Repository navigation
fix(ci): pin semantic-release preset and repair python/php image builds after base drift - #76
Merged
Merged
Conversation
…ds after base drift Three independent CI breakages, each root-caused and reproduced before fixing: - release.yml installed semantic-release and the conventionalcommits preset unpinned. Preset 10.0.0 (published 2026-06-26, after our last successful release) requires conventional-changelog-writer@9 while @semantic-release/release-notes-generator still bundles writer@8, so generateNotes fails and no release is cut. Pinned to semantic-release@25.0.9 + conventional-changelog-conventionalcommits@9.3.1; verified the exact pair renders notes and that 10.4.0 reproduces the CI error in a local dry run. - python image: the dhi.io/python:3.14 packaging moved from /opt/python to /usr (interpreter /usr/bin/python, site-packages /usr/lib/python3.14/site-packages) and is now apt-managed. Installing Debian's python3-dev (and the libpulse-dev/portaudio19-dev chains) makes apt REMOVE python-3.14 entirely, which is the 'python: command not found' CI failure. Dropped those packages (headers ship as python-3.14-dev; nothing in requirements/ compiles against pulse or portaudio) and updated the final-stage copy paths and ENTRYPOINT PATH to the new layout. - php image: shared libs were copied from the hard-coded /usr/lib/x86_64-linux-gnu dir, which does not exist in the arm64 php-source stage (lstat error). Now globbed per-arch into /usr/local/lib, which is on the default ld.so path for both arches. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…t in-run Language images do FROM runner_image, which was always pointed at the current run's dev-<sha> tag - but that tag only exists when docker/runner/** changed (runner build job) or on releases (retag-runner). A PR touching a language Dockerfile without touching the runner made every language build fail with 'kubecoderun-runner:dev-<sha>: not found'. Use :latest (the last released runner) in that case; release and force_all behavior unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
🎉 This PR is included in version 3.6.2 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Background: 3 independent CI breakages surfaced today - none caused by the PRs that exposed them, all drift in unpinned externals. Each was root-caused and reproduced by execution before fixing, since these only bite when the relevant path actually runs (language builds only trigger on
docker/changes, and the release job only runs on main).conventional-changelog-conventionalcommits@10(published 2026-06-26, right after our last successful release) requiresconventional-changelog-writer@9, while@semantic-release/release-notes-generatorstill bundles writer@8 - so the unpinnednpm install -gcombo failsgenerateNotesand main cuts no release (seen on the fix(k8s): pin kubernetes client below 36 and self-heal on 401 #74 merge). Pinned tosemantic-release@25.0.9+ preset@9.3.1dhi.io/python:3.14-debian13repackaged python under/usr(interpreter/usr/bin/python, site-packages/usr/lib/python3.14/site-packages) as apt-managed debs - and installing Debian'spython3-devnow makes apt removepython-3.14entirely, which is thepython: command not foundfailure on both arches. droppedpython3-dev(headers already ship aspython-3.14-dev) plusportaudio19-dev/libpulse-devwhose chains pull the same Debian python3 swap - nothing inrequirements/compiles against them. also updated the final-stage copies and ENTRYPOINT PATH off the dead/opt/pythonlayout. console-script shims aren't carried over anymore - the runner invokespython {file}andpython -m pipstill works/usr/lib/x86_64-linux-gnu, which doesn't exist in the arm64 php-source stage (lstaterror). now globbed per-arch into/usr/local/lib, which is on the default ld.so path for bothTesting
Release pin - reproduced both sides in a local scratch-repo dry run against semantic-release 25.0.9:
Python - reproduced the eviction and verified the fixed recipe in the actual base image (
docker runon the exact apt list):PHP - verified the glob COPY + ldconfig resolves argon2/sodium/icu/onig in a local arm64 test build against the real
dhi.io/php:8.5.6-debian13-devanddhi.io/debian-base:trixie-debian13-devimages.This PR touches
docker/, so CI itself builds every language image on both arches - that's the authoritative end-to-end check for the full python/php builds, which are too heavy to have run locally.Review Strategy
The base-image drift class of failure will recur - dhi.io tags are mutable. Worth considering digest pins + Renovate for the
dhi.io/*references in a follow-up, but I didn't want to couple that to unbreaking CI.🤖 Generated with Claude Code