From f2e322e5ae7314ee7513a28a3759ffea83649b2a Mon Sep 17 00:00:00 2001 From: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Date: Wed, 26 Aug 2026 21:15:58 -0300 Subject: [PATCH] fix(docker): decouple the best-effort Bun image from the release manifest MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The v3.8.50 Docker publish failed on both arches with: process "/bin/sh -c bun run --quiet build" ... cannot allocate memory Only Dockerfile.bun failed. The SUPPORTED images built fine — runner-base in 16m03 (amd64) / 14m13 (arm64), runner-web in 3m15 / 1m31 — yet none of them reached the registry, because one best-effort target sank the whole workflow. AGENTS.md is explicit that Bun is a compatibility path and NOT a supported runtime. Giving it the power to block the release inverts that: the runtime users actually run stayed unpublished so an experimental one could fail loudly. The Bun image is still built and still pushed on every run — it only stops being a release blocker: - both Bun build steps are `continue-on-error` - the digest files are only created when a digest actually exists - `create_manifest` takes an `optional` flag: an empty digest dir now warns and skips that tag instead of exiting 1. base/web stay hard-fail, so a real regression in a supported image still stops the publish. Applied to both the Docker Hub and GHCR manifest steps. One trap worth naming: the digest guard uses `if` blocks rather than `[ -n "$X" ] && touch ...`. Under `set -euo pipefail` a failing AND-list aborts the step — which is exactly the empty-digest case this is meant to handle, so the terse form would have swapped one blocker for another. --- .github/workflows/docker-publish.yml | 45 +++++++++++++++++++++++----- 1 file changed, 37 insertions(+), 8 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 3b04a20c8bb5..06b9c5411fb2 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -185,6 +185,13 @@ jobs: - name: Build and push BUN base platform image by digest id: build-bun-base + # Bun is a best-effort compatibility target, not a supported runtime + # (AGENTS.md -> Environment). Its `bun run build` has been OOM-killing on + # both arches; letting that sink the whole publish means the SUPPORTED + # runner-base / runner-web images never reach the registry either. The + # image is still built and pushed whenever it succeeds — only its power to + # block the release is removed. + continue-on-error: true uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 with: context: . @@ -203,6 +210,13 @@ jobs: - name: Build and push BUN web platform image by digest id: build-bun-web + # Bun is a best-effort compatibility target, not a supported runtime + # (AGENTS.md -> Environment). Its `bun run build` has been OOM-killing on + # both arches; letting that sink the whole publish means the SUPPORTED + # runner-base / runner-web images never reach the registry either. The + # image is still built and pushed whenever it succeeds — only its power to + # block the release is removed. + continue-on-error: true uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 with: context: . @@ -230,8 +244,15 @@ jobs: mkdir -p /tmp/digests/base /tmp/digests/web /tmp/digests/bun-base /tmp/digests/bun-web touch "/tmp/digests/base/${DIGEST_BASE#sha256:}" touch "/tmp/digests/web/${DIGEST_WEB#sha256:}" - touch "/tmp/digests/bun-base/${DIGEST_BUN_BASE#sha256:}" - touch "/tmp/digests/bun-web/${DIGEST_BUN_WEB#sha256:}" + # Empty when the (non-blocking) bun build produced no image. `if` blocks, + # not `[ -n ] && touch`: under `set -e` a failing AND-list aborts the step, + # which is precisely the case being handled here. + if [ -n "$DIGEST_BUN_BASE" ]; then + touch "/tmp/digests/bun-base/${DIGEST_BUN_BASE#sha256:}" + fi + if [ -n "$DIGEST_BUN_WEB" ]; then + touch "/tmp/digests/bun-web/${DIGEST_BUN_WEB#sha256:}" + fi - name: Upload base digests uses: actions/upload-artifact@v7 @@ -338,7 +359,7 @@ jobs: set -euo pipefail create_manifest() { - local image="$1" suffix="$2" dir="$3" + local image="$1" suffix="$2" dir="$3" optional="${4:-}" local tags=(-t "${image}:${VERSION}${suffix}") if [ "$PROMOTE_LATEST" = "true" ]; then tags+=(-t "${image}:latest${suffix}") @@ -348,6 +369,10 @@ jobs: refs+=("${image}@sha256:$(basename "$digest_file")") done < <(find "$dir" -type f | sort) if [ "${#refs[@]}" -eq 0 ]; then + if [ -n "$optional" ]; then + echo "::warning::No image digests in $dir — skipping optional tag ${image}:${VERSION}${suffix}" >&2 + return 0 + fi echo "No image digests in $dir" >&2 exit 1 fi @@ -356,15 +381,15 @@ jobs: create_manifest "${IMAGE_NAME}" "" /tmp/digests/base create_manifest "${IMAGE_NAME}" "-web" /tmp/digests/web - create_manifest "${IMAGE_NAME}" "-bun" /tmp/digests/bun-base - create_manifest "${IMAGE_NAME}" "-web-bun" /tmp/digests/bun-web + create_manifest "${IMAGE_NAME}" "-bun" /tmp/digests/bun-base optional + create_manifest "${IMAGE_NAME}" "-web-bun" /tmp/digests/bun-web optional - name: Create GHCR manifest run: | set -euo pipefail create_manifest() { - local image="$1" suffix="$2" dir="$3" + local image="$1" suffix="$2" dir="$3" optional="${4:-}" local tags=(-t "${image}:${VERSION}${suffix}") if [ "$PROMOTE_LATEST" = "true" ]; then tags+=(-t "${image}:latest${suffix}") @@ -374,6 +399,10 @@ jobs: refs+=("${image}@sha256:$(basename "$digest_file")") done < <(find "$dir" -type f | sort) if [ "${#refs[@]}" -eq 0 ]; then + if [ -n "$optional" ]; then + echo "::warning::No image digests in $dir — skipping optional tag ${image}:${VERSION}${suffix}" >&2 + return 0 + fi echo "No image digests in $dir" >&2 exit 1 fi @@ -382,8 +411,8 @@ jobs: create_manifest "${GHCR_IMAGE_NAME}" "" /tmp/digests/base create_manifest "${GHCR_IMAGE_NAME}" "-web" /tmp/digests/web - create_manifest "${GHCR_IMAGE_NAME}" "-bun" /tmp/digests/bun-base - create_manifest "${GHCR_IMAGE_NAME}" "-web-bun" /tmp/digests/bun-web + create_manifest "${GHCR_IMAGE_NAME}" "-bun" /tmp/digests/bun-base optional + create_manifest "${GHCR_IMAGE_NAME}" "-web-bun" /tmp/digests/bun-web optional - name: Inspect image if: needs.prepare.outputs.version != 'main'