docs(ci-testing): on-demand image tag race + explicit version bake#46
Conversation
A /retro session (2026-07-16) found a :profiling-<sha> image built on both main-push and tag-push; last-writer-wins made the baked git-ref nondeterministic (a release read ref=main). Separately, InstalledVersions::getPrettyVersion in a .git-less Docker build returned 1.0.0+no-version-set. Add Pattern 6: build the on-demand variant on tags/dispatch only, and bake the version explicitly (COMPOSER_ROOT_VERSION or a baked APP_BUILD_REF). Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds a new documentation section, 'Pattern 6,' to the CI testing guide, which outlines best practices for handling on-demand image tags and versioning in Docker builds to avoid common pitfalls like tag races and missing version metadata. The reviewer suggested adding a concrete Dockerfile example to the documentation to better illustrate the proposed solution for baking version information into images.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Gemini review on #46: make Trap B's baked-env solution concrete with the Dockerfile ARG/ENV lines instead of describing it abstractly. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
|
1 participant
Summary
Add "Pattern 6" to
ci-testing.md: publishing an on-demand variant image (:profiling-<sha>) that carries its own build provenance has two traps — a multi-trigger tag race, and no version in a.git-less build.Came from
/retrosession on 2026-07-16 (timetracker release/deploy work)./ui/admin/statusshowedBranch/Tag: mainandVersion: 1.0.0+no-version-setfor a tagged release.:profiling-<sha>was built by both themainpush and the tag push; last-writer-wins clobbered the baked git-ref. (B)Composer\InstalledVersions::getPrettyVersion(root)has no version in a.git-less Docker build.workflow_dispatchonly; bake the version via a build arg (COMPOSER_ROOT_VERSION) or a baked git-ref env (APP_BUILD_REF).Change
references/ci-testing.md: new "Pattern 6: On-demand image tags — build on ONE trigger, and bake the version explicitly".Test plan
scripts/verify-harness.sh— Level 3 COMPLETE, 0 errorsif:expression andCOMPOSER_ROOT_VERSIONrecipe verified against the real fix (fix(status): show the release version on the admin status page timetracker#645)