Skip to content

Commit d4187d0

Browse files
DaedalusGDaedalusG
authored
fix: update v7.5.4453 Docker Compose image manifests (#1407)
## Summary - update both release-managed Docker Compose manifests to public Sourcegraph 7.5.4453 images - pin each image to its promoted digest - repair the `release-v7.5.4453` branch before moving tag `v7.5.4453` to the corrected branch head ## Impact The current `v7.5.4453` tag contains stale Docker Compose image references, including Sourcegraph 6.1 and PostgreSQL 6.0 images. Users checking out the 7.5.4453 tag therefore do not receive the images produced for the 7.5.4453 search release. ## What happened The Temporal `UpdateDockerImages` activity completed successfully and reported both expected files as updated. It created commit `d20cc5d6f1da12a6872fa968b9f927c18cc904c6` (`Update compose images to v7.5.4453`). That commit contains the expected internal image changes, but it is no longer reachable from the release branch. One second later, the workflow created the empty Buildkite configuration commit `7e757fd508c04ea857580b1438c7108602eaca2d`. Both commits have the same parent, `31be4b977b9b9c28f9ccc4a4a2a188a972ab0f54`, rather than the configuration commit having the image-update commit as its parent: ``` 31be4b ├── d20cc5d Update compose images to v7.5.4453 (orphaned) └── 7e757fd release: v7.5.4453 (branch head) ``` Our hypothesis is that the GitHub ref read performed by the configuration-commit activity briefly returned the old branch head after the image activity had updated it. The configuration commit was consequently created from the stale parent. The workflow then force-updated the branch ref, replacing the image commit instead of advancing from it. This matches the implementation: the generic commit input supports an explicit `ParentCommitSHA` to avoid GitHub eventual-consistency races, but the empty configuration-commit path fetches the branch head again and does not chain directly from the image activity result. The ref update is also forced, allowing a stale, non-fast-forward commit to silently replace the previous branch head. This would explain why prior releases worked: the race depends on whether the updated GitHub ref is visible before the immediately following activity reads it. The k8s workflow performs multiple commits and has more time between its first update and configuration commit. ## Follow-up After this PR merges, move tag `v7.5.4453` to the merged `release-v7.5.4453` branch head so checkouts of the tag receive these corrected manifests. The workflow should separately be hardened by explicitly chaining the configuration commit from the image-update commit and avoiding forced ref updates for normal sequential commits. ## Test plan - verified the PR changes only the two manifests processed by `UpdateDockerImages` - verified all Sourcegraph image references use tag `7.5.4453` and pinned public digests - verified the promoted digests against the k8s release manifests; verified the caddy digest directly against Docker Hub - ran `git diff --check`
1 parent 001b577 commit d4187d0

2 files changed

Lines changed: 28 additions & 28 deletions

File tree

‎docker-compose/db-only-migrate.docker-compose.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ services:
1313
#
1414
pgsql:
1515
container_name: pgsql
16-
image: 'index.docker.io/sourcegraph/postgresql-16:6.0.0@sha256:224a2604331cb73809f466394c5b4f3ca95bf6a5a140cb75820dfe67301074bb'
16+
image: 'index.docker.io/sourcegraph/postgresql-16:7.5.4453@sha256:c287f49fdf847eeffb25481e614454ade57aee4aafe2774d260aec070176fa78'
1717
cpus: 4
1818
mem_limit: '2g'
1919
healthcheck:
@@ -30,7 +30,7 @@ services:
3030

3131
codeintel-db:
3232
container_name: codeintel-db
33-
image: 'index.docker.io/sourcegraph/postgresql-16:6.0.0@sha256:224a2604331cb73809f466394c5b4f3ca95bf6a5a140cb75820dfe67301074bb'
33+
image: 'index.docker.io/sourcegraph/postgresql-16:7.5.4453@sha256:c287f49fdf847eeffb25481e614454ade57aee4aafe2774d260aec070176fa78'
3434
cpus: 4
3535
mem_limit: '2g'
3636
healthcheck:

