Repository navigation
fix(ci): mirror runnable OCI images without unsupported referrers - #1012
Conversation
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
utafrali
left a comment
utafrali
left a comment
There was a problem hiding this comment.
The fix is correct and well-targeted: replacing Buildx (which aggressively re-discovers referrers) with a pinned regctl that can copy images with referrers disabled solves the documented 403 from Aliyun. The Python-based descriptor filtering is careful and the test coverage is good. The main practical concern is the hardcoded amd64 binary URL, which will break silently on ARM runners.
| - name: Install pinned registry copy tool | ||
| if: ${{ steps.mirror.outputs.enabled == 'true' }} | ||
| uses: docker/setup-buildx-action@v3 | ||
| run: | |
There was a problem hiding this comment.
The binary URL hardcodes regctl-linux-amd64. If this job ever runs on a non-amd64 runner (GitHub now offers arm64 hosted runners), this step will silently download the wrong binary and the SHA256 check will catch it too late, failing the entire job with a confusing checksum error.
Since the SHA256 is arch-specific anyway, the simplest fix is to add a comment making the amd64 assumption explicit and document it near the runs-on: key for this job:
# This step pins the amd64 binary; the job must run on an amd64 runner.or detect the arch dynamically with separate per-arch checksums.
| echo 'FAIL: inspection failure was swallowed' >&2; exit 1 | ||
| else [[ $? == "$expected" ]]; fi | ||
| else | ||
| if CREATE_EXIT="$expected" TARGET_EXISTS=false bash "$REPO_ROOT/scripts/mirror-runtime-images.sh" "$work/images" >"$work/output" 2>&1; then |
There was a problem hiding this comment.
The else [[ $? == "$expected" ]]; fi construct does not actually fail the test if the exit code is wrong. The [[ ]] expression returns false, but the test script has no set -e and nothing forces a failure. The assertion is effectively dead.
Change to:
else
actual=$?
[[ "$actual" == "$expected" ]] || { echo "FAIL: expected exit $expected, got $actual" >&2; exit 1; }
fiThis also applies to the identical pattern in the create branch a few lines below.
|
|
||
| - name: Set up Docker Buildx | ||
| - name: Install pinned registry copy tool | ||
| if: ${{ steps.mirror.outputs.enabled == 'true' }} |
There was a problem hiding this comment.
The curl call has no --max-time flag. A stalled connection (not a refused connection, which --retry would catch) will hang until GitHub's 6-hour job timeout. Add --max-time 60 to bound the download time.
| # Buildx also discovers and copies referrers even with explicit child sources. | ||
| # regctl can copy the original image blobs without adding those artifacts. | ||
| if [[ ${#source_refs[@]} -eq 1 && "${source_refs[0]}" == "$source" ]]; then | ||
| regctl image copy --referrers=false "$source" "${target_prefix}/${target}" |
There was a problem hiding this comment.
The --referrers=false flag is passed to regctl index create. This flag is well-documented for regctl image copy, but it is worth confirming the flag is also accepted by index create in v0.11.7. If it is silently ignored or unrecognized, multi-arch images would still have referrers propagated, reintroducing the 403. A quick regctl index create --help | grep referrer in the CI log would confirm it.
Summary
application/vnd.oci.empty.v1+json，返回403。regctl v0.11.7并校验 SHA256，显式关闭 referrers 复制；四应用镜像的 Buildx 构建不变。Validation
Risk
Notes