fix(cozystack-api): pin the image to the build that ships the SecurityGroup API - #3169
fix(cozystack-api): pin the image to the build that ships the SecurityGroup API#3169Andrei Kvapil (kvaps) wants to merge 1 commit into
Conversation
…yGroup API #2922 added the sdn.cozystack.io SecurityGroup API to cozystack-api, but main's committed image is still the v1.5.0 release, which predates it — the new build was only pinned transiently inside #2922's own E2E and never committed. As a result every PR that does not itself rebuild cozystack-api installs the old apiserver, so `kubectl get securitygroup` returns "the server doesn't have a resource type" and the securitygroup / serviceexposure e2e tests fail on unrelated PRs. Pin cozystack-api to the current main-HEAD build that carries the API (image mirrored to ghcr from the #2922 build). Stopgap until a release re-pins it through the normal build. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io>
📝 WalkthroughWalkthroughThis PR updates the pinned container image reference for the cozystack-api component in the Helm values file, changing the image tag from v1.5.0 to v0.0.0 with a corresponding new sha256 digest. ChangesImage Reference Update
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses a regression where the cozystack-api component was running an outdated version lacking the SecurityGroup API. By pinning the image to a verified build digest, it ensures that the environment correctly supports the new API, preventing test failures in unrelated pull requests. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
There was a problem hiding this comment.
Code Review
This pull request updates the cozystack-api image tag and digest in values.yaml. Feedback highlights that manually editing image digest values in values.yaml violates the repository style guide, as these should be managed by CI via make image. Additionally, the pull request description is missing the required release-note block.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| @@ -1,3 +1,3 @@ | |||
| cozystackAPI: | |||
| image: ghcr.io/cozystack/cozystack/cozystack-api:v1.5.0@sha256:ef50b155e419cf8f0b4d57af9fa385ecbacd5c1248f13591ffcca75c2f9f2a07 | |||
| image: ghcr.io/cozystack/cozystack/cozystack-api:v0.0.0@sha256:e272d098cb0ab5a8bce3c3509350dce0847d752920e0effc7ecb9c97bafc24f8 | |||
There was a problem hiding this comment.
The repository style guide states that image digest values in values.yaml should be set by CI via make image rather than being manually edited. Although this is intended as a temporary stopgap, manual edits to these digests violate this guideline and are prone to being overwritten during subsequent automated updates.
References
- Image digest values in values.yaml should be set by CI via make image, not by humans. (link)
| @@ -1,3 +1,3 @@ | |||
| cozystackAPI: | |||
| image: ghcr.io/cozystack/cozystack/cozystack-api:v1.5.0@sha256:ef50b155e419cf8f0b4d57af9fa385ecbacd5c1248f13591ffcca75c2f9f2a07 | |||
| image: ghcr.io/cozystack/cozystack/cozystack-api:v0.0.0@sha256:e272d098cb0ab5a8bce3c3509350dce0847d752920e0effc7ecb9c97bafc24f8 | |||
There was a problem hiding this comment.
The pull request body is missing the required release-note block. Please add a release-note block to the PR description.
References
- PR body must contain a release-note block. (link)
There was a problem hiding this comment.
🧹 Nitpick comments (1)
packages/system/cozystack-api/values.yaml (1)
2-2: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winSingle-arch digest pin — confirm platform support and mark as temporary.
Per the PR description, this digest is from an amd64-only mirrored build used as a stopgap. Pinning by digest (rather than a multi-arch manifest tag) means this will fail to pull/run on non-amd64 nodes (e.g. arm64) until a proper multi-arch release replaces it. Consider adding a YAML comment above this line noting it's a temporary stopgap pin (with a link/reference to the tracking issue) so it isn't missed when reverting to the normal release process.
📝 Suggested comment annotation
cozystackAPI: + # TEMPORARY: pinned to amd64-only digest from PR `#2922` build as a stopgap + # until a normal release re-pins cozystack-api via the standard build. image: ghcr.io/cozystack/cozystack/cozystack-api:v0.0.0@sha256:e272d098cb0ab5a8bce3c3509350dce0847d752920e0effc7ecb9c97bafc24f8🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/system/cozystack-api/values.yaml` at line 2, The image pin in the values configuration is a temporary amd64-only digest and should be clearly marked so it is not mistaken for a permanent release pin. Add a YAML comment above the image entry in the cozystack-api values file noting that this digest is a stopgap, that it may not work on non-amd64 nodes, and referencing the tracking issue or follow-up for the proper multi-arch release.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@packages/system/cozystack-api/values.yaml`:
- Line 2: The image pin in the values configuration is a temporary amd64-only
digest and should be clearly marked so it is not mistaken for a permanent
release pin. Add a YAML comment above the image entry in the cozystack-api
values file noting that this digest is a stopgap, that it may not work on
non-amd64 nodes, and referencing the tracking issue or follow-up for the proper
multi-arch release.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 932a7c02-7703-43b5-b8e7-52c27df86b8a
📒 Files selected for processing (1)
packages/system/cozystack-api/values.yaml
What
Pin
packages/system/cozystack-api/values.yamlto the current main-HEAD cozystack-api build that carries thesdn.cozystack.ioSecurityGroup API.Why
#2922 added the SecurityGroup API to cozystack-api, but main's committed image is still the
v1.5.0release, which predates it. cozystack-api was only rebuilt transiently inside #2922's own E2E (via the per-PR digest patch) and that digest was never committed to main.Consequence: any PR that does not itself rebuild cozystack-api installs the old apiserver, so the aggregated
v1alpha1.sdn.cozystack.ioAPIService has no backing implementation andkubectl get securitygroupreturns "the server doesn't have a resource type". The securitygroup and serviceexposure e2e tests therefore fail on every unrelated PR, blocking main.How
The image is mirrored to ghcr from the #2922 build (amd64, digest
e272d098…) and pinned by digest. This is a stopgap so unrelated PRs stop failing; a normal release should re-pin cozystack-api through the standard build.Companion to the securitygroup-controller placeholder image being unpublished (same class of gap — a newly-added in-house image not committed after merge).
Summary by CodeRabbit