fix(deploy): prefix vendor image tag options with the GHCR repo - #144
Merged
Conversation
resolve_vendor_image_tags only resolves bare tags (e.g. "0.9.0-claude") — it just confirms a tag exists on GHCR, it has no opinion on registry/repo. The Stable/Beta <select> in deploy.ts used that bare tag directly as its option value, and deploy_provision_agent/build_default_k8s_manifest write whatever `image` the panel sends straight into the ECS task def / pod spec with no normalization. So picking Stable/Beta (anything but Custom) sent a bare tag as the image, which kubelet/ECS resolve against Docker Hub's `library/<tag>` instead of GHCR — ImagePullBackOff, "repository does not exist or may require 'docker login'". Build the full `ghcr.io/openabdev/openab:<tag>` ref once in deploy.ts before it ever leaves the panel; labels keep showing the short tag. Co-authored-by: Orca (ecs-claude) <orca@openab.dev>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
resolve_vendor_image_tags(vendor_images.rs) resolves and returns bare GHCR tags (e.g.0.9.0-claude) — it only confirms a tag exists, it has no concept of registry/repo.<select>(console/src/deploy.ts) used that bare tag directly as the optionvalue, which flows unchanged intodeploy_provision_agent→provision_agent_k8s/AWS path →build_default_k8s_manifest'sspec.image(or the ECS task def) — nothing along that chain ever prefixes a registry.image: 0.9.0-claude, which the container runtime resolves against Docker Hub'slibrary/<tag>instead of GHCR →ImagePullBackOff/ "repository does not exist or may require 'docker login': denied". Reproduced live on a k8s fleet (Hephaestus, orbstack context) stuck inPending/ImagePullBackOff.ghcr.io/openabdev/openab:<tag>ref once indeploy.tswhen populating the Stable/Beta options; the dropdown label still shows the short tag for readability. The Custom field is unaffected — it already expects a full ref from the user.Test plan
npm run typecheck(console) — passesnpm test(console, vitest) — 103/103 passingImagePullBackOff