .dockerignore") — five months.I checked the registry rather than assuming:
ghcr.io/dbdiff/dbdiff:latestghcr.io/dbdiff/dbdiff:3.0.0-rc.8ghcr.io/dbdiff/dbdiff:fullghcr.io/dbdiff/dbdiff:full-3.0.0-rc.8The full image has never been published. The documented tag simply does not exist.
Why nobody noticed
The push steps are
continue-on-error: true. That is right for a registry outage — a Docker Hub problem should not block GHCR — but it also swallowed a build that could never succeed. buildx logged##[error] buildx failed with: ERROR: failed to build, and the job still concluded success, so every release reported green while publishing nothing.The fix
1.
.dockerignoreno longer excludesscripts/ortests/.Dockerfile.slimcopies neither, so this costs it only build context.2. Both images are built without pushing, before any push step, and those validation steps are not
continue-on-error. A broken Dockerfile now fails the release loudly, while registry resilience is preserved for the actual pushes. Layers land in the gha cache, so the push steps reuse them rather than rebuilding.Verification
Reproduced the failure locally with podman, then confirmed the fix:
/usr/src/dbdiff/scripts,/usr/src/dbdiff/testsand/usr/src/dbdiff/srcas the Dockerfile intendsdb:3306, the expected compose behaviour)actionlintcleanWorth considering separately
Images are only built during
release.yml, so even with this change a broken Dockerfile is caught at release time rather than on the PR that breaks it. Adding a build-only job to the PR workflow would move that left. Left out here to keep this change focused.🤖 Generated with Claude Code