fix: the agent image builds under Kaniko, and a release tag builds the server image #14

Merged

morten-olsen merged 6 commits from mc/d50e173f-a8c1-46a2-889f-e1c5b7e1bcc5 into main 2026-10-07 16:06:53 +02:00

Conversation 0 Commits 6 Files changed 6 +46 -29

paperclip commented 2026-10-07 16:06:02 +02:00

Contributor

• Copy link
• Copy Markdown

Summary

Two more failures found on the release tags v0.6.0 and v0.6.1 (pipeline 69), both fixed here.

1. Agent image: TARGETARCH is empty under Kaniko. With #12 in, image-agent publish got as far as the Dockerfile's kubectl step and died with curl: (22) ... 404 (URL /linux//kubectl). The Security review had flagged this risk. Fix: ARG TARGETARCH=amd64 (Docker's own value still overrides it); the earlier dpkg fallback is dropped.
2. Server image: no tag ever built it. Pipeline 69 ran only image-agent and release; ai/mission-control has no 0.6.0/0.6.1 tag, only latest and sha tags. image.yaml has depends_on: quality, and quality does not run on tags, so the workflow never started. Fix: the release build moves to .woodpecker/image-release.yaml (tag only, no depends_on, pushes :<version>, :latest, :<short sha>, advisory Trivy scan), and image.yaml and image-smoke.yaml no longer list tag events. A release commit is one main already built and smoke-tested. (This is my reading of the cause: the evidence is that the workflow did not start; I did not see Woodpecker say why.)

Evidence

• woodpecker-cli pipeline log show ai/mission-control 69 publish: the 404 on the kubectl step; pipeline ps 69: no image workflow; package API: no version tags.
• woodpecker-cli lint --strict .woodpecker valid (9 workflows); prettier clean. No build run here.

Merge danger

On merge, image.yaml on main no longer has tag events: no change for main pushes. Nothing publishes until a tag. A new release (v0.6.2) is needed to test.

Rollback

Revert the PR; the images already pushed are unaffected.

After rollout

Tag: image-release and image-agent both succeed; ai/mission-control:<version> and ai/mission-control-agent:<version> exist; read the Trivy output.

## Summary Two more failures found on the release tags v0.6.0 and v0.6.1 (pipeline 69), both fixed here. 1. **Agent image: `TARGETARCH` is empty under Kaniko.** With #12 in, `image-agent` `publish` got as far as the Dockerfile's kubectl step and died with `curl: (22) ... 404` (URL `/linux//kubectl`). The Security review had flagged this risk. Fix: `ARG TARGETARCH=amd64` (Docker's own value still overrides it); the earlier dpkg fallback is dropped. 2. **Server image: no tag ever built it.** Pipeline 69 ran only `image-agent` and `release`; `ai/mission-control` has no `0.6.0`/`0.6.1` tag, only `latest` and sha tags. `image.yaml` has `depends_on: quality`, and `quality` does not run on tags, so the workflow never started. Fix: the release build moves to `.woodpecker/image-release.yaml` (tag only, no `depends_on`, pushes `:<version>`, `:latest`, `:<short sha>`, advisory Trivy scan), and `image.yaml` and `image-smoke.yaml` no longer list tag events. A release commit is one main already built and smoke-tested. (This is my reading of the cause: the evidence is that the workflow did not start; I did not see Woodpecker say why.) ## Evidence - `woodpecker-cli pipeline log show ai/mission-control 69 publish`: the 404 on the kubectl step; `pipeline ps 69`: no `image` workflow; package API: no version tags. - `woodpecker-cli lint --strict .woodpecker` valid (9 workflows); prettier clean. No build run here. ## Merge danger On merge, `image.yaml` on main no longer has tag events: no change for main pushes. Nothing publishes until a tag. A new release (v0.6.2) is needed to test. ## Rollback Revert the PR; the images already pushed are unaffected. ## After rollout Tag: `image-release` and `image-agent` both succeed; `ai/mission-control:<version>` and `ai/mission-control-agent:<version>` exist; read the Trivy output.

paperclip added 6 commits 2026-10-07 16:06:02 +02:00

feat: a release tag also builds the agent image, both images are scanned and their base pinned ... c99f73a4d0

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix: quote the scan steps' image so an empty tag does not break the YAML of every pipeline ... e26b09be77

On a push the unquoted ${CI_COMMIT_TAG##v} expands to nothing and leaves 'agent:' as a mapping
key, so Woodpecker rejected the whole repo's config (pipelines 57-60 errored).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Merge remote-tracking branch 'origin/mc/d50e173f-a8c1-46a2-889f-e1c5b7e1bcc5' into mc/d50e173f-a8c1-46a2-889f-e1c5b7e1bcc5 6436e832cc

fix: the agent image build reads its Dockerfile from the context ... 188d020570

Kaniko failed on v0.6.0 with 'error resolving dockerfile path'. The Dockerfile is copied beside
the executable in dist/release, so the plugin's default Dockerfile path is the right one.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix: the agent image's TARGETARCH defaults to amd64 under Kaniko ... 6783639b30

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix: the server image gets its own release-tag workflow ... 006e5affb7

image.yaml waits for quality, which does not run on tags, so no tag ever built the server image.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

morten-olsen merged commit e2687c0eb4 into main 2026-10-07 16:06:53 +02:00

morten-olsen deleted branch mc/d50e173f-a8c1-46a2-889f-e1c5b7e1bcc5 2026-10-07 16:06:54 +02:00

morten-olsen referenced this pull request from a commit 2026-10-07 16:06:54 +02:00

fix: the agent image builds under Kaniko, and a release tag builds the server image (#14)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

ai/mission-control!14

No description provided.