From a778ac000deacd15f692192c6ea3d88cd7c9301c Mon Sep 17 00:00:00 2001 From: Alkin Tezuysal Date: Sat, 31 Oct 2026 14:21:47 +0000 Subject: [PATCH 1/4] fix(docker): base component images on their exact build release A component works only on the MySQL release it was built against: a component_mcp_guard built for 8.4.8 crashed mysql:8.4 (8.4.11) in the #244 dry run. The component images were built for 8.4.8 / 9.7.0 but based on the floating mysql:8.4 / mysql:9.7. - docker-publish.yml: build the component for 8.4.11, 9.7.2, 26.10.0, base each image on mysql:, also tag it with the release (mysql8.4.11-component, mysql9.7.2-component, mysql26.10.0), and run the artifact smoke test on the same release. - Dockerfile.component: MYSQL_VERSION is required (no default). - docs/DOCKER_IMAGES.md, CHANGELOG. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/docker-publish.yml | 23 +++++++++++++++++------ CHANGELOG.md | 1 + Dockerfile.component | 5 ++++- docs/DOCKER_IMAGES.md | 6 ++++++ 4 files changed, 28 insertions(+), 7 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 6bd7d463..94d35bdd 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -226,18 +226,27 @@ jobs: fail-fast: false matrix: include: - - mysql-tag: 'mysql-8.4.8' + # A component works only on the exact release it was built against (a build for + # 8.4.8 crashed 8.4.11 in askdba/myvector#244), so each image is based on + # mysql:, the release of mysql-tag, and also tagged with it. + - mysql-tag: 'mysql-8.4.11' + mysql-release: '8.4.11' mysql-version: '8.4' build-script: scripts/build-component-8.4-docker.sh image-tag: 'mysql8.4-component' - - mysql-tag: 'mysql-9.7.0' + release-image-tag: 'mysql8.4.11-component' + - mysql-tag: 'mysql-9.7.2' + mysql-release: '9.7.2' mysql-version: '9.7' build-script: scripts/build-component-9.7-docker.sh image-tag: 'mysql9.7-component' + release-image-tag: 'mysql9.7.2-component' - mysql-tag: 'mysql-26.10.0' + mysql-release: '26.10.0' mysql-version: '26.10' build-script: scripts/build-component-26.10-docker.sh image-tag: 'mysql26.10' + release-image-tag: 'mysql26.10.0' steps: - name: Checkout MyVector Code uses: actions/checkout@v4 @@ -269,7 +278,7 @@ jobs: - name: Smoke test component artifact run: | chmod +x scripts/smoke-component.sh - COMPONENT_DIR=build/component-amd64 ./scripts/smoke-component.sh "${{ matrix.mysql-version }}" + COMPONENT_DIR=build/component-amd64 ./scripts/smoke-component.sh "${{ matrix.mysql-release }}" - name: Smoke test image contents run: | @@ -277,7 +286,7 @@ jobs: docker buildx build \ --platform "linux/${arch}" \ --file Dockerfile.component \ - --build-arg MYSQL_VERSION=${{ matrix.mysql-version }} \ + --build-arg MYSQL_VERSION=${{ matrix.mysql-release }} \ -t "myvector-component-smoke:${{ matrix.mysql-version }}-${arch}" \ --load \ . @@ -308,6 +317,8 @@ jobs: platforms: linux/amd64,linux/arm64 # Never push on a dry_run dispatch — build only, to prove the pipeline. push: ${{ !(github.event_name == 'workflow_dispatch' && inputs.dry_run) }} - tags: ghcr.io/${{ github.repository }}:${{ matrix.image-tag }} + tags: | + ghcr.io/${{ github.repository }}:${{ matrix.image-tag }} + ghcr.io/${{ github.repository }}:${{ matrix.release-image-tag }} build-args: | - MYSQL_VERSION=${{ matrix.mysql-version }} + MYSQL_VERSION=${{ matrix.mysql-release }} diff --git a/CHANGELOG.md b/CHANGELOG.md index e404d565..16d90dfc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -125,6 +125,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 and rebuild the index. See [Declaring a Vector Column](docs/usage.md#declaring-a-vector-column). ### Fixed +- **Component images pinned to their build release.