[PR #348] [MERGED] Handle transient OCI registry outages during digest validation #100

New issue

Closed

opened 2026-06-08 08:29:55 +00:00 by ryangr0 · 0 comments

ryangr0 commented

2026-06-08 08:29:55 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/webgrip/homelab-cluster/pull/348
Author: @Copilot
Created: 6/1/2026
Status: ✅ Merged
Merged: 6/1/2026
Merged by: @Ryangr0

Base: main ← Head: copilot/fix-validating-cluster-config

📝 Commits (2)

e2fad2c Initial plan
3cc26a5 fix: tolerate transient OCI registry outages in digest verification

📊 Changes

3 files changed (+62 additions, -9 deletions)

View changed files

📝 scripts/lib/oci.sh (+34 -5)
📝 scripts/update-oci-digests.sh (+14 -1)
📝 scripts/verify-oci-digests.sh (+14 -3)

📄 Description

The failing Validate rendered cluster config job was blocked by transient 502 responses from Quay while resolving Jetstack chart digests. This change keeps digest validation strict for real mismatches, while avoiding false CI failures when the upstream registry is temporarily unavailable.

Digest lookup hardening
- add retries around OCI manifest HEAD requests
- classify lookup failures as transient (5xx/network) vs permanent
Validation behavior
- treat transient registry failures as warnings and skip only that digest check
- continue failing on missing digests, permanent lookup failures, and actual digest mismatches
Update path behavior
- keep update-oci-digests.sh fail-fast
- surface whether a refresh failed due to a transient registry outage or a permanent resolution problem

if ! fetch_digest "$image" "$tag" >"$tmp_output"; then
  if [[ "${OCI_FETCH_DIGEST_ERROR_KIND:-}" == "transient" ]]; then
    echo "WARN ${file}: skipped digest verification for ${image}:${tag} because the registry returned a transient error"
    continue
  fi

  echo "FAIL ${file}: could not resolve registry digest for ${image}:${tag}"
  status=1
  continue
fi

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/webgrip/homelab-cluster/pull/348 **Author:** [@Copilot](https://github.com/apps/copilot-swe-agent) **Created:** 6/1/2026 **Status:** ✅ Merged **Merged:** 6/1/2026 **Merged by:** [@Ryangr0](https://github.com/Ryangr0) **Base:** `main` ← **Head:** `copilot/fix-validating-cluster-config` --- ### 📝 Commits (2) - [`e2fad2c`](https://github.com/webgrip/homelab-cluster/commit/e2fad2c43cd11efcc87c9b0bf1516609d46f11da) Initial plan - [`3cc26a5`](https://github.com/webgrip/homelab-cluster/commit/3cc26a5257ca08721cc124532bf8e34cec32f004) fix: tolerate transient OCI registry outages in digest verification ### 📊 Changes **3 files changed** (+62 additions, -9 deletions) <details> <summary>View changed files</summary> 📝 `scripts/lib/oci.sh` (+34 -5) 📝 `scripts/update-oci-digests.sh` (+14 -1) 📝 `scripts/verify-oci-digests.sh` (+14 -3) </details> ### 📄 Description The failing `Validate rendered cluster config` job was blocked by transient `502` responses from Quay while resolving Jetstack chart digests. This change keeps digest validation strict for real mismatches, while avoiding false CI failures when the upstream registry is temporarily unavailable. - **Digest lookup hardening** - add retries around OCI manifest `HEAD` requests - classify lookup failures as transient (`5xx`/network) vs permanent - **Validation behavior** - treat transient registry failures as warnings and skip only that digest check - continue failing on missing digests, permanent lookup failures, and actual digest mismatches - **Update path behavior** - keep `update-oci-digests.sh` fail-fast - surface whether a refresh failed due to a transient registry outage or a permanent resolution problem ```bash if ! fetch_digest "$image" "$tag" >"$tmp_output"; then if [[ "${OCI_FETCH_DIGEST_ERROR_KIND:-}" == "transient" ]]; then echo "WARN ${file}: skipped digest verification for ${image}:${tag} because the registry returned a transient error" continue fi echo "FAIL ${file}: could not resolve registry digest for ${image}:${tag}" status=1 continue fi ``` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

ryangr0

2026-06-08 08:29:55 +00:00