From 1495c98ec524d5f3a9039275811ca57bfd1ed47f Mon Sep 17 00:00:00 2001 From: cplieger <917744+cplieger@users.noreply.github.com> Date: Wed, 5 Aug 2026 01:40:00 +0200 Subject: [PATCH] fix(docker-release): hold buildx at v0.36.0 to unblock image releases Every docker release in the fleet has been failing since 2026-08-04 with "Cannot find Buildx release v0.36.1 in releases JSON". setup-buildx-action does not download from the buildx release itself; it resolves the URL from docker/actions-toolkit's .github/buildx-releases.json, a static file a bot regenerates AFTER each release. buildx v0.36.1 published at 15:50Z, Renovate landed the pin at 16:02Z (#424), and the JSON still lacked the entry 7 hours later, so the version this workflow asks for does not exist as far as the action is concerned. Nothing caught it before merge: ci.yaml's build-ability job passes NO version input to the action, so every PR's `ci / docker` check stayed green while every post-merge release died. Confirmed on web-terminal-kiro, web-terminal-server and vibekit; a rerun failed identically. Rolling back to v0.36.0, which the JSON does carry, restores releases now. The durable guard is a 3-day minimumReleaseAge for docker/buildx in the shared preset (cplieger/.github#136), landed first so Renovate cannot re-propose v0.36.1 into the same hole; v0.36.1 becomes eligible again on 2026-08-07, by which point the JSON will have it. --- .github/workflows/docker-release.yaml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docker-release.yaml b/.github/workflows/docker-release.yaml index 63ae008..f1f131a 100644 --- a/.github/workflows/docker-release.yaml +++ b/.github/workflows/docker-release.yaml @@ -108,8 +108,19 @@ on: env: IMAGE_NAME: ${{ github.repository_owner }}/${{ inputs.image-name }} REGISTRY: ghcr.io + # Held one patch behind on purpose. setup-buildx-action resolves the version + # to download from docker/actions-toolkit's .github/buildx-releases.json, + # which is regenerated by a bot AFTER each buildx release, so a pin bumped + # the same day fails every docker release in the fleet with "Cannot find + # Buildx release in releases JSON". v0.36.1 published 2026-08-04 15:50Z, + # Renovate landed it 16:02Z, and the JSON still did not carry it 7 hours + # later. The durable guard is a minimumReleaseAge for docker/buildx in the + # shared preset (cplieger/.github default.json), which holds the bump until + # the JSON has caught up; this value only needs to move when that PR opens. + # Note ci.yaml's build-ability job passes NO version input and so never + # broke — which is why every PR stayed green while every release died. # renovate: datasource=github-releases depName=docker/buildx - BUILDX_VERSION: v0.36.1 + BUILDX_VERSION: v0.36.0 # A cosign MAJOR is a breaking change even when the bump looks routine # (v2→v3 flipped sign-blob defaults and broke release SBOM signing) — majors # are not auto-merged; read the changelog before approving.