Skip to content

feat(base-images): immutable per-publish image tags #4607

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
myftija merged 3 commits into from
Aug 13, 2026
+15 −3
Merged

feat(base-images): immutable per-publish image tags #4607

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e1dcad4
feat(base-images): push an immutable snapshot-dated tag per publish
myftija Aug 13, 2026
8bcb764
fix(base-images): disambiguate the immutable tag with the commit
myftija Aug 13, 2026
ed9f3da
fix(base-images): include the snapshot time in the immutable tag
myftija Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 11 additions & 2 deletions .github/workflows/base-images.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ jobs:
build_packages: ${{ steps.config.outputs.build_packages }}
suite: ${{ steps.config.outputs.suite }}
snapshot: ${{ steps.config.outputs.snapshot }}
publish_id: ${{ steps.config.outputs.publish_id }}
source_date_epoch: ${{ steps.config.outputs.source_date_epoch }}
push: ${{ steps.config.outputs.push }}
steps:
Expand All @@ -52,6 +53,7 @@ jobs:
SNAPSHOT_INPUT: ${{ inputs.debian_snapshot }}
EVENT_NAME: ${{ github.event_name }}
REF: ${{ github.ref }}
SHA: ${{ github.sha }}
run: |
PACKAGES="$(jq -er '.packages' base-images/images.json)"
BUILD_PACKAGES="$(jq -er '.buildPackages' base-images/images.json)"
Expand Down Expand Up @@ -89,6 +91,7 @@ jobs:
echo "build_packages=$BUILD_PACKAGES"
echo "suite=$SUITE"
echo "snapshot=$SNAPSHOT"
echo "publish_id=${SNAPSHOT:0:8}-${SNAPSHOT:9:6}-${SHA:0:7}"
Comment thread
myftija marked this conversation as resolved.
echo "source_date_epoch=$EPOCH"
echo "push=$PUSH"
} >> "$GITHUB_OUTPUT"
Expand Down Expand Up @@ -164,7 +167,11 @@ jobs:
platforms: linux/amd64,linux/arm64
provenance: false
outputs: type=image,push=true,rewrite-timestamp=true
tags: triggerdotdev/${{ matrix.image.repo }}:${{ matrix.image.tag }}
# The dated tag is immutable and keeps every published digest
# tag-referenced forever; shipped CLI releases pin these digests
tags: |
triggerdotdev/${{ matrix.image.repo }}:${{ matrix.image.tag }}
triggerdotdev/${{ matrix.image.repo }}:${{ matrix.image.tag }}-${{ needs.setup.outputs.publish_id }}
build-args: |
BASE_IMAGE=${{ matrix.image.base }}
DEBIAN_SNAPSHOT=${{ needs.setup.outputs.snapshot }}
Expand All @@ -187,7 +194,9 @@ jobs:
platforms: linux/amd64,linux/arm64
provenance: false
outputs: type=image,push=true,rewrite-timestamp=true
tags: triggerdotdev/${{ matrix.image.repo }}:${{ matrix.image.tag }}-build
tags: |
triggerdotdev/${{ matrix.image.repo }}:${{ matrix.image.tag }}-build
triggerdotdev/${{ matrix.image.repo }}:${{ matrix.image.tag }}-build-${{ needs.setup.outputs.publish_id }}
build-args: |
BASE_IMAGE=${{ matrix.image.base }}
DEBIAN_SNAPSHOT=${{ needs.setup.outputs.snapshot }}
Expand Down
5 changes: 4 additions & 1 deletion base-images/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,10 @@ images derived from these behave like their upstream bases.
## Tags and pinning

Tags are mutable and rebuilt in place on demand; each rebuild picks up Debian
security updates published up to its snapshot date. The
security updates published up to its snapshot date. Every publish also pushes
an immutable per-publish tag (snapshot timestamp plus commit, e.g. `22-bookworm-20260812-000000-45444a7`) so previously
published digests stay tag-referenced; never delete these, since shipped CLI
releases pin their digests. The
runtime itself (the node or bun binaries from the upstream base) only moves
when the base digests in `images.json` are bumped. When bumping a base
digest, keep the snapshot at least as new as the upstream image's own archive
Expand Down
Loading