fix: remove ARG TARGETARCH default in Dockerfile.test-tools#126
Merged
Conversation
`ARG TARGETARCH=amd64` (with a default) silently shadows BuildKit's per-platform auto-inject (moby/buildkit#3403). Consequence: every multi-arch build of this Dockerfile — including every `:vX.Y.Z` and `:latest` pushed to GHCR by release-test-tools.yaml since v0.9.10 — ran its `case` branch with TARGETARCH=amd64 *regardless of target platform*. The arm64 variant therefore shipped x86_64 shellcheck and hadolint binaries; downstream CI on arm64 runners fails at `shellcheck: Exec format error` the first time it consumes test-tools on arm64 (caught by ros1_bridge PR #27 enabling the arm64 matrix). Fix: drop the default. `ARG TARGETARCH` (bare declaration) lets BuildKit auto-inject take effect. Outside BuildKit, pass `--build-arg TARGETARCH=<arch>` explicitly — the `case` default branch already fails loud on empty TARGETARCH so nobody silently ships the wrong binaries. Regression test in template_spec.bats asserts the ARG has no default, plus the existing bare-declaration test continues to guarantee consumption is still wired. 674 → 675. Re-release plan: tag v0.10.0-rc2 after merge. release-test-tools.yaml re-runs on tag push and reissues ghcr.io/.../test-tools:v0.10.0-rc2 + :latest with correct per-arch binaries. Downstream repos on the broken v0.9.13 / v0.10.0-rc1 tags stay broken on arm64 until they bump @tag.
This was referenced Apr 24, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Critical latent bug shipped since multi-arch matrix landed (v0.9.10+). The arm64 variant of every GHCR
test-tools:*image contains x86_64 shellcheck / hadolint binaries, silently breaking downstream arm64 CI at first consumption.Root cause
Dockerfile.test-toolsdeclaresARG TARGETARCH=amd64with a default. Per moby/buildkit#3403, a default value shadows BuildKit's per-platform auto-inject. Result: multi-arch builds of this file run thecase "${TARGETARCH}" in ...branch withTARGETARCH=amd64regardless of the actual build platform → x86_64 binary URL used for both amd64 and arm64 manifests.Confirmation
Anonymous pull of
ghcr.io/ycpss91255-docker/test-tools:v0.9.13arm64 variant:ros1_bridge PR #27 enabled arm64 matrix and hit:
Fix
Regression test in
template_spec.batsasserts the ARG has no default (^ARG TARGETARCH=must not match) while the bare declaration (^ARG TARGETARCH$) still does. 674 → 675.Release plan (post-merge)
release-test-tools.yamlauto-reissuesghcr.io/.../test-tools:v0.10.0-rc2+:latestwith per-arch-correct binaries.main.yaml@v0.9.13→@v0.10.0-rc2, arm64 matrix goes green.Impact on existing tags
v0.9.13,v0.10.0-rc1GHCR images stay broken on arm64. Repos currently pinned to those tags that only build amd64 are unaffected. Repos with arm64 matrix enabled must move to@v0.10.0-rc2+— or the template bumps its minimum supported tag if we want to deprecate the broken ones.Test plan
make -f Makefile.ci testlocal — 675/675 pass:v0.10.0-rc2, confirm shellcheck is aarch64: