From 7ea25ee4fdea3d196fb3a32966ae2f8d7c8005d8 Mon Sep 17 00:00:00 2001 From: Per Magnus Petersen Date: Sun, 11 Oct 2026 09:56:26 +0200 Subject: [PATCH] Retry the Harbor manifest copy instead of a probe for it The companion SHA tag step failed on the last build even though the image had already been pushed and deployed. Harbor's vulnerability policy blocks manifest reads while Trivy's scan is Running, and `imagetools create` copies the manifest, so Harbor answered 412 Precondition Failed. Two faults compounded. The loop gated on `imagetools inspect`, but a probe passing is no guarantee the copy will be allowed. And `create` sat outside the condition, so under the default `bash -e` its first failure aborted the step before `exit 0` or any further attempt: the log shows one waiting line, then the error, with 58 of 60 retries unused. Retry the real operation instead, inside the condition so a blocked copy is a reason to wait rather than fatal. The trade-off is that a permanently failing copy now takes the full ten minutes to report instead of failing fast; the previous behaviour failed fast but wrongly, on a transient block. Also records that only the primary tag matters for rollout, since the Flux image policy matches the timestamp tag, so a failure in this step costs the audit tag rather than the deployment. Co-Authored-By: Claude Opus 5 (1M context) --- .gitea/workflows/build.yml | 13 +++++++++++-- AGENTS.md | 6 ++++++ CLAUDE.md | 6 ++++++ 3 files changed, 23 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index 9acf031..3a3d8b5 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -66,14 +66,23 @@ jobs: cache-from: type=registry,ref=${{ env.IMAGE }}:buildcache cache-to: type=registry,ref=${{ env.IMAGE }}:buildcache,mode=max + # The primary tag is already pushed and deployable by the time this runs: + # the image policy selects `main-`, so a failure here costs the + # SHA audit tag, not the rollout. - name: Wait for Harbor policy, then add SHA tag + shell: bash env: PRIMARY: ${{ steps.tags.outputs.primary }} QUALIFIED: ${{ steps.tags.outputs.qualified }} run: | + # Harbor's vulnerability policy blocks manifest reads while Trivy's scan + # is still Running, and `imagetools create` copies the manifest. Retry + # that copy itself rather than an `inspect` probe: a probe that passes is + # no guarantee the copy will, and under the default `bash -e` the first + # blocked copy aborted the step before its retries could run. for attempt in $(seq 1 60); do - if docker buildx imagetools inspect "$PRIMARY" >/dev/null 2>&1; then - docker buildx imagetools create --tag "$QUALIFIED" "$PRIMARY" + if docker buildx imagetools create --tag "$QUALIFIED" "$PRIMARY"; then + echo "tagged $QUALIFIED on attempt $attempt" exit 0 fi echo "waiting for Harbor scan/pull policy ($attempt/60)" diff --git a/AGENTS.md b/AGENTS.md index 51b4e9e..b737c2b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -35,6 +35,12 @@ The image does not set `BTCDATA_URL`; deployments must provide it. `BUILD_SHA` i runner, then publishes immutable linux/amd64 images to `harbor.pmagnus.cloud/btcprice/btcprice`. It embeds the short Git SHA as `APP_VERSION`. +The build pushes two tags: `main-`, then a companion `main--` for +audit. Harbor's vulnerability policy blocks manifest reads while Trivy is still scanning, so +the companion tag is retried until the scan clears. Only the first tag matters for deployment — +the Flux image policy matches `^main-<14 digits>$` — so a failure in that last step costs the +audit tag and nothing else. + Flux image automation updates the manifests in the separate `magnus/deploy` repository and Flux reconciles k3s. CI has no Kubernetes credentials. Production runs two replicas—one on hostinger and one on citadel—and is served at https://btcprice.k8s.pmagnus.cloud through ingress-nginx and diff --git a/CLAUDE.md b/CLAUDE.md index b06fb05..f39c3bf 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -35,6 +35,12 @@ The image does not set `BTCDATA_URL`; deployments must provide it. `BUILD_SHA` i runner, then publishes immutable linux/amd64 images to `harbor.pmagnus.cloud/btcprice/btcprice`. It embeds the short Git SHA as `APP_VERSION`. +The build pushes two tags: `main-`, then a companion `main--` for +audit. Harbor's vulnerability policy blocks manifest reads while Trivy is still scanning, so +the companion tag is retried until the scan clears. Only the first tag matters for deployment — +the Flux image policy matches `^main-<14 digits>$` — so a failure in that last step costs the +audit tag and nothing else. + Flux image automation updates the manifests in the separate `magnus/deploy` repository and Flux reconciles k3s. CI has no Kubernetes credentials. Production runs two replicas—one on hostinger and one on citadel—and is served at https://btcprice.k8s.pmagnus.cloud through ingress-nginx and -- 2.54.0