Skip to content

fix(docker-release): hold buildx at v0.36.0 to unblock image releases #426

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cplieger merged 1 commit into from
Aug 4, 2026
Merged

fix(docker-release): hold buildx at v0.36.0 to unblock image releases #426

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion .github/workflows/docker-release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,8 +108,19 @@ on:
env:
IMAGE_NAME: ${{ github.repository_owner }}/${{ inputs.image-name }}
REGISTRY: ghcr.io
# Held one patch behind on purpose. setup-buildx-action resolves the version
# to download from docker/actions-toolkit's .github/buildx-releases.json,
# which is regenerated by a bot AFTER each buildx release, so a pin bumped
# the same day fails every docker release in the fleet with "Cannot find
# Buildx release <v> in releases JSON". v0.36.1 published 2026-08-04 15:50Z,
# Renovate landed it 16:02Z, and the JSON still did not carry it 7 hours
# later. The durable guard is a minimumReleaseAge for docker/buildx in the
# shared preset (cplieger/.github default.json), which holds the bump until
# the JSON has caught up; this value only needs to move when that PR opens.
# Note ci.yaml's build-ability job passes NO version input and so never
# broke — which is why every PR stayed green while every release died.
# renovate: datasource=github-releases depName=docker/buildx
BUILDX_VERSION: v0.36.1
BUILDX_VERSION: v0.36.0
# A cosign MAJOR is a breaking change even when the bump looks routine
# (v2→v3 flipped sign-blob defaults and broke release SBOM signing) — majors
# are not auto-merged; read the changelog before approving.
Expand Down
Loading