rhel-bootc-examples: bootc-git buildroot digest pin goes stale within days

Found in the 2026-09-29 P0 end-to-end re-verification (tracker#33).

just bootc-rpms on cgwalters-forge/rhel-bootc-examples#4 (head fdde227) fails before building anything:

reading manifest sha256:fd6b1e14d330489aac4624aeb6269428163b6fd557cfb572fd1098c73109e84b in quay.io/centos/centos: manifest unknown

bootc-git/buildroot pins quay.io/centos/centos:stream10 by digest. That tag is rebuilt often (the current one was created minutes before the run), has no dated tags (neither has quay.io/centos-bootc/centos-bootc beyond stale 2024 ones), and quay garbage-collects the old manifests: the pin set on 2026-09-25 was gone by 2026-09-29. So the example, and its CI, break a few days after every bump.

Options:

A (recommended): keep the digest for reproducibility, but have bootc-git/Justfile build fall back to buildroot_tag with a warning when the pinned digest can't be pulled, and have CI run just bootc-git-bump (or pass BOOTC_BUILDROOT) so it tests the current buildroot.
B: drop the buildroot pin and always use the tag; keep only the bootc commit pin.
C: keep as is and bump by hand (what the re-verification did, on