deploy: surface skopeo's stderr in the agent-tools wait step #225

Merged

dominik.polakovics merged 1 commit from lab/20260723-2144 into main

2026-07-25 09:29:37 +02:00

dominik.polakovics commented

2026-07-25 09:20:30 +02:00

Owner

The 'Wait for the agent-tools refs' gate in deploy.yml discarded skopeo's output entirely (>/dev/null 2>&1), so every failure — whatever its real cause — surfaced as the same 'still does not resolve' deadline error after 30 minutes.

That gate has never passed since #221 introduced it: deploy runs 294 and 296 (both attempts) all died at exactly the deadline, including a re-run whose entire retry window was after the agent-tools tags were published, the publish job's own anonymous scratch-pull verification passed, and an anonymous token→manifest→config-blob fetch returned 200 from the deploy target host. So skopeo fails in the runner environment for a reason unrelated to tag existence, and the discarded stderr is the only thing that would name it.

This change:

captures skopeo's stderr (2>&1 >/dev/null — keeps stderr, drops the inspect JSON stdout) and prints it on every 30s retry line and in the deadline ::error,
logs skopeo --version once up front.

The capture-ordering and until err="$(…)" behavior under set -euo pipefail is verified locally (loop exits on success, stderr lands in the message on failure). The next merge to main then diagnoses the gate itself.

Closes #224

The 'Wait for the agent-tools refs' gate in deploy.yml discarded skopeo's output entirely (`>/dev/null 2>&1`), so every failure — whatever its real cause — surfaced as the same 'still does not resolve' deadline error after 30 minutes. That gate has never passed since #221 introduced it: deploy runs 294 and 296 (both attempts) all died at exactly the deadline, including a re-run whose entire retry window was **after** the agent-tools tags were published, the publish job's own anonymous scratch-pull verification passed, and an anonymous token→manifest→config-blob fetch returned 200 from the deploy target host. So skopeo fails in the runner environment for a reason unrelated to tag existence, and the discarded stderr is the only thing that would name it. This change: - captures skopeo's stderr (`2>&1 >/dev/null` — keeps stderr, drops the inspect JSON stdout) and prints it on every 30s retry line and in the deadline `::error`, - logs `skopeo --version` once up front. The capture-ordering and `until err="$(…)"` behavior under `set -euo pipefail` is verified locally (loop exits on success, stderr lands in the message on failure). The next merge to main then diagnoses the gate itself. Closes #224

dominik.polakovics added 1 commit

2026-07-25 09:20:30 +02:00

fix(ci): surface skopeo's stderr in the deploy wait step (issue #224 )

ci / native (pull_request) Successful in 9m5s

Details

7d4399f117

The 'Wait for the agent-tools refs' gate ran skopeo inspect with
>/dev/null 2>&1, so a probe failing for any reason other than a missing
tag — TLS trust, the job container's network path, a registry auth
quirk — produced the same misleading 'still does not resolve' deadline
error. The step has never passed since #221 introduced it, including a
re-run whose whole 30-minute window was after the tags were published
and verified anonymously pullable, so the real failure is something the
discarded stderr would have named.

Capture stderr (2>&1 >/dev/null keeps stderr, drops the inspect JSON)
and print it on every retry and in the deadline error; log skopeo's
version once up front.

Closes #224

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

dominik.polakovics scheduled this pull request to auto merge when all checks succeed

2026-07-25 09:29:32 +02:00

dominik.polakovics merged commit fd66032033 into main

2026-07-25 09:29:37 +02:00

dominik.polakovics deleted branch lab/20260723-2144

2026-07-25 09:29:37 +02:00

dominik.polakovics referenced this pull request from a commit

2026-07-25 09:29:39 +02:00

Merge pull request 'deploy: surface skopeo's stderr in the agent-tools wait step' (#225) from lab/20260723-2144 into main