From cd3b8b6a505232ff75b438623672d3209e995dce Mon Sep 17 00:00:00 2001 From: pythonlearner1025 Date: Fri, 28 Aug 2026 05:43:17 +0000 Subject: [PATCH] ci: pin the first golden snapshot that is a whole build 425047509 was a partial build. Its bake died at `sshd -t` and never reached lever 2, the root-password fix, the identity strip or the marker, so every workspace on it carries the builder's /etc/machine-id and refuses a host SSH login. See #101. 425198627 is baked from the repaired script and verified after the fact: root password never expires and a key login works with no workaround, the marker names the box image, `docker image inspect` passes, sshd owns 2222 with ssh.socket masked, /etc/machine-id is freshly generated, and snapd, unattended-upgrades and apt-daily are all disabled. 2.40 GB, x86. The 41.3 s and 40.1 s in the comment above were measured on the partial build, which carried the box image but none of lever 2. They stay as written because they are a floor for this image, not a measurement of it. Both deployments share one Hetzner project, so one id serves both. Prod picks it up on its next v* tag. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01J6fUBY1B27EzvDwbhfBf52 --- .github/workflows/canary.yml | 7 ++++++- .github/workflows/release.yml | 7 ++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml index 4d45fd26..e6df5993 100644 --- a/.github/workflows/canary.yml +++ b/.github/workflows/canary.yml @@ -130,7 +130,12 @@ jobs: # Inert while the policy above is byok-required, because a snapshot # cannot cross into an org's own project. It goes live for subscribed # orgs under plans/SUBSCRIPTION-COMPUTE.md. - BLITZ_DEPLOY_VAR_HETZNER_SERVER_IMAGES: '*=425047509' + # + # Snapshot 425198627, baked 2026-08-28 by the repaired bake (#101). + # The timings above were measured on 425047509, which was a partial + # build: it carried the box image but not lever 2, so those numbers + # are a floor for this image rather than a measurement of it. + BLITZ_DEPLOY_VAR_HETZNER_SERVER_IMAGES: '*=425198627' # The billing service's origin, once it has one. Empty is skipped, so # this line changes nothing until the value is set, and setting it # then needs no commit. It is an environment secret rather than an diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 972437cb..32d370ea 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -172,7 +172,12 @@ jobs: # Rebake with `npm run golden:bake -- --location hel1` and update # BOTH workflows. An id that no longer resolves is not an outage: the # adapter warns and falls back to stock Ubuntu. - BLITZ_DEPLOY_VAR_HETZNER_SERVER_IMAGES: '*=425047509' + # + # Snapshot 425198627, baked 2026-08-28 by the repaired bake (#101). + # The timings above were measured on 425047509, which was a partial + # build: it carried the box image but not lever 2, so those numbers + # are a floor for this image rather than a measurement of it. + BLITZ_DEPLOY_VAR_HETZNER_SERVER_IMAGES: '*=425198627' # The billing service's origin, once it has one. Empty is skipped, so # this line changes nothing until the value is set, and setting it # then needs no commit. It is an environment secret rather than an