Repository navigation
fix(ci): restore native mise oci image uploads - #442
Merged
Merged
Conversation
Use the released single-PATCH upload fix for large GHCR layers. Keep the shared mise pins in sync so the image builder and its consumers use the same release. Use Docker Buildx to check the remote manifest digest before publishing the job output. Keep registry credentials in job-local state and attest the verified digest in a separate job. Add push-step tests for successful uploads and failures before digest output.
Charles Chiu (charliie-dev)
requested review from
a team
and
a balanced review from Copilot
October 7, 2026 17:19
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
實際 GHCR 認證、GitHub-hosted Linux runner 與 provenance 發布流程尚未完成端到端驗證。
0 open findings
What changed in this PR
此 PR 恢復使用 mise 原生 OCI 上傳，並以 Buildx 驗證遠端 digest。
Changes:
- mise pin 同步升級至
2026.10.4。 - 改用
mise oci push --image-dir，保留 digest 驗證。 - 新增推送流程回歸測試並更新文件。
| File | Description |
|---|---|
README.md |
更新映像推送與驗證說明 |
.github/workflows/self-release.yml |
同步 mise pin |
.github/workflows/mise-tools-image.yml |
恢復原生推送並改用 Buildx 驗證 |
.github/workflows/mise-task.yml |
同步 mise pin |
.github/workflows/auto-release.yml |
同步預設 mise pin |
.github/tests/test_mise_tools_image.py |
覆蓋推送、檢查及失敗路徑 |
🧠 Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mise oci push --image-dirto upload the built OCI layout.2026.10.4.The release includes jdx/mise#14017 (merge commit
bc5cf7797df3492d4b2ff29221fa86be088cc0fc). GitHub compare confirms that this commit is an ancestor ofv2026.10.4. The fix streams large blobs in one PATCH withoutContent-Range.This completes the native-upload path for the problem tracked in #431, whose workaround shipped in #432.
Closes #431
Validation
mise run allpasses with both the installed mise and the new2026.10.4binary. Trivy reports no supported config targets; OpenGrep retains its existing partial-scan warnings.actionlintpasses.python3 .github/tests/test_mise_tools_image.pypasses: native command arguments, isolated credential paths, digest agreement, digest mismatch, push failure, inspect failure, and invalid local digest.2026.10.3control sends two ranged PATCH requests and reproduces HTTP 416. The2026.10.4binary sends one range-free PATCH, completes the push, and passes the Buildx remote digest check.Verification limit
The manual GHCR image workflow and provenance attestation have not been dispatched for this branch. A live publishing run needs separate approval. The local fixture verifies the upload protocol and digest gate; it does not verify GHCR authentication or a GitHub-hosted Linux runner.