[flowcool]

Behavior

Native RC builds failed before image publication because the host runtime check imported release_image.py without its requests dependency. Install the exact hashed runtime requirements after Python setup in both native build jobs. The existing image identity and isolated runtime checks can then run.

Release impact

Release tooling fix for v4.0.0. No runtime behavior or shared Ghostfolio helper changed. The failed rc.1 has no published image digest and cannot qualify. A new immutable RC includes this workflow fix. Reverting the workflow requires another RC; published candidates cannot be overwritten. PR #328 owns the implementation.

Verification

• Command: required PR CI, including native AMD64 and ARM64 container checks.
• Expected result: the checker imports its pinned dependencies and validates both images.
• Observed result: all required checks pass on 549905f. The rc.2 build also passed both native checks and publication: https://github.com/flowcool/ghostfolio-ibkr-sync/actions/runs/40698337401.
• bash -n scripts/check_container_runtime.sh and git diff --check pass.

AI assistance

Codex prepared the change. The author checked the exact rc.1 failure on both runners, dependency hashes, semantic diff, required CI and Pullfrog review.

Pullfrog review

Completed on final head 549905f. No issue or unresolved thread. Merged through pr-ship as 72fb74a.

Review evidence: #329 (review)

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: flowcool/ghostfolio-ibkr-sync
• Branch: fix/rc-native-runtime-check
• File: .coderabbit.yaml
• Commit: 549905f
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 85a39e6d-87bc-4558-88b3-4e7f36ff2538

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pullfrog]

✅ No new issues found.

Reviewed changes: the single workflow change in .github/workflows/release-image.yml.

• Install checker dependencies in native build jobs — adds pip install --require-hashes -r requirements.txt after setup-python, so scripts/check_container_runtime.sh can import release_image.py, which imports requests at top level. The step runs before the runtime check, and requirements.txt pins requests with hashes. It matches the install line already used in the preflight and other jobs of this workflow.

  ^{｜ View workflow run ｜ Using claude-sonnet-5-5 ｜ 𝕏}