fix(docker-release): hold buildx at v0.36.0 to unblock image releases - #426
Merged
Conversation
Every docker release in the fleet has been failing since 2026-08-04 with "Cannot find Buildx release v0.36.1 in releases JSON". setup-buildx-action does not download from the buildx release itself; it resolves the URL from docker/actions-toolkit's .github/buildx-releases.json, a static file a bot regenerates AFTER each release. buildx v0.36.1 published at 15:50Z, Renovate landed the pin at 16:02Z (#424), and the JSON still lacked the entry 7 hours later, so the version this workflow asks for does not exist as far as the action is concerned. Nothing caught it before merge: ci.yaml's build-ability job passes NO version input to the action, so every PR's `ci / docker` check stayed green while every post-merge release died. Confirmed on web-terminal-kiro, web-terminal-server and vibekit; a rerun failed identically. Rolling back to v0.36.0, which the JSON does carry, restores releases now. The durable guard is a 3-day minimumReleaseAge for docker/buildx in the shared preset (cplieger/.github#136), landed first so Renovate cannot re-propose v0.36.1 into the same hole; v0.36.1 becomes eligible again on 2026-08-07, by which point the JSON will have it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Rolls
BUILDX_VERSIONback to v0.36.0. Every docker image release in the fleet has been failing since 2026-08-04:setup-buildx-actiondoes not download from the buildx release itself. It resolves the download URL fromdocker/actions-toolkit's.github/buildx-releases.json, a static file a bot regenerates after each release. buildx v0.36.1 published at 15:50Z, Renovate landed the pin at 16:02Z (#424), and the JSON still lacked the entry 7 hours later (verified by direct fetch: 137 entries, nov0.36.1). So the version this workflow asks for does not exist as far as the action is concerned.Why it merged green and broke afterwards
ci.yaml's build-ability job passes noversioninput to the action, so it always resolves. Onlydocker-release.yamlpasses the pin, at lines 283 and 377. Every PR'sci / dockercheck therefore stays green while every post-merge release dies.Confirmed failures: web-terminal-kiro (run 30959626732, reran
--failedonce and it failed identically), web-terminal-server (run 30960032307), vibekit (release at 20:11Z). Neither web-terminal repo cut a release —release / docker / buildfailed on both arches andfinalizewas skipped.The durable guard is separate
cplieger/.github#136 adds a 3-day
minimumReleaseAgefordocker/buildx, landed before this PR so Renovate cannot immediately re-propose v0.36.1 into the same hole. v0.36.1 becomes eligible again on 2026-08-07, by which point the JSON will carry it, and the pin can then move normally.The alternative considered and rejected: dropping the explicit
version:input so the release path matchesci.yaml's already-passing default. That deletes the failure class outright, but it also gives up a deliberate reproducibility pin on a supply-chain-relevant tool, which is a bigger decision than an incident fix should make.Propagation
This is a Channel 2 change, so
self-release.yamlcuts a tag on merge,move-major-tag.yamlmovesv2, and Renovate bumps each consumer's SHA pin.release.yamlcallsdocker-release.yamlthrough a local./.github/workflows/ref, so a consumer stays on the broken copy until its own pin moves — the fleet self-heals on the resident renovate container's hourly sweep, or sooner if it is run by hand.