webgrip/infrastructure
5
0
Fork 0
Code Issues 1 Pull requests 2 Projects Releases 102 Packages Wiki Activity Actions

chore(images): repoint OCI provenance labels at Forgejo (batch 1/5) #75

Open
ryangr0 wants to merge 2 commits from chore/oci-labels-batch1 into main
pull from: chore/oci-labels-batch1
merge into: webgrip:main
Conversation 0 Commits 2 Files changed 3 +9 -9
ryangr0 commented 2026-07-31 16:55:20 +00:00
Owner
Copy link

Replaces the label portion of the closed #70.

org.opencontainers.image.{source,url,documentation} are baked into every published image and still point at github.com, which stopped being the source of truth when the platform moved to Forgejo. Anyone inspecting one of these images is sent to a mirror.

Three images only: node-ci-runner, vikunja-mcp, act-runner. Pure label change — 3 lines per file, verified: 9 insertions, 9 deletions, all image.source / image.url / image.documentation.

Why this is batched

on_source_change builds one matrix entry per changed ops/docker/ dir, and Forgejo ignores strategy.max-parallel — the setting is present in the workflow and does nothing. So the original #70, touching all 17 Dockerfiles, would have fanned out 17 concurrent builds onto fringe-workstation: the node co-locating Harbor, its Postgres, the Envoy data plane and the dind DaemonSet on 8 threads, and the documented cause of the "Harbor outages" in runs 136/137/158.

These three are the lowest-stakes to go first — small alpine images, short Dockerfiles, and nothing builds FROM them. If the batching approach is wrong, it is wrong here rather than on the release toolchain.

Remaining batches

Ordered by blast radius and rebuild cost. The LABEL's position in the Dockerfile decides the cost: near the end means the buildx registry cache covers everything before it and the rebuild is cheap; near the top invalidates the whole image.

Batch Images Note
2 mkdocs-runner, techdocs-runner, techdocs-builder techdocs chain
3 semantic-release{,-monorepo,-rust}, rust-releaser release toolchain
4 agent-runner, php-ci-runner, playwright-runner playwright is large but cache-friendly
5 rust-ci-runner → tauri-ci-runner; ci-runner and helm-deploy SOLO tauri builds FROM rust-ci-runner; ci-runner and helm-deploy are the only two images whose LABEL sits near the top, so they are the only two that get a full rebuild

Independent of #74 — no overlapping files.

Replaces the label portion of the closed #70. `org.opencontainers.image.{source,url,documentation}` are baked into every published image and still point at github.com, which stopped being the source of truth when the platform moved to Forgejo. Anyone inspecting one of these images is sent to a mirror. **Three images only: `node-ci-runner`, `vikunja-mcp`, `act-runner`.** Pure label change — 3 lines per file, verified: 9 insertions, 9 deletions, all `image.source` / `image.url` / `image.documentation`. ## Why this is batched `on_source_change` builds one matrix entry per changed `ops/docker/` dir, and **Forgejo ignores `strategy.max-parallel`** — the setting is present in the workflow and does nothing. So the original #70, touching all 17 Dockerfiles, would have fanned out 17 concurrent builds onto `fringe-workstation`: the node co-locating Harbor, its Postgres, the Envoy data plane and the dind DaemonSet on 8 threads, and the documented cause of the "Harbor outages" in runs 136/137/158. These three are the lowest-stakes to go first — small alpine images, short Dockerfiles, and nothing builds `FROM` them. If the batching approach is wrong, it is wrong here rather than on the release toolchain. ## Remaining batches Ordered by blast radius and rebuild cost. The `LABEL`'s **position in the Dockerfile** decides the cost: near the end means the buildx registry cache covers everything before it and the rebuild is cheap; near the top invalidates the whole image. | Batch | Images | Note | | --- | --- | --- | | 2 | mkdocs-runner, techdocs-runner, techdocs-builder | techdocs chain | | 3 | semantic-release{,-monorepo,-rust}, rust-releaser | release toolchain | | 4 | agent-runner, php-ci-runner, playwright-runner | playwright is large but cache-friendly | | 5 | rust-ci-runner → tauri-ci-runner; **ci-runner and helm-deploy SOLO** | tauri builds `FROM` rust-ci-runner; ci-runner and helm-deploy are the **only two** images whose LABEL sits near the top, so they are the only two that get a full rebuild | Independent of #74 — no overlapping files.
chore(images): repoint OCI provenance labels at Forgejo (batch 1/5)
Some checks failed
[Workflow] On Source Change / Guard: per-image .releaserc.cjs present (push) Successful in 27s
Details
[Workflow] On Source Change / Determine Changed Directories (push) Successful in 56s
Details
[Workflow] On Source Change / Determine changed images (push) Has been cancelled
Details
726ce58723 
org.opencontainers.image.{source,url,documentation} are baked into every
published image and still pointed at github.com, which stopped being the source
of truth when the platform moved to Forgejo. A consumer inspecting one of these
images was sent to a mirror.