‎docker-compose/docker-compose.yaml‎

Lines changed: 26 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ services:
1313
# for this container will need to be updated to reflect the new connection information.
1414
migrator:
1515
container_name: migrator
16-
image: 'index.docker.io/sourcegraph/migrator:6.1.2889@sha256:67b5b187f006bb789898cd1ab02fd82f860fe1511524a416ba63ee71ebd603c6'
16+
image: 'index.docker.io/sourcegraph/migrator:7.5.4453@sha256:8a0c3a3cb5f3b7a0e56a171b6ce05b7a149b8b91286394dc8cd4727a0da3999e'
1717
cpus: 0.5
1818
mem_limit: '500m'
1919
command: ['up']
@@ -69,7 +69,7 @@ services:
6969
# https://caddyserver.com/docs/caddyfile
7070
caddy:
7171
container_name: caddy
72-
image: 'index.docker.io/sourcegraph/caddy:6.1.2889@sha256:26443b2905169ec27efba3c090d9c04e0c0779d7fb4001cbdcbe32ec1598eb59'
72+
image: 'index.docker.io/sourcegraph/caddy:7.5.4453@sha256:311363c79a71cfb79922fc98301866ebb56e30d5ddb9f4bfca1ade1fbe3b4858'
7373
cpus: 4
7474
mem_limit: '4g'
7575
environment:
@@ -124,7 +124,7 @@ services:
124124
# service.
125125
sourcegraph-frontend-0:
126126
container_name: sourcegraph-frontend-0
127-
image: 'index.docker.io/sourcegraph/frontend:6.1.2889@sha256:43dad562a65d08842659abdd06cf3c92d3745cc9e18c3762e458b78028a86e1e'
127+
image: 'index.docker.io/sourcegraph/frontend:7.5.4453@sha256:f0628e99ffcd12db5dc54eed7e3b81f8f07b35b2dca93a0773aa4d48f06b11ed'
128128
cpus: 4
129129
mem_limit: '8g'
130130
environment:
@@ -177,7 +177,7 @@ services:
177177
#
178178
sourcegraph-frontend-internal:
179179
container_name: sourcegraph-frontend-internal
180-
image: 'index.docker.io/sourcegraph/frontend:6.1.2889@sha256:43dad562a65d08842659abdd06cf3c92d3745cc9e18c3762e458b78028a86e1e'
180+
image: 'index.docker.io/sourcegraph/frontend:7.5.4453@sha256:f0628e99ffcd12db5dc54eed7e3b81f8f07b35b2dca93a0773aa4d48f06b11ed'
181181
cpus: 4
182182
mem_limit: '8g'
183183
environment:
@@ -223,7 +223,7 @@ services:
223223
#
224224
gitserver-0:
225225
container_name: gitserver-0
226-
image: 'index.docker.io/sourcegraph/gitserver:6.1.2889@sha256:282142b7886f58b0ea7251575c92d5c837ff8649d5831c9c52745ebed6f3af4f'
226+
image: 'index.docker.io/sourcegraph/gitserver:7.5.4453@sha256:f2dbd482247d160cb2763f200eaa9931c04e0eb3ddf92b0c3c75bd55f79d019c'
227227
cpus: 4
228228
mem_limit: '8g'
229229
environment:
@@ -246,7 +246,7 @@ services:
246246
#
247247
zoekt-indexserver-0:
248248
container_name: zoekt-indexserver-0
249-
image: 'index.docker.io/sourcegraph/search-indexer:6.1.2889@sha256:8a79ecf88f4f22ff72c8a50f33a2d43506c44deddf6ef2e43d8101af9ccd97c0'
249+
image: 'index.docker.io/sourcegraph/search-indexer:7.5.4453@sha256:75a831098b20c25c28e1c4b265eeb85b71757f4d5d11a2627d6cf896902eeec5'
250250
cpus: 8
251251
mem_limit: '16g'
252252
environment:
@@ -269,7 +269,7 @@ services:
269269
#
270270
zoekt-webserver-0:
271271
container_name: zoekt-webserver-0
272-
image: 'index.docker.io/sourcegraph/indexed-searcher:6.1.2889@sha256:9bb181a003811fb0193c4fa594ded800f2f155752829f1c4f97a7bfa37dbe69e'
