(tooling-memory) branch main updated: image: build to check, never publish

[st...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

sstriker pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-memory.git


The following commit(s) were added to refs/heads/main by this push:
     new 0eacdb8  image: build to check, never publish
0eacdb8 is described below

commit 0eacdb809995ae07a9a4a97860f3ad85da105880
Author: Sander Striker <st...@apache.org>
AuthorDate: Mon Oct 19 23:20:45 2026 +0200

    image: build to check, never publish
    
    The workflow pushed the harness image to GHCR on every change to its
    inputs and weekly, which under the apache organisation publishes a build
    that is not a release. It now only builds, to show the Dockerfile still
    does; each machine builds its own with make image. The weekly rebuild
    goes, since without publishing it has nothing to hand on, and so does
    the packages permission. The daily pin check and its pull request stay.
    
    Co-Authored-By: Claude Opus 5.5 <no...@anthropic.com>
---
 .github/workflows/image.yml | 32 ++++++++++----------------------
 images/harness/README.md    |  4 ++--
 2 files changed, 12 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml
index 7b4703a..169c1d7 100644
--- a/.github/workflows/image.yml
+++ b/.github/workflows/image.yml
@@ -1,6 +1,6 @@
-# The harness image: built and published when its inputs change, and weekly regardless so
-# base-image and apt security updates are taken; pins are bumped by a daily check that
-# opens a pull request. Never on a run: `memory launch` uses the tag it is given.
+# The harness image: built when its inputs change, to show the Dockerfile still builds, and
+# never published; machines build their own with `make image`. Pins are bumped by a daily
+# check that opens a pull request. Never on a run: `memory launch` uses the tag it is given.
 name: image
 
 on:
@@ -8,20 +8,18 @@ on:
     branches: [main]
     paths: ["images/harness/**", "crates/**", "Cargo.*", ".github/workflows/image.yml"]
   schedule:
-    - cron: "17 4 * * 1"   # weekly rebuild, Monday 04:17 UTC: base image and apt updates
     - cron: "41 5 * * *"   # daily pin check
   workflow_dispatch:
 
 permissions:
   contents: write
-  packages: write
   pull-requests: write
 
 jobs:
   # Daily: bump the pins and open (or update) a pull request. CI runs on it like any PR
   # once a person approves the workflow run, since it is opened with the workflow token.
   bump:
-    if: github.event_name == 'schedule' && github.event.schedule == '41 5 * * *'
+    if: github.event_name == 'schedule'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -47,13 +45,13 @@ jobs:
           git push -f origin bot/harness-pins
           gh pr create --fill --base main --head bot/harness-pins \
             --title "image: bump harness pins" \
-            --body "$(printf 'Daily pin check.\n\n%s\n\nMerging builds and publishes the image.' "${{ steps.bump.outputs.changes }}")" \
+            --body "$(printf 'Daily pin check.\n\n%s' "${{ steps.bump.outputs.changes }}")" \
             || gh pr edit bot/harness-pins --body "$(printf 'Daily pin check.\n\n%s' "${{ steps.bump.outputs.changes }}")"
 
-  # On a change to the inputs, and weekly: build with the release binary and publish to
-  # GHCR, tagged by commit and as latest. The digest is what machines should run.
+  # On a change to the inputs: build with the release binary, to show the image still
+  # builds. Nothing is pushed.
   build:
-    if: github.event_name != 'schedule' || github.event.schedule == '17 4 * * 1'
+    if: github.event_name != 'schedule'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -63,15 +61,5 @@ jobs:
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - name: Build the memory binary
         run: cargo build --release --locked -p amem && cp target/release/amem images/harness/memory
-      - name: Log in to GHCR
-        run: echo "${{ github.token }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
-      - name: Build and publish
-        run: |
-          repo="ghcr.io/${{ github.repository }}/harness"
-          docker build --pull -t "$repo:${{ github.sha }}" -t "$repo:latest" images/harness
-          docker push "$repo:${{ github.sha }}"
-          docker push "$repo:latest"
-          docker inspect --format='{{index .RepoDigests 0}}' "$repo:latest" | tee images/harness/digest
-      - name: Summarise
-        run: |
-          { echo "## Harness image"; echo; echo '```'; cat images/harness/digest; echo '```'; } >> "$GITHUB_STEP_SUMMARY"
+      - name: Build the image
+        run: docker build --pull -t harness:${{ github.sha }} images/harness
diff --git a/images/harness/README.md b/images/harness/README.md
index 3f018dd..a01ab7b 100644
--- a/images/harness/README.md
+++ b/images/harness/README.md
@@ -17,9 +17,9 @@ those move, and on a clock for the one that moves silently:
 
 | When | What | Why |
 |---|---|---|
-| A pin changes | `.github/workflows/image.yml` builds with the release binary and publishes to GHCR, tagged by commit and as `latest`; the digest it prints is what machines should run | A new harness version is a deliberate, reviewed change |
+| A pin changes | `.github/workflows/image.yml` builds with the release binary to show the image still builds; nothing is published, so each machine builds its own with `make image` | A new harness version is a deliberate, reviewed change |
 | Daily, 05:41 UTC | `scripts/bump-harness-versions.sh` checks npm and nodejs.org for newer versions of the seven harnesses and the Node line, and opens or updates a pull request bumping the pins | Security releases of a harness land within a day; a person still merges |
-| Weekly, Monday 04:17 UTC | A rebuild with `--pull`, nothing else changed; Muse Code moves here too, since its launcher takes the version from Meta's release channel at build time and the daily pin check has no version to compare | `ubuntu:24.04` moves under its tag and apt has security updates; a weekly rebuild takes them without anyone bumping anything |
+| A machine wants the base image's and apt's updates | `make image` again, after pulling `ubuntu:24.04`; Muse Code moves here too, since its launcher takes the version from Meta's release channel at build time | `ubuntu:24.04` moves under its tag, and nothing is published for a machine to pull instead |
 | Urgent | Bump the pin by hand and merge | The daily check is the floor, not the ceiling |
 
 Locally, `make image` is for developing the launcher itself. The pull request the bot opens


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org