Batch 1 of 5. Split deliberately: on_source_change builds one matrix entry per
changed ops/docker/ dir, and Forgejo IGNORES strategy.max-parallel (the setting is
present and does nothing), so a single PR touching all 17 images produces 17
concurrent builds on fringe-workstation — the node co-locating Harbor, its
Postgres, the Envoy data plane and the dind DaemonSet on 8 threads, and the
documented cause of the "Harbor outages" in runs 136/137/158.

These three first because they are the lowest-stakes: small alpine-based images,
short Dockerfiles, and nothing else builds FROM them. If the batching approach is
wrong, it is wrong here rather than on the release toolchain.

Remaining batches, ordered by blast radius and rebuild cost (the LABEL's position
decides the latter — near the end of the file means the registry cache covers
everything before it):

  2. mkdocs-runner, techdocs-runner, techdocs-builder   (techdocs chain)
  3. semantic-release{,-monorepo,-rust}, rust-releaser  (release toolchain)
  4. agent-runner, php-ci-runner, playwright-runner     (cheap; playwright is
                                                         large but cache-friendly)
  5. rust-ci-runner then tauri-ci-runner, and ci-runner + helm-deploy SOLO —
     tauri builds FROM rust-ci-runner, and ci-runner/helm-deploy are the only two
     images whose LABEL sits near the TOP of the Dockerfile, so they are the only
     two that cannot use the cache and get a full rebuild.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Merge branch 'main' into chore/oci-labels-batch1
Some checks failed
[Workflow] On Source Change / Guard: per-image .releaserc.cjs present (push) Successful in 8s
Details
[Workflow] On Source Change / Determine Changed Directories (push) Successful in 1m56s
Details
[Workflow] On Source Change / Determine changed images (push) Successful in 0s
Details
[Workflow] On Source Change / Release (cve-gate, ops/docker/cve-gate) (push) Has been skipped
Details
[Workflow] On Source Change / Release (ci-runner, ops/docker/ci-runner) (push) Has been skipped
Details
[Workflow] On Source Change / Build check (ci-runner, ops/docker/ci-runner) (push) Successful in 2m27s
Details
[Workflow] On Source Change / Build check (cve-gate, ops/docker/cve-gate) (push) Failing after 5m31s
Details
745ab0e150
Some checks failed
[Workflow] On Source Change / Guard: per-image .releaserc.cjs present (push) Successful in 8s
Details
[Workflow] On Source Change / Determine Changed Directories (push) Successful in 1m56s
Details
[Workflow] On Source Change / Determine changed images (push) Successful in 0s
Details
[Workflow] On Source Change / Release (cve-gate, ops/docker/cve-gate) (push) Has been skipped
Details
[Workflow] On Source Change / Release (ci-runner, ops/docker/ci-runner) (push) Has been skipped
Details
[Workflow] On Source Change / Build check (ci-runner, ops/docker/ci-runner) (push) Successful in 2m27s
Details
[Workflow] On Source Change / Build check (cve-gate, ops/docker/cve-gate) (push) Failing after 5m31s
Details
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin chore/oci-labels-batch1:chore/oci-labels-batch1
git switch chore/oci-labels-batch1

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff chore/oci-labels-batch1
git switch chore/oci-labels-batch1
git rebase main
git switch main
git merge --ff-only chore/oci-labels-batch1
git switch chore/oci-labels-batch1
git rebase main
git switch main
git merge --no-ff chore/oci-labels-batch1
git switch main
git merge --squash chore/oci-labels-batch1
git switch main
git merge --ff-only chore/oci-labels-batch1
git switch main
git merge chore/oci-labels-batch1
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
pull-request
Mirrored from GitHub Pull Request

  
released
No labels
pull-request
released
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
webgrip/infrastructure!75
No description provided.