ci: use Harbor auth and an explicit source ref for the L2-fix image build - #8
ci: use Harbor auth and an explicit source ref for the L2-fix image build#8allyblockcast[bot] wants to merge 1 commit into
Conversation
…uild registry.blockcast.net has been Harbor since the 2026-05-17 zot cutover, but this workflow still logged in with the retired zot htpasswd pair (ci-cache / LOCAL_REGISTRY_PASSWORD), so every dispatch failed at login before reaching the build. Switch to the org-wide HARBOR_USERNAME / HARBOR_PASSWORD pair that Blockcast/onprem-k8s canary-local-registry-login.yaml exercises hourly against the same registry. Also replace the hard-pinned checkout ref fix/l2-responder-stale-vip-cleanup with a required source_ref input. The workflow file only exists on the default branch, so the dispatch ref cannot select the source; the old pin meant a dispatch aimed at any other branch silently built the prototype tree. Refs BLO-22722, BLO-8011.
|
@ally please review at head |
![allyblockcast[bot]](https://avatars.githubusercontent.com/u/57363972?s=60&v=4){kind=small}
There was a problem hiding this comment.
Ally — Consolidated PR Review
Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex.
Reviewed head: 3ef6413
Critical Issues (0)
Important Issues (1)
- [pr-review-toolkit, gstack/review, native-codex]
.github/workflows/build-l2fix.yaml:28—source_refhas a default despite the workflow’s stated requirement that callers select the source explicitly. A manual or API dispatch that omits the input will buildfeat/multicast-egw-cegp-downstream, recreating the silent wrong-tree behavior for any intended source other than that branch.- Remove
default: 'feat/multicast-egw-cegp-downstream'so every dispatch must provide the intended branch, tag, or immutable commit SHA.
- Remove
Suggestions (0)
Strengths
- The Harbor credential migration is scoped to secret references; no credential material is exposed.
- Recording the resolved commit makes successful image builds auditable.
- The successful image-build check demonstrates that the replacement Harbor credentials can push the target image.
Recommended Action
- Remove the
source_refdefault and dispatch with an explicit source ref. - Re-run the workflow to confirm the build receipt records the requested source and resolved commit.
Fixes the registry login failure that blocked the BLO-8011 image bake (failing run).
What was wrong
1. Retired registry credentials.
registry.blockcast.nethas been Harbor since the 2026-05-17 zot -> Harbor cutover. This workflow was last touched on 2026-05-06 (#1,a31d4986) — eleven days before that cutover — and still logs in with the zot-era htpasswd pairci-cache/LOCAL_REGISTRY_PASSWORD. That pair no longer authenticates, so every dispatch dies atLog in to registry.blockcast.netand skips the build.The registry itself is healthy.
Blockcast/onprem-k8s.github/workflows/canary-local-registry-login.yamllogs in to the same host hourly withHARBOR_USERNAME/HARBOR_PASSWORDand has been green all day (15:24Z run). This PR moves to that same org-wide pair, which ~25 workflows acrossmagma,trafficcontrol,pim-multicast-gatewayand others already use.2. Hard-pinned source branch. The checkout step pinned
ref: fix/l2-responder-stale-vip-cleanup. Because this workflow file exists only on the default branch, the dispatch ref selects the workflow, never the source — so a dispatch aimed at any other branch silently built the prototype tree instead. That is precisely the accident BLO-8011 warns against ("Build workflow runs againstfeat/multicast-egw-cegp-downstream, not the historical prototype branch by accident"). Replaced with a requiredsource_refinput, plus aRecord build sourcestep that prints the resolved commit so the built SHA is on the receipt.Verification
Dispatched from this branch against source SHA
9d3e97e21299d5796ccfa46e328b5a97ea4195f2(tip offeat/multicast-egw-cegp-downstream); run linked in the comments below.No credential values are read, written, or exposed by this change — only the secret names change.
Refs BLO-22722, BLO-8011.