Fix CI: pin opencode install and repair fx/php builds on Ubuntu resolute base - #15
Open
f3l1x wants to merge 4 commits into
Open
Fix CI: pin opencode install and repair fx/php builds on Ubuntu resolute base#15f3l1x wants to merge 4 commits into
f3l1x wants to merge 4 commits into
Conversation
The curl installer fetches the latest version from the unauthenticated GitHub API, which is rate-limited on shared Actions runner IPs. Failures were swallowed by '|| true', leaving a dangling /usr/local/bin/opencode symlink and failing the 'opencode --version' test only after the build. Install the opencode-ai npm package instead (npm registry only, no GitHub API) and verify the binary during the build. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S9abShYK5RMmbeuZurGH3b
The codercom/enterprise-base:ubuntu image moved to Ubuntu resolute, which broke fx and php builds in two compounding ways: 1. ppa:ondrej/php publishes no release for resolute (404). PHP 8.5 and all needed extensions are now in the native Ubuntu archive, so drop the PPA (and software-properties-common, only needed for it). php8.5-imap is dropped: the imap extension was unbundled from PHP core in 8.4 and no package exists for resolute. 2. The failure was masked by an unparenthesized 'chown ... || true' near the end of the RUN chain: && and || have equal precedence, so that '|| true' rescued the failed apt-get update, skipped every install step in between, and produced a 'successful' image with no node/php inside. Ownership chowns are now plain commands (their targets always exist) and the claude chmod fallbacks are parenthesized, so a mid-chain failure fails the build. opencode is now installed with a pinned version (ENV OPENCODE_VERSION, matching the GLAB_VERSION convention) instead of 'latest': - deterministic: skips the unauthenticated api.github.com 'latest' lookup that gets rate-limited on shared Actions runners (the original nodejs failure) and downloads the release tarball directly - the binary stays in /home/coder/.opencode/bin owned by coder, so the coder user can still run 'opencode upgrade' (replaces the earlier npm-based approach, which put a root-owned binary in /usr/lib) - no '|| true': a failed install now fails the build, and 'opencode --version' verifies the binary at build time Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S9abShYK5RMmbeuZurGH3b
f3l1x
changed the title
Test (fx) and Test (golang) failed with 'Failed to resolve action download info: Service Unavailable' before any repo code ran. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S9abShYK5RMmbeuZurGH3b
Every installed tool now has an ENV *_VERSION pin: claude, deno, bun, composer, codex, copilot, pi, t3, pnpm, agent-browser (opencode, glab, go, node were already pinned). Conventions noted in CLAUDE.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S9abShYK5RMmbeuZurGH3b
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the flaky
opencodeinstallation that broke the nodejs smoke test, and repairs the fx/php builds that broke whencodercom/enterprise-base:ubuntumoved to Ubuntu resolute.Key Changes
opencode install hardened (all five images)
ENV OPENCODE_VERSION(same convention asGLAB_VERSION). This skips the installer's unauthenticatedapi.github.com/releases/latestlookup, which gets rate-limited on shared GitHub Actions runner IPs — the cause of the original nodejs failure./home/coder/.opencode/binowned bycoder, so the coder user can still runopencode upgradeinside a workspace.|| truearound the installer is gone andopencode --versionruns at build time, so a failed install now fails the build instead of producing a broken image.fx + php builds fixed for Ubuntu resolute
ppa:ondrej/phppublishes no release for resolute (404) and is being merged into packages.sury.org. PHP 8.5 and all required extensions are now installed from the native Ubuntu archive; the PPA andsoftware-properties-commonare removed.php8.5-imapis dropped: the imap extension was unbundled from PHP core in 8.4 and no package exists for resolute (neither in the archive nor the PPA).Silent-failure bug fixed (all five images)
The fx/php breakage went undetected at build time because of an unparenthesized
chown ... || truelate in theRUNchain: since&&and||bind with equal precedence, that|| truerescued the failedapt-get update, skipped every install step in between, and let the build "succeed" with an image missing node/php entirely. Ownershipchowns are now plain commands and the remaining intentional fallbacks are parenthesized, so any mid-chain failure fails the build.https://claude.ai/code/session_01S9abShYK5RMmbeuZurGH3b