chore(release): promote develop to main — repair the agent-runtime image build - #673
Merged
Conversation
…silently writing nothing The build step I added in 73e5873 failed in CI, and it failed in the one way its own guard could not catch. `wget -qO /tmp/opa <url>` exits **0 without writing the file**. The OPA download URL redirects to another host, and the BusyBox wget that Alpine ships does not follow it — but it reports success anyway. `set -eu` had nothing to catch, so the run continued and died three commands later on `mv: can't rename '/tmp/opa': No such file or directory`, an error that names neither the cause nor the URL. `curl -fsSL` instead: `-f` turns an HTTP error into a non-zero exit, `-L` follows the redirect, and `test -s` refuses an empty file. The `opa version` assertion that was supposed to be the backstop now actually gets to run. Why this shipped: the original commit said in as many words that the image build was NOT verified, because no Docker daemon was available at the time — and the image build was exactly what broke. I checked the URL with `curl -IL`, which follows redirects, and did not consider that BusyBox would not. Verified this time by building it: the image builds, and inside it `.harness/bin/opa version` reports `Version: 1.19.0` from an ELF binary — Linux, not the Mach-O the repository carries. Note for whoever reads the pipeline: `Build & Push Services (GHCR)` does not gate a pull request here. It runs on push, so #669 and #670 both merged green with this broken. A build that only fails after the merge is a build that tells you late. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: aarroyo <beyondnet.peru@gmail.com>
…edirects fix(agent-runtime): the OPA download follows its redirect instead of silently writing nothing BusyBox wget exits 0 without writing the file when the download URL redirects to another host, so `set -eu` had nothing to catch and the run died three commands later on a `mv` that named neither the cause nor the URL. Verified by building the image: opa reports Version 1.19.0 from an ELF binary.
chore(release): realign develop with main after the #670 promotion Zero file changes; the single commit is the merge node GitHub created on main. Verified before merging that the three-way merge keeps develop's OPA fix (#672) and reintroduces no wget: main carries the broken Dockerfile but contributes no change to it relative to the common ancestor. The red GHCR check on this PR is TRUE about main, not stale — main still needs a promotion to receive the fix.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
📊 Bilingual Coverage ImpactPR Changes
Repository Coverage
✅ Good: All EN changes have ES counterparts. Generated by GitHub Actions |
This was referenced Sep 1, 2026
This was referenced Sep 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request Summary
Three commits, and one file actually changes:
src/apps/agent-runtime-api/Dockerfile.maincurrently cannot build the agent-runtime image. The OPA download step promoted in #670 usedwget -qO, and the BusyBox wget Alpine ships exits 0 without writing the file when the download URL redirects to another host.set -euhad nothing to catch, so the build carried on and died three commands later onmv: can't rename '/tmp/opa': No such file or directory— an error naming neither the cause nor the URL.#672 replaced it with
curl -fsSLplustest -s:-fturns an HTTP error into a non-zero exit,-Lfollows the redirect, and the guard refuses an empty file. Theopa versionassertion that was meant to be the backstop now actually runs.The other two commits are merge nodes — #672 into develop, and the #671 sync-back — and carry no file changes of their own.
Verified
The image was built locally before proposing the fix, which is what the original change could not do and is exactly where it broke: inside the image,
.harness/bin/opa versionreportsVersion: 1.19.0from an ELF binary — Linux, not the Mach-O the repository carries under.harness/bin.Before you submit
Signed-off-by.curlis already installed in the runner stage of this same Dockerfile.Linked ADRs / Issues
What the reviewer should know
This is the second promotion in a row where the image build was not what gated the merge.
Build & Push Services (GHCR)runs on push, not on pull requests, so #669 merged with 46 green checks and #670 with 78 while the image did not build. The break surfaced only afterwards, on the sync-back PR — andpublished-artifact-canary, which asks the same question about the published npm package, is not in the PR check set either.Two merges have now passed over a broken image build. Whether that stays out of branch protection is worth deciding on purpose rather than by omission.
🤖 Generated with Claude Code