** A component works only on the exact MySQL release it was built against: in a dry run, a `component_mcp_guard` built for 8.4.8 crashed `mysql:8.4` (8.4.11). The images were built for 8.4.8 and 9.7.0 but ran on the floating `mysql:8.4`/`mysql:9.7`. `docker-publish.yml` now builds the component images for **8.4.11, 9.7.2 and 26.10.0** and bases each one on `mysql:`. It also tags each image with its release (`mysql8.4.11-component`, `mysql9.7.2-component`, `mysql26.10.0`), and the artifact smoke test runs on the same release. `Dockerfile.component` now requires `MYSQL_VERSION` (no default). - **Component build scripts reconfigure the server tree after a failed configure.** A `.configure-ok` marker is written only after `cmake` succeeds; before, the scripts trusted `CMakeCache.txt`, which appears before configuration finishes, so a failed configure was skipped on the next run. - **Component build scripts no longer re-clone the MySQL source on every run.** Inside the build container, git refused the host-owned tree ("dubious ownership"), so the tag check always failed and the tree was deleted and cloned again, which also defeated the CI cache of the source tree. The scripts now mark the tree as a git safe directory. - **Component: `myvector_construct()` with a constant argument is built once, not per row** diff --git a/Dockerfile.component b/Dockerfile.component index ea26434d..6f36b372 100644 --- a/Dockerfile.component +++ b/Dockerfile.component @@ -1,4 +1,7 @@ -ARG MYSQL_VERSION=8.4 +# MYSQL_VERSION (required, no default) is the exact release the component was built +# against, for example 8.4.11: a component built for another patch release can crash +# the server. +ARG MYSQL_VERSION FROM mysql:${MYSQL_VERSION} ARG TARGETARCH diff --git a/docs/DOCKER_IMAGES.md b/docs/DOCKER_IMAGES.md index 473495b4..eb7774ce 100644 --- a/docs/DOCKER_IMAGES.md +++ b/docs/DOCKER_IMAGES.md @@ -221,6 +221,12 @@ instructions in the main README: | `ghcr.io/askdba/myvector:mysql26.10` | 26.10.x (Innovation) | Component only (`INSTALL COMPONENT`) | | `ghcr.io/askdba/myvector:latest` | 8.0.x | Plugin (`INSTALL PLUGIN`) | +Each component image is based on the exact MySQL release its component was built +against: a component built for one patch release can crash another (an 8.4.8 build +crashed 8.4.11). The image is also tagged with that release, e.g. +`mysql8.4.11-component`, `mysql9.7.2-component`, `mysql26.10.0`; the version tags +above move to the new release when the build is updated. + Component images (`INSTALL COMPONENT`) contain `/usr/lib/mysql/plugin/myvector.so` + `myvector.json` and `/docker-entrypoint-initdb.d/myvector_install_component.sql`, rather than the plugin's `myvectorplugin.sql`. From 36b31cb24293f01f910d30e6467f01602758db1c Mon Sep 17 00:00:00 2001 From: Alkin Tezuysal Date: Sat, 31 Oct 2026 14:57:13 +0000 Subject: [PATCH 2/4] fix(docker): pin component images to 8.4.13 and 9.7.4 The floating mysql:8.4 and mysql:9.7 tags have moved to 8.4.13 and 9.7.4; build and base the component images on those, so pinning does not move users to an older server. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/docker-publish.yml | 12 ++++++------ CHANGELOG.md | 2 +- Dockerfile.component | 2 +- docs/DOCKER_IMAGES.md | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 94d35bdd..7a91d1a2 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -229,18 +229,18 @@ jobs: # A component works only on the exact release it was built against (a build for # 8.4.8 crashed 8.4.11 in askdba/myvector#244), so each image is based on # mysql:, the release of mysql-tag, and also tagged with it. - - mysql-tag: 'mysql-8.4.11' - mysql-release: '8.4.11' + - mysql-tag: 'mysql-8.4.13' + mysql-release: '8.4.13' mysql-version: '8.4' build-script: scripts/build-component-8.4-docker.sh image-tag: 'mysql8.4-component' - release-image-tag: 'mysql8.4.11-component' - - mysql-tag: 'mysql-9.7.2' - mysql-release: '9.7.2' + release-image-tag: 'mysql8.4.13-component' + - mysql-tag: 'mysql-9.7.4' + mysql-release: '9.7.4' mysql-version: '9.7' build-script: scripts/build-component-9.7-docker.sh image-tag: 'mysql9.7-component' - release-image-tag: 'mysql9.7.2-component' + release-image-tag: 'mysql9.7.4-component' - mysql-tag: 'mysql-26.10.0' mysql-release: '26.10.0' mysql-version: '26.10' diff --git a/CHANGELOG.md b/CHANGELOG.md index 16d90dfc..01fe3000 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -125,7 +125,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 and rebuild the index. See [Declaring a Vector Column](docs/usage.md#declaring-a-vector-column). ### Fixed -- **Component images pinned to their build release.** A component works only on the exact MySQL release it was built against: in a dry run, a `component_mcp_guard` built for 8.4.8 crashed `mysql:8.4` (8.4.11). The images were built for 8.4.8 and 9.7.0 but ran on the floating `mysql:8.4`/`mysql:9.7`. `docker-publish.yml` now builds the component images for **8.4.11, 9.7.2 and 26.10.0** and bases each one on `mysql:`. It also tags each image with its release (`mysql8.4.11-component`, `mysql9.7.2-component`, `mysql26.10.0`), and the artifact smoke test runs on the same release. `Dockerfile.component` now requires `MYSQL_VERSION` (no default). +- **Component images pinned to their build release.** A component works only on the exact MySQL release it was built against: in a dry run, a `component_mcp_guard` built for 8.4.8 crashed `mysql:8.4` (8.4.11). The images were built for 8.4.8 and 9.7.0 but ran on the floating `mysql:8.4`/`mysql:9.7`. `docker-publish.yml` now builds the component images for **8.4.13, 9.7.4 and 26.10.0** (the releases the floating tags now point to) and bases each one on `mysql:`. It also tags each image with its release (`mysql8.4.13-component`, `mysql9.7.4-component`, `mysql26.10.0`), and the artifact smoke test runs on the same release. `Dockerfile.component` now requires `MYSQL_VERSION` (no default). - **Component build scripts reconfigure the server tree after a failed configure.** A `.configure-ok` marker is written only after `cmake` succeeds; before, the scripts trusted `CMakeCache.txt`, which appears before configuration finishes, so a failed configure was skipped on the next run. - **Component build scripts no longer re-clone the MySQL source on every run.** Inside the build container, git refused the host-owned tree ("dubious ownership"), so the tag check always failed and the tree was deleted and cloned again, which also defeated the CI cache of the source tree. The scripts now mark the tree as a git safe directory. - **Component: `myvector_construct()` with a constant argument is built once, not per row** diff --git a/Dockerfile.component b/Dockerfile.component index 6f36b372..f6c2e0d5 100644 --- a/Dockerfile.component +++ b/Dockerfile.component @@ -1,5 +1,5 @@ # MYSQL_VERSION (required, no default) is the exact release the component was built -# against, for example 8.4.11: a component built for another patch release can crash +# against, for example 8.4.13: a component built for another patch release can crash # the server. ARG MYSQL_VERSION diff --git a/docs/DOCKER_IMAGES.md b/docs/DOCKER_IMAGES.md index eb7774ce..2b387336 100644 --- a/docs/DOCKER_IMAGES.md +++ b/docs/DOCKER_IMAGES.md @@ -224,7 +224,7 @@ instructions in the main README: Each component image is based on the exact MySQL release its component was built against: a component built for one patch release can crash another (an 8.4.8 build crashed 8.4.11). The image is also tagged with that release, e.g. -`mysql8.4.11-component`, `mysql9.7.2-component`, `mysql26.10.0`; the version tags +`mysql8.4.13-component`, `mysql9.7.4-component`, `mysql26.10.0`; the version tags above move to the new release when the build is updated. Component images (`INSTALL COMPONENT`) contain `/usr/lib/mysql/plugin/myvector.so` + From cff37484ed7afe50883b3259efd490e0db3cc72d Mon Sep 17 00:00:00 2001 From: Alkin Tezuysal Date: Sat, 31 Oct 2026 14:57:43 +0000 Subject: [PATCH 3/4] docs(examples): build the movie-finder image on the component's release The example built the component for mysql-9.7.0 and the image FROM the floating mysql:9.7; use 9.7.4 for both (CodeRabbit, #245). Co-Authored-By: Claude Opus 5.5 --- examples/movie-finder/README.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/examples/movie-finder/README.md b/examples/movie-finder/README.md index 717ddc17..2f52415e 100644 --- a/examples/movie-finder/README.md +++ b/examples/movie-finder/README.md @@ -91,10 +91,11 @@ a restart. Until a release includes them, build a local image from `main`: ```bash # from the repository root; ARCH is arm64 or amd64, matching your machine ARCH=arm64 -./scripts/build-component-9.7-docker.sh mysql-9.7.0 build/component-local +./scripts/build-component-9.7-docker.sh mysql-9.7.4 build/component-local cp build/component-local/libmyvector_component.so myvector-component-$ARCH.so cp build/component-local/myvector.json sql/myvector_install_component.sql sql/myvector_uninstall_component.sql . -docker build -f Dockerfile.component --build-arg MYSQL_VERSION=9.7 \ +# MYSQL_VERSION must be the release the component was built for (mysql-9.7.4 above) +docker build -f Dockerfile.component --build-arg MYSQL_VERSION=9.7.4 \ --build-arg TARGETARCH=$ARCH -t myvector-local:mysql9.7-component . cd examples/movie-finder From 89dc2c6dae92dd1f7744bd209bea6d7ed25a4336 Mon Sep 17 00:00:00 2001 From: Alkin Tezuysal Date: Sat, 31 Oct 2026 15:52:36 +0000 Subject: [PATCH 4/4] fix(build): configure 9.7 without WebAuthn (9.7.4 enables it by default) The dry run of #245 failed configuring mysql-9.7.4: like 26.10, 9.7.4 builds the WebAuthn plugin by default and needs libudev/libfido2 headers the build container lacks. Turn it off as build-component-26.10-docker.sh does; the component build needs only generated headers. Co-Authored-By: Claude Opus 5.5 --- scripts/build-component-9.7-docker.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/scripts/build-component-9.7-docker.sh b/scripts/build-component-9.7-docker.sh index 00de2ee2..a3ac677b 100755 --- a/scripts/build-component-9.7-docker.sh +++ b/scripts/build-component-9.7-docker.sh @@ -95,6 +95,8 @@ docker run --rm \ # so a failed configure would otherwise be skipped on the next run. if [ ! -f "$MYSQL_BLD/.configure-ok" ]; then cd "$MYSQL_BLD" + # WebAuthn: on by default from 9.7.4 (as in 26.10), it needs libudev/libfido2 + # headers this container does not have; the component build needs none of it. cmake .. \ -DCMAKE_C_COMPILER=/opt/rh/gcc-toolset-14/root/usr/bin/gcc \ -DCMAKE_CXX_COMPILER=/opt/rh/gcc-toolset-14/root/usr/bin/g++ \ @@ -106,6 +108,7 @@ docker run --rm \ -DWITH_NDB=OFF \ -DWITH_NDBCLUSTER=OFF \ -DWITH_GROUP_REPLICATION=OFF \ + -DWITH_AUTHENTICATION_WEBAUTHN=OFF \ -DWITH_EXAMPLE_STORAGE_ENGINE=OFF \ -DCMAKE_BUILD_TYPE=Release touch "$MYSQL_BLD/.configure-ok"