From 59175c491194045eceef7733527957151204ba05 Mon Sep 17 00:00:00 2001 From: sebasnallar Date: Mon, 7 Sep 2026 10:04:16 -0300 Subject: [PATCH 1/3] =?UTF-8?q?fix(publish):=20pin=20GH=5FREPO=20in=20fina?= =?UTF-8?q?lize-release=20=E2=80=94=20no=20checkout,=20gh=20can't=20infer?= =?UTF-8?q?=20the=20repo?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The finalize job never checks out, so gh release create/edit died with 'not a git repository' on the first run where it actually executed (v1.16.1 backfill — builds and registrations all green). GH_REPO makes gh target the repo explicitly. The v1.16.1 release was created manually with that run's digests; the guard keeps re-runs idempotent. Co-Authored-By: Claude Fable 5 --- .github/workflows/publish-images.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/publish-images.yml b/.github/workflows/publish-images.yml index d42dd683..f58c2251 100644 --- a/.github/workflows/publish-images.yml +++ b/.github/workflows/publish-images.yml @@ -153,6 +153,9 @@ jobs: runs-on: ubuntu-24.04 env: GH_TOKEN: ${{ github.token }} + # No checkout in this job: gh infers the repo from git otherwise and dies + # with "not a git repository" — GH_REPO pins it explicitly. + GH_REPO: ${{ github.repository }} TAG: ${{ inputs.existing_tag || github.ref_name }} REGISTRY: public.ecr.aws/nullplatform DIGEST_CONTAINERS: ${{ needs.containers.outputs.image_digest }} From ac2b818598f9530af25847cc243920b96a90c6b6 Mon Sep 17 00:00:00 2001 From: Agustin Celentano <12614595+agustincelentano@users.noreply.github.com> Date: Mon, 7 Sep 2026 11:25:02 -0300 Subject: [PATCH 2/3] fix(scheduled-task): run the image as the k8s scope with the overlay and ship aws-cli The image baked NP_SERVICE_PATH=/app/pkg/scheduled_task with no NP_OVERRIDES_PATH, so the worker ran the overlay's partial workflows (two skipped steps) as the whole scope. Point the base at k8s and pass the overlay as NP_OVERRIDES_PATH, like the legacy channel and containers-datadog do. Add aws-cli: the k8s scripts call it from the assume_role step onwards. --- docker/scheduled-task.Dockerfile | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/docker/scheduled-task.Dockerfile b/docker/scheduled-task.Dockerfile index 1ece0e96..f4f994be 100644 --- a/docker/scheduled-task.Dockerfile +++ b/docker/scheduled-task.Dockerfile @@ -4,7 +4,10 @@ # its steps only reach for kubectl + gomplate (bash/jq/np ship in the base). FROM public.ecr.aws/nullplatform/scopes/worker-bridge:1.0.0 -RUN apk add --no-cache gomplate +# aws-cli: the k8s scope scripts this overlay runs on top of call `aws` (sts +# assume-role first of all, then IAM and ECR); without it every action fails at +# the assume_role step on AWS installs. +RUN apk add --no-cache aws-cli gomplate ARG TARGETARCH ARG KUBECTL_VERSION=1.30.4 @@ -13,6 +16,11 @@ RUN curl -fsSL -o /usr/local/bin/kubectl "https://dl.k8s.io/release/v${KUBECTL_V && kubectl version --client COPY . /app/pkg +# The scheduled task is the k8s scope run with the scheduled_task overlay (see +# scheduled_task/specs/notification-channel.json.tpl: --service-path=k8s +# --overrides-path=scheduled_task), so the base stays k8s and the overlay goes +# in NP_OVERRIDES_PATH, like containers-datadog does. ENV NP_PACKAGE_NAME=scheduled-task \ - NP_SERVICE_PATH=/app/pkg/scheduled_task \ + NP_SERVICE_PATH=/app/pkg/k8s \ + NP_OVERRIDES_PATH=/app/pkg/scheduled_task \ NP_SCOPE_ENTRYPOINT=/app/pkg/entrypoint From 21be4582aca992c0b2586afd7b9e6f6eb4e3ab7f Mon Sep 17 00:00:00 2001 From: Agustin Celentano <12614595+agustincelentano@users.noreply.github.com> Date: Tue, 8 Sep 2026 09:27:52 -0300 Subject: [PATCH 3/3] ci(publish-images): register the release tag on every scope image artifact The three np artifact create steps passed only the digest, so the global artifacts for containers, scheduled-task and containers-datadog carry no tag and cannot be resolved with `lookup = true` + meta.tag, unlike the images published through release-publish-oci. Pass the release tag too. --- .github/workflows/publish-images.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish-images.yml b/.github/workflows/publish-images.yml index f58c2251..626d0b26 100644 --- a/.github/workflows/publish-images.yml +++ b/.github/workflows/publish-images.yml @@ -1,7 +1,9 @@ name: publish-images # Publishes every scope's worker image to ECR Public on each semver tag, then -# registers each as an oci_image platform artifact (visible-to organization=*). +# registers each as an oci_image platform artifact (visible-to organization=*) +# carrying both the digest and the release tag, so packages can resolve it by +# tag (`lookup = true` + meta.tag) instead of copying a digest around. # Same mold as scopes-lambda (publish-image.yml), fanned out to the 3 images: # # scopes/containers <- k8s/ (base; FROM worker-bridge + tooling) @@ -71,6 +73,7 @@ jobs: --registry public.ecr.aws \ --repository nullplatform/scopes/containers \ --digest "${{ needs.containers.outputs.image_digest }}" \ + --tag "${{ inputs.existing_tag || github.ref_name }}" \ --visible-to "organization=*" # ── scheduled-task (standalone) ──────────────────────────────────────────── @@ -104,6 +107,7 @@ jobs: --registry public.ecr.aws \ --repository nullplatform/scopes/scheduled-task \ --digest "${{ needs.scheduled-task.outputs.image_digest }}" \ + --tag "${{ inputs.existing_tag || github.ref_name }}" \ --visible-to "organization=*" # ── containers-datadog (overlay) ─────────────────────────────────────────── @@ -139,6 +143,7 @@ jobs: --registry public.ecr.aws \ --repository nullplatform/scopes/containers-datadog \ --digest "${{ needs.containers-datadog.outputs.image_digest }}" \ + --tag "${{ inputs.existing_tag || github.ref_name }}" \ --visible-to "organization=*" # ── GitHub release with artifact metadata ──────────────────────────────────