From 768456664f584caa9da7705f798060ec22fee8cf Mon Sep 17 00:00:00 2001 From: aarroyo Date: Tue, 1 Sep 2026 09:51:12 -0500 Subject: [PATCH] fix(agent-runtime): the OPA step fails at the command that fails, and says why MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The build still breaks in CI, and the reason I cannot yet name it is the defect this commit fixes: the step reports the wrong error, three commands late. CI shows `mv: can't rename '/tmp/opa': No such file or directory` and — this is the part that matters — **no output at all from curl or from node** in between, even with `-S`, which prints errors. Neither the download failing nor the `test -s` after it aborted the run. A `;` chain that should have stopped and did not turns every failure into the same misleading message. So the step is now an `&&` chain rather than `set -eu` with `;`. Any failure stops AT that command, with that command's own message. `set -x` traces each step, the pin and the URL are echoed, `test -n` refuses an empty version, and `ls -l` shows what was actually downloaded before anything is moved. This does NOT claim to fix the root cause. It cannot be reproduced here: the image builds clean locally on both arm64 and, with `--no-cache`, on linux/amd64 — the pin resolves to 1.19.0, curl fetches 60,526,763 bytes and `opa version` reports `Version: 1.19.0`. Whatever differs is in the runner, and until now the build was incapable of saying what. Now it will. Guessing at a cause I cannot observe would be the same mistake as shipping the first version with the image unverified. This makes the next CI run answer the question. Co-Authored-By: Claude Opus 5 Signed-off-by: aarroyo --- src/apps/agent-runtime-api/Dockerfile | 30 ++++++++++++++++++++------- 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/src/apps/agent-runtime-api/Dockerfile b/src/apps/agent-runtime-api/Dockerfile index 85c0c7fc..0c9e8213 100644 --- a/src/apps/agent-runtime-api/Dockerfile +++ b/src/apps/agent-runtime-api/Dockerfile @@ -43,14 +43,28 @@ COPY .harness ./.harness # un `mv` que no encontraba nada. `-f` convierte un HTTP de error en salida no nula, # `-L` sigue la redireccion, y el `test -s` asegura que lo descargado no esta vacio. ARG TARGETARCH -RUN apk add --no-cache curl && \ - set -eu; \ - OPA_VERSION="$(node --input-type=module -e "import { OPA_VERSION } from 'file:///repo/.harness/scripts/opa-runtime.mjs'; process.stdout.write(OPA_VERSION);")"; \ - curl -fsSL -o /tmp/opa "https://openpolicyagent.org/downloads/v${OPA_VERSION}/opa_linux_${TARGETARCH:-amd64}_static"; \ - test -s /tmp/opa; \ - chmod 0755 /tmp/opa; \ - mv /tmp/opa .harness/bin/opa; \ - .harness/bin/opa version | grep -q "Version: ${OPA_VERSION}" +# Encadenado con `&&`, NO con `set -eu` y `;`. La version anterior fallaba en CI con +# `mv: can't rename '/tmp/opa'` — tres ordenes despues de la causa y sin nombrarla — +# porque ni el fallo de la descarga ni el `test -s` posterior abortaban. Un `;` que +# deberia haber cortado y no corta convierte cualquier error en el error equivocado. +# Con `&&` la cadena se detiene EN el comando que falla y con SU mensaje. +# +# Cada paso ademas se anuncia, porque el log de CI no mostro salida alguna de `curl` +# ni de `node`: sin saber cual de los dos corrio, el fallo no era diagnosticable. +RUN set -x \ + && apk add --no-cache curl \ + && OPA_VERSION="$(node --input-type=module -e "import { OPA_VERSION } from 'file:///repo/.harness/scripts/opa-runtime.mjs'; process.stdout.write(OPA_VERSION);")" \ + && echo "OPA pin resuelto: '${OPA_VERSION}'" \ + && test -n "${OPA_VERSION}" \ + && OPA_URL="https://openpolicyagent.org/downloads/v${OPA_VERSION}/opa_linux_${TARGETARCH:-amd64}_static" \ + && echo "Descargando ${OPA_URL}" \ + && curl -fsS --retry 3 --retry-connrefused -L -o /tmp/opa "${OPA_URL}" \ + && ls -l /tmp/opa \ + && test -s /tmp/opa \ + && chmod 0755 /tmp/opa \ + && mv /tmp/opa .harness/bin/opa \ + && .harness/bin/opa version \ + && .harness/bin/opa version | grep -q "Version: ${OPA_VERSION}" RUN npm ci --legacy-peer-deps