Repository navigation
chore(repo): sync develop into next - #7198
Conversation
…ng every image (#7194) `detect-unmirrored-images.ts` treated any failed `docker buildx imagetools inspect` as "not mirrored" and discarded stderr. A registry blip during detection therefore flagged every pinned image for a re-push. In [Mirror template images run 93](https://github.com/supabase/cli/actions/runs/38847585115), all 19 images were flagged even though every one was already mirrored. The images published to ECR Public by their own release pipelines then failed with `403 Forbidden` on the blob HEAD. The probe now treats only a registry `not found` as unmirrored. Any other inspect failure aborts detection with the target and the registry's error, so a probe failure shows up as one red detect job with its cause instead of a fan-out of misleading push failures.
This bumps storage from v1.83.3-r0 to v1.83.5-r0. https://github.com/supabase/slim-services/releases/tag/storage-v1.83.5-r0 Planned after supabase/slim-services published v1.83.5-r0. This branch is rewritten from develop whenever a newer relevant release arrives. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
# Conflicts: # apps/cli-go/pkg/config/templates/Dockerfile
Claude resolved the merge of
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🤖 AI Review
Reconciled both independent reviews and inspected the changed code, surrounding workflow, tests, and trusted conventions. Claude's sole finding remains uncertain because its registry-response premise is unverified; Codex reported no findings. The storage version update is internally consistent, but published digests and hashes were not independently validated.
Findings
| Severity | Location | Category | Sources | Claim |
|---|---|---|---|---|
| 🟡 MINOR | apps/cli/scripts/detect-unmirrored-images.ts:80 |
error-handling |
claude | Backfilling a previously nonexistent mirror repository may fail if GHCR or ECR Public reports its absence as an authorization or repository-unknown error rather than stderr ending in ': not found'. The detector throws for those responses, preventing the mirror job from running. |
Stats
Claude findings: 1 · Codex findings: 0 · Confirmed: 0 · Refuted: 0 · Uncertain: 1
Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: manual · Workflow run
This review runs once per PR. A maintainer can request another with a /ai-review comment.
| if (stderr.trimEnd().endsWith(": not found")) { | ||
| return false; | ||
| } | ||
| throw new Error(`could not inspect ${target} (exit ${exit}): ${stderr.trim()}`); |
There was a problem hiding this comment.
🟡 MINOR · error-handling · source: claude
Backfilling a previously nonexistent mirror repository may fail if GHCR or ECR Public reports its absence as an authorization or repository-unknown error rather than stderr ending in ': not found'. The detector throws for those responses, preventing the mirror job from running.
Evidence: apps/cli/scripts/detect-unmirrored-images.ts:77-83 accepts successful probes and ': not found' failures only. Errors propagate through partitionUnmirroredImages at lines 52-59 and its top-level invocation at line 101. .github/workflows/mirror-template-images.yml:40-68 grants packages:read, logs into GHCR, and runs detection without an ECR login; lines 70-83 make mirroring depend on detection. detect-unmirrored-images.unit.test.ts:64-78 covers a synthetic not-found response and a network timeout, but no actual missing-repository response.
Suggested fix: Capture missing-repository responses from both registries under the workflow's authentication conditions. Add regression cases for any verified absence responses and handle them narrowly while retaining failures for genuine authentication, rate-limit, and network errors.
Adjudication (uncertain): The surrounding code confirms that any nonmatching error aborts detection and prevents backfilling. However, neither the implementation nor its tests establishes that GHCR or ECR Public returns the alleged authorization or repository-unknown response for an absent repository under these credentials. No registry reproduction was performed, so the central premise cannot be confirmed or refuted.
There was a problem hiding this comment.
develop added this strict error handling in detect-unmirrored-images.ts in #7194, so the merge did not introduce it and it is out of scope for this sync. If GHCR or ECR Public really do report missing repositories in another way, a follow-up PR against develop should handle that.
Claude repair roundNo CI checks failed on this sync, so I made no code changes. The one open review finding is about code that 0 findings fixed, 1 declined (workflow run). |
supabase-oss
left a comment
supabase-oss
left a comment
There was a problem hiding this comment.
CI is green and the AI review raised nothing the merge introduced, so this approves Claude's resolution of the sync (https://github.com/supabase/cli/actions/runs/38883571604).
Merging
developintonextconflicts. This branch starts at the tip ofdevelop(724ce54);nextis at74bcab0.Conflicting files:
apps/cli-go/pkg/config/templates/DockerfileTo resolve:
git fetch origin git switch sync/develop-into-next git merge origin/next # resolve the conflicts, then commit git push origin sync/develop-into-nextApprove to fast-forward
next; do not use the merge button.