272+
image: 'index.docker.io/sourcegraph/indexed-searcher:7.5.4453@sha256:2cabbb14f98f84d9ef1c4a83201beea9c0d783737a4a388d4c5870582c05967e'
273273
cpus: 8
274274
mem_limit: '50g'
275275
environment:
@@ -296,7 +296,7 @@ services:
296296
#
297297
searcher-0:
298298
container_name: searcher-0
299-
image: 'index.docker.io/sourcegraph/searcher:6.1.2889@sha256:66f633e4e666d65684915087009bdbdb8a46dad6eccb4c307a6de141e0225be6'
299+
image: 'index.docker.io/sourcegraph/searcher:7.5.4453@sha256:dcdf9706101f5849ef24539896f9b3e60ca6a4ba906addf66b6ce299fac91ac7'
300300
cpus: 2
301301
mem_limit: '2g'
302302
environment:
@@ -320,7 +320,7 @@ services:
320320
#
321321
precise-code-intel-worker:
322322
container_name: precise-code-intel-worker
323-
image: 'index.docker.io/sourcegraph/precise-code-intel-worker:6.1.2889@sha256:2a8ec49e080ff19e6f05f92c39cfc67ac50b8e2ff5aba4dcbd7451bba1e8d539'
323+
image: 'index.docker.io/sourcegraph/precise-code-intel-worker:7.5.4453@sha256:443f2e6e3d0af65d8f3d2990ba88b386315fb9c9c59adc91baa64a55667873a0'
324324
cpus: 2
325325
mem_limit: '4g'
326326
environment:
@@ -346,7 +346,7 @@ services:
346346
#
347347
worker:
348348
container_name: worker
349-
image: 'index.docker.io/sourcegraph/worker:6.1.2889@sha256:1ef615670e315edda8511ab1e06ffd27b98129bc962bf06aca455c7731baf482'
349+
image: 'index.docker.io/sourcegraph/worker:7.5.4453@sha256:49a666bff68d107d1fdc03470fd144a9ceb8b9da0faa7a191dd0da530956f22c'
350350
cpus: 4
351351
mem_limit: '4g'
352352
environment:
@@ -371,7 +371,7 @@ services:
371371
#
372372
syntactic-code-intel-worker:
373373
container_name: syntactic-code-intel-worker
374-
image: 'index.docker.io/sourcegraph/syntactic-code-intel-worker:6.1.1295@sha256:c6e2b097b8f16394e339588e208c43587f1fa6a35cb44e9759622c448ddc1445'
374+
image: 'index.docker.io/sourcegraph/syntactic-code-intel-worker:7.5.4453@sha256:379ecf86e0488466ed2345a97d3dfaf1a9e10aa832942a74cda424ca9ed695eb'
375375
cpus: 2
376376
mem_limit: '4g'
377377
environment:
@@ -398,7 +398,7 @@ services:
398398
#
399399
syntect-server:
400400
container_name: syntect-server
401-
image: 'index.docker.io/sourcegraph/syntax-highlighter:6.1.2889@sha256:eea296267ca84c8d06eb9c1e44fd5f4c4fbb3f0490193517cc3764d558a773c6'
401+
image: 'index.docker.io/sourcegraph/syntax-highlighter:7.5.4453@sha256:b0a8cba42d5d629109b4591f6a4009ae887318b670603fedb65fee81d1b817f0'
402402
cpus: 4
403403
mem_limit: '6g'
404404
healthcheck:
@@ -419,7 +419,7 @@ services:
419419
#
420420
prometheus:
421421
container_name: prometheus
422-
image: 'index.docker.io/sourcegraph/prometheus:6.1.2889@sha256:75fa45933ecb03f7aca1d54ec5ebc05d11ff300494a2ca8fbaefa25c83f0326f'
422+
image: 'index.docker.io/sourcegraph/prometheus:7.5.4453@sha256:a3414f655ce25292e31219f695f9a2d740ee16c31aff8007c12a61c5c05340f6'
423423
cpus: 4
424424
mem_limit: '8g'
425425
volumes:
@@ -446,7 +446,7 @@ services:
446446
# 'GF_SERVER_ROOT_URL='https://grafana.example.com'
447447
grafana:
448448
container_name: grafana
449-
image: 'index.docker.io/sourcegraph/grafana:6.3.3@sha256:2f68b9b1542e7d75459d983b606d2fdd1c11a75610464e3d7a6ced4f3ac474bf'
449+
image: 'index.docker.io/sourcegraph/grafana:7.5.4453@sha256:df250d7ca343c836c6dc38b151a4c3fe6c7a4489c25e130e36c3708c6cce0c90'
450450
cpus: 1
451451
mem_limit: '1g'
452452
volumes:
@@ -465,7 +465,7 @@ services:
465465
#
466466
cadvisor:
467467
container_name: cadvisor
468-
image: 'index.docker.io/sourcegraph/cadvisor:6.1.2889@sha256:c13394cf2de03154dd48e78129bf3d4cc31854ab98dedafd3901b413d54b4822'
468+
image: 'index.docker.io/sourcegraph/cadvisor:7.5.4453@sha256:9d2652e3b05e371d30abd18fadb4450d480d70f95c7fdc064a73d4ab1dd787a9'
469469
cpus: 1
470470
mem_limit: '1g'
471471
# You may set `privileged` to `false and `cadvisor` will run with reduced privileges.
@@ -498,7 +498,7 @@ services:
498498
#
499499
node-exporter:
500500
container_name: node-exporter
501-
image: 'index.docker.io/sourcegraph/node-exporter:6.1.2889@sha256:e496aa37a1053cd59f0025c232fd58261ae08d934269870a343061c7a9596bfd'
501+
image: 'index.docker.io/sourcegraph/node-exporter:7.5.4453@sha256:ae1ad1a5008de94e418019badf4535d5d0b2e7950410074c66346f99bf27519d'
502502
cpus: .5
503503
mem_limit: '1g'
504504
pid: 'host'
@@ -527,7 +527,7 @@ services:
527527
#
528528
pgsql:
529529
container_name: pgsql
530-
image: 'index.docker.io/sourcegraph/postgresql-16:6.1.2889@sha256:8cb7b0f54c7ab464f8e3b26918a70bebcb060219dd0b91084209563238ec1dd5'
530+
image: 'index.docker.io/sourcegraph/postgresql-16:7.5.4453@sha256:c287f49fdf847eeffb25481e614454ade57aee4aafe2774d260aec070176fa78'
531531
cpus: 4
532532
mem_limit: '4g'
533533
shm_size: '1g'
@@ -555,7 +555,7 @@ services:
555555
# for this container will need to be updated to reflect the new connection information.
556556
pgsql-exporter:
557557
container_name: pgsql-exporter
558-
image: 'index.docker.io/sourcegraph/postgres_exporter:6.1.2889@sha256:a2fedb3d4aa845375d3c60f37e2813d095c6718c2afa96c2bcc8c17dc8b73991'
558+
image: 'index.docker.io/sourcegraph/postgres_exporter:7.5.4453@sha256:866af1c481b1facaddf1f06d317f10f25b82dd294e45e20df9fb1cb59bbdf272'
559559
cpus: 0.1
560560
mem_limit: '50m'
561561
networks:
@@ -574,7 +574,7 @@ services:
574574
#
575575
codeintel-db:
576576
container_name: codeintel-db
577-
image: 'index.docker.io/sourcegraph/postgresql-16:6.1.2889@sha256:8cb7b0f54c7ab464f8e3b26918a70bebcb060219dd0b91084209563238ec1dd5'
577+
image: 'index.docker.io/sourcegraph/postgresql-16:7.5.4453@sha256:c287f49fdf847eeffb25481e614454ade57aee4aafe2774d260aec070176fa78'
578578
cpus: 4
579579
mem_limit: '4g'
580580
shm_size: '1g'
@@ -602,7 +602,7 @@ services:
602602
# for this container will need to be updated to reflect the new connection information.
603603
codeintel-db-exporter:
604604
container_name: codeintel-db-exporter
605-
image: 'index.docker.io/sourcegraph/postgres_exporter:6.1.2889@sha256:a2fedb3d4aa845375d3c60f37e2813d095c6718c2afa96c2bcc8c17dc8b73991'
605+
