Skip to content

ci: pull the Postgres service from mirror.gcr.io, pinned by digest (BUG-3602) - #2081

Merged
xarmian merged 1 commit into
mainfrom
wren/bug-3602-pg-image-mirror
Oct 11, 2026
Merged

xarmian merged 1 commit into
mainfrom
wren/bug-3602-pg-image-mirror

Conversation

@xarmian

@xarmian xarmian commented Oct 11, 2026

Copy link
Copy Markdown
Collaborator

BUG-3602 (high). #2078's Go (PostgreSQL) job failed in 22s, before any test ran. Pulling public.ecr.aws/docker/library/postgres:17-alpine answered "toomanyrequests: Data limit exceeded". AWS's public mirror replaced Docker Hub on day 90 for the same reason (#1989); now it meters too, and every PR's PG job is exposed.

Change: the service image becomes mirror.gcr.io/library/postgres:17-alpine@sha256:b0f9560a2de083e2cc7382e75f808c7381a32852a7ec49117deedb300e552b24.

  • Google's Docker Hub mirror, which is the lead's choice. A GHCR copy would be an org-registry write.
  • Pinned to postgres:17-alpine's multi-arch index digest. docker buildx imagetools inspect shows the same digest on mirror.gcr.io and public.ecr.aws today, so this is the image CI already ran, and a moved tag cannot change it mid-flight. Bump it deliberately.

The Makefile's local postgres:17-alpine runs and the compose files are a developer's own pulls; this PR leaves them as they are.

Evidence:

  • Digest cross-checked on both registries.
  • Codex: CLEAN at b12f510 (gpt-6-luna). It confirms the YAML and service block are intact, the digest-qualified service image is valid, and nothing else in .github/ pulls Postgres.
  • This PR's own Go (PostgreSQL) job is the live test of the new pull.

https://claude.ai/code/session_01FAVXA5mJ5BNhKmv95jxQkQ

…UG-3602)

#2078's Go (PostgreSQL) job failed before any test ran: pulling
public.ecr.aws/docker/library/postgres:17-alpine answered
"toomanyrequests: Data limit exceeded". AWS's public mirror replaced
Docker Hub on day 90 for the same reason (#1989), and now meters too.
Every PR's PG job is exposed.

The service image is now Google's Docker Hub mirror, pinned to
postgres:17-alpine's multi-arch index digest
(sha256:b0f9560a...552b24). That digest is the same on mirror.gcr.io and
public.ecr.aws today, so it is the image CI already ran, and a moved tag
cannot change it mid-flight.

Claude-Session: https://claude.ai/code/session_01FAVXA5mJ5BNhKmv95jxQkQ
@xarmian
xarmian merged commit 079811f into main Oct 11, 2026
12 checks passed
@xarmian
xarmian deleted the wren/bug-3602-pg-image-mirror branch October 11, 2026 22:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant