Skip to content

Fix cli-proxy image tag mismatch causing fleet-wide smoke-test outage - #50685

Merged
pelikhan merged 9 commits into
mainfrom
copilot/aw-failures-pin-variant-image-tag
Aug 5, 2026
Merged

Fix cli-proxy image tag mismatch causing fleet-wide smoke-test outage#50685
pelikhan merged 9 commits into
mainfrom
copilot/aw-failures-pin-variant-image-tag

Conversation

Copilot AI commented Aug 5, 2026 •
edited by github-actions Bot
Loading

Copy link
Copy Markdown
Contributor

download_docker_images.sh only tagged digest-pinned AWF images with their version-pinned tag (e.g. :0.27.44), while AWF's compose stack resolves images like cli-proxy via :latest under --pull never. The mismatch caused docker compose up -d --pull never to fail with No such image across 9 smoke workflows since the container stack never started.

Fix

  • actions/setup/sh/download_docker_images.sh: after pulling and resolving the version tag (including the existing digest-pin tag alias step), additionally alias the image under the mutable :latest tag whenever the resolved tag differs from latest. Both the versioned tag and :latest now resolve locally regardless of which reference downstream tooling uses.
# before: only ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.44 existed locally
# after: also tagged as ghcr.io/github/gh-aw-firewall/cli-proxy:latest
docker tag ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.44 ghcr.io/github/gh-aw-firewall/cli-proxy:latest
  • Added a changeset documenting the patch.

Run: https://github.com/github/gh-aw/actions/runs/31052246569> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 5.39 AIC · ⌖ 7.13 AIC · ⊞ 8.3K · ◷

Comment /souschef to run again

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 14.2 AIC · ⌖ 5.16 AIC · ⊞ 8.3K · ◷
Comment /souschef to run again

Copilot AI linked an issue Aug 5, 2026 that may be closed by this pull request
[aw-failures] Fleet-wide smoke-test outage: cli-proxy image tag mismatch (:0.27.44 tagged, :latest expected) blocks 9 workflows #50681
Closed
Copilot AI and others added 2 commits August 5, 2026 20:08
@pelikhan
Alias downloaded Docker images with :latest tag to fix cli-proxy tag …
a6487f1 
…mismatch

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
@pelikhan
Add changeset for cli-proxy tag mismatch fix
98e99d8 
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Pin awf compose stack to versioned image tag Fix cli-proxy image tag mismatch causing fleet-wide smoke-test outage Aug 5, 2026
Copilot AI requested a review from pelikhan August 5, 2026 20:09
@pelikhan
pelikhan marked this pull request as ready for review August 5, 2026 21:46
Copilot AI balanced review requested due to automatic review settings August 5, 2026 21:46
Copilot AI reviewed Aug 5, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes smoke-test startup failures caused by mismatched versioned and latest Docker image tags.

Changes:

  • Adds local :latest aliases after image pulls.
  • Adds a patch changeset documenting the fix.
Show a summary per file
File Description
actions/setup/sh/download_docker_images.sh Adds Docker tag aliasing logic.
.changeset/patch-fix-cli-proxy-latest-tag-alias.md Documents the patch release.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Suppressed comments (1)

actions/setup/sh/download_docker_images.sh:63

  • Splitting on the first colon breaks valid image references whose registry includes a port. registry.example:5000/team/image:v1 produces registry.example:latest instead of registry.example:5000/team/image:latest. Detect a tag only in the final path component and remove only its last colon-delimited suffix.
      if [[ "$tag_ref" == *":"* && "$tag_ref" != *"@"* ]]; then
        local repo_ref="${tag_ref%%:*}"
        local tag_part="${tag_ref##*:}"
        if [[ "$tag_part" != "latest" ]]; then
          local latest_ref="${repo_ref}:latest"
  • Files reviewed: 2/2 changed files
  • Comments generated: 2
  • Review effort level: Balanced

Comment thread actions/setup/sh/download_docker_images.sh Outdated
Comment on lines +45 to +51
tag_ref="${image%%@sha256:*}"
if [[ "$tag_ref" == *":"* ]]; then
echo "Tagging digest-pinned image as $tag_ref"
docker tag "$image" "$tag_ref"
else
tag_ref="$image"
fi
Comment thread actions/setup/sh/download_docker_images.sh
Comment on lines +63 to +65
local latest_ref="${repo_ref}:latest"
echo "Aliasing $tag_ref as $latest_ref"
docker tag "$tag_ref" "$latest_ref"
@gh-aw-bot

gh-aw-bot commented Aug 5, 2026

Copy link
Copy Markdown
Collaborator

@copilot please review the latest PR feedback, refresh this branch if it is behind main, then run the pr-finisher skill and push any follow-up fixes.

Run: https://github.com/github/gh-aw/actions/runs/31052246569

Generated by PR Sous Chef.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 5.39 AIC · ⌖ 7.13 AIC · ⊞ 8.3K · ◷
Comment /souschef to run again

@github-actions github-actions Bot mentioned this pull request Aug 5, 2026
Closed
@gh-aw-bot
fix: tighten AWF docker latest aliasing
a789fc6 
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot AI commented Aug 5, 2026

Copy link
Copy Markdown
Contributor Author

@copilot please review the latest PR feedback, refresh this branch if it is behind main, then run the pr-finisher skill and push any follow-up fixes.

  • failed checks:...

Addressed the follow-up fixes in a789fc6. The branch was already up to date with main; I updated the AWF-only aliasing logic, added coverage for digest-pinned references and concurrent-tag safety, and pushed the result.

Copilot AI requested a review from gh-aw-bot August 5, 2026 22:42
@gh-aw-bot

gh-aw-bot commented Aug 5, 2026

Copy link
Copy Markdown
Collaborator

@copilot please review the latest PR feedback, refresh this branch if it is behind main, then run the pr-finisher skill and push any follow-up fixes.

Run: https://github.com/github/gh-aw/actions/runs/31055742237

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 14.2 AIC · ⌖ 5.16 AIC · ⊞ 8.3K · ◷
Comment /souschef to run again

@pelikhan
pelikhan merged commit 32c363e into main Aug 5, 2026
26 checks passed
@pelikhan
pelikhan deleted the copilot/aw-failures-pin-variant-image-tag branch August 5, 2026 23:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@pelikhan pelikhan Awaiting requested review from pelikhan
@gh-aw-bot gh-aw-bot Awaiting requested review from gh-aw-bot

Assignees

@pelikhan pelikhan

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[aw-failures] Fleet-wide smoke-test outage: cli-proxy image tag mismatch (:0.27.44 tagged, :latest expected) blocks 9 workflows

4 participants

@gh-aw-bot @pelikhan