image: 'index.docker.io/sourcegraph/postgres_exporter:7.5.4453@sha256:866af1c481b1facaddf1f06d317f10f25b82dd294e45e20df9fb1cb59bbdf272'
606606
cpus: 0.1
607607
mem_limit: '50m'
608608
networks:
@@ -621,7 +621,7 @@ services:
621621
#
622622
codeinsights-db:
623623
container_name: codeinsights-db
624-
image: 'index.docker.io/sourcegraph/postgresql-16-codeinsights:6.1.2889@sha256:7d84febae82181e096f79e26f6459e86fa66a40ccbe30ff0f37cb118707e4e2a'
624+
image: 'index.docker.io/sourcegraph/postgresql-16-codeinsights:7.5.4453@sha256:b25f899f00734b28b35be26285733b0a4a6fea07e02d5d8f2e9291cac4884100'
625625
cpus: 4
626626
mem_limit: '2g'
627627
shm_size: '1g'
@@ -654,7 +654,7 @@ services:
654654
# for this container will need to be updated to reflect the new connection information.
655655
codeinsights-db-exporter:
656656
container_name: codeinsights-db-exporter
657-
image: 'index.docker.io/sourcegraph/postgres_exporter:6.1.2889@sha256:a2fedb3d4aa845375d3c60f37e2813d095c6718c2afa96c2bcc8c17dc8b73991'
657+
image: 'index.docker.io/sourcegraph/postgres_exporter:7.5.4453@sha256:866af1c481b1facaddf1f06d317f10f25b82dd294e45e20df9fb1cb59bbdf272'
658658
cpus: 0.1
659659
mem_limit: '50m'
660660
networks:
@@ -673,7 +673,7 @@ services:
673673
#
674674
blobstore:
675675
container_name: blobstore
676-
image: 'index.docker.io/sourcegraph/blobstore:6.1.2889@sha256:8f49a897d7f7ad4655df9cd79959620ddb73406adccccd567c4846aa24ec4a01'
676+
image: 'index.docker.io/sourcegraph/blobstore:7.5.4453@sha256:cecf3abc30ef26e8c2f0f297778ce2e5c2641ba6687c097e8f21dd0ae4fc462b'
677677
cpus: 1
678678
mem_limit: '1g'
679679
healthcheck:
@@ -696,7 +696,7 @@ services:
696696
#
697697
redis-cache:
698698
container_name: redis-cache
699-
image: 'index.docker.io/sourcegraph/redis-cache:6.1.2889@sha256:204c164bc59119cde8b8d19a640897e8ffe008e040b730bed2188f28fca0d31c'
699+
image: 'index.docker.io/sourcegraph/redis-cache:7.5.4453@sha256:3e528499ad1ba3a56bb625386b03b12d51550f0be005a475e4ead8d936d8be53'
700700
cpus: 1
701701
mem_limit: '7g'
702702
volumes:
@@ -712,7 +712,7 @@ services:
712712
#
713713
redis-store:
714714
container_name: redis-store
715-
image: 'index.docker.io/sourcegraph/redis-store:6.1.2889@sha256:4f4dfb3074e586b7eb8ab2ba631285aeb5e018452219e2f1a2f235c85b8de4bc'
715+
image: 'index.docker.io/sourcegraph/redis-store:7.5.4453@sha256:fed88fe64f23b390f8f2ae8d4fe9052a2f02adfc54cb1090d31df27cf8781f1e'
716716
cpus: 1
717717
mem_limit: '7g'
718718
volumes:
@@ -727,7 +727,7 @@ services:
727727
# Ports exposed to the public internet: none
728728
otel-collector:
729729
container_name: otel-collector
730-
image: 'index.docker.io/sourcegraph/opentelemetry-collector:6.1.2889@sha256:c05e84380dd81d74ff952f73d132710dc4a162fa26c0a0709fba58dcb2829958'
730+
image: 'index.docker.io/sourcegraph/opentelemetry-collector:7.5.4453@sha256:18fc34f101aec65403e7ca289a68ae7ab59718b5c11e832d3a72284e39d95100'
731731
cpus: 1
732732
mem_limit: '1g'
733733
networks:

0 commit comments

Comments
 (0)