Skip to content

Merge beta into main (publish-images fix) - #241

Merged
sebasnallar merged 3 commits into
mainfrom
beta
Sep 4, 2026
Merged

sebasnallar merged 3 commits into
mainfrom
beta

Conversation

@sebasnallar

Copy link
Copy Markdown
Contributor

Promotes beta → main. Beta is ahead by exactly one change (#240) — the publish-images fix:

  • Image names corrected to scopes/scheduled_task and scopes/containers_datadog (underscores, matching the ECR repositories that actually exist). scopes/containers untouched.
  • workflow_dispatch with existing_tag for recovery/backfill, with the ref passthrough (via actions-nullplatform#100, merged) so a backfill builds the tag's commit, not the dispatch branch.
  • CLI install pinned to released 2.10.0.

Why main needs it

workflow_dispatch runs the workflow file at the dispatched ref. The dispatch from beta failed at OIDC AssumeRole — the role's trust policy doesn't include the refs/heads/beta subject (run 33891484370, every job dead before any docker command). With the fix on main we can dispatch from main, and if the trust policy rejects that subject too, cut v1.16.2 from main — the refs/tags/* subject is proven to work.

Recovery after merge

gh workflow run publish-images.yml --repo nullplatform/scopes --ref main -f existing_tag=v1.16.1

Fallback if AssumeRole rejects refs/heads/main: tag v1.16.2 from main.

🤖 Generated with Claude Code

sebasnallar and others added 3 commits September 3, 2026 18:53
v1.16.1 failed to publish scheduled-task and containers-datadog: the ECR
repositories don't exist, and the names were wrong anyway — the images
are scopes/scheduled_task and scopes/containers_datadog (underscores,
matching the source directories). Renames image_name, the artifact
registration repository and the release table for both.

Also adds a workflow_dispatch existing_tag input: a tag push runs the
workflow at the tagged commit, so a fix on main can never reach an
already-pushed tag without a dispatch path. CLI install moves from the
alpha-packages channel to the released 2.10.0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Passes ref: existing_tag to docker-build-push-ecr (via
actions-nullplatform#100) so a recovery dispatch builds the tagged
content, not the main head the dispatch ran from.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
fix(publish): underscore image names + existing_tag recovery dispatch
@sebasnallar sebasnallar changed the title fix(publish): underscore image names + existing_tag recovery dispatch Merge beta into main (publish-images fix) Sep 4, 2026
@sebasnallar
sebasnallar merged commit 6172ee5 into main Sep 4, 2026
8 of 10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants