sean/seanfarm
Watch
1
0
Fork
You've already forked seanfarm
 0
Code Issues Pull requests Projects Releases 386 Packages Wiki Activity

fix(node-snapshot-bake): pull hetzner-builder from the canonical registry #220

Merged
binjovi-bot merged 1 commit from fix/hetzner-builder-canonical-registry into trunk 2026-09-03 15:31:14 +00:00
Conversation 0 Commits 1 Files changed 2 +4 -4
sean commented 2026-09-03 13:19:48 +00:00
Owner
Copy link

The three cloud helpers in node-snapshot-bake pin codeberg.org/someara/hetzner-builder:v3, and Codeberg no longer serves it. zots sync answers manifest not foundfor both thev3` tag and its digest, so the snapshot bake cannot pull.

Cause: images/hetzner-builder/VERSION moved from 4 to 5 on 2026-08-15 in a bulk bump of ten image VERSIONs (builder-images 3fa57ed). Nothing updated the consumers, so seanfarm kept pinning v3 and sean/pipelines kept pinning v4. The pipelines pin broke every kernel release since seanfarm45 on 08-19; that half is fixed and released as v0.1.741. This is the same break on the GitOps snapshot wave.

registry.sean.farm/build/hetzner-builder carries the same lineage at v5. build/* sits outside both seanfarm-image-digest-pinned and the Kyverno cosign rule, which scope to registry.sean.farm/seanfarm/*, so no new admission surface.

tests/house-helper-images/run-all.sh is updated with it and still requires all three occurrences. bash tests/check.sh passes.

https://claude.ai/code/session_01MdSbMhzabSbpG8TtP9Ur3H

The three cloud helpers in `node-snapshot-bake` pin `codeberg.org/someara/hetzner-builder:v3`, and Codeberg no longer serves it. zot`s sync answers `manifest not found` for both the `v3` tag and its digest, so the snapshot bake cannot pull. Cause: `images/hetzner-builder/VERSION` moved from 4 to 5 on 2026-08-15 in a bulk bump of ten image VERSIONs (builder-images 3fa57ed). Nothing updated the consumers, so seanfarm kept pinning `v3` and sean/pipelines kept pinning `v4`. The pipelines pin broke every kernel release since seanfarm45 on 08-19; that half is fixed and released as v0.1.741. This is the same break on the GitOps snapshot wave. `registry.sean.farm/build/hetzner-builder` carries the same lineage at `v5`. `build/*` sits outside both `seanfarm-image-digest-pinned` and the Kyverno cosign rule, which scope to `registry.sean.farm/seanfarm/*`, so no new admission surface. `tests/house-helper-images/run-all.sh` is updated with it and still requires all three occurrences. `bash tests/check.sh` passes. https://claude.ai/code/session_01MdSbMhzabSbpG8TtP9Ur3H
fix(node-snapshot-bake): pull hetzner-builder from the canonical registry
All checks were successful
binjovi/ci Binjovi completed the frozen plan
Details
6e0e4ce35d
 
The three cloud helpers pinned codeberg.org/someara/hetzner-builder:v3,
and codeberg no longer serves it. zot's sync answers "manifest not
found" for both the v3 tag and its digest, so the bake cannot pull.

images/hetzner-builder/VERSION moved from 4 to 5 on 2026-08-15 in a bulk
bump of ten image VERSIONs. Nothing updated the consumers, so seanfarm
kept pinning v3 and sean/pipelines kept pinning v4. The pipelines pin
broke every kernel release; this one breaks the GitOps snapshot wave.

code.sean.farm is canonical. registry.sean.farm/build/hetzner-builder
carries the same lineage at v5, so pin that by digest, matching the fix
already released in sean/pipelines. build/* is outside the
seanfarm-image-digest-pinned policy and the Kyverno cosign rule, which
both scope to registry.sean.farm/seanfarm/*, so no new admission
surface.

Claude-Session: https://claude.ai/code/session_01MdSbMhzabSbpG8TtP9Ur3H
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/seanfarm!220
No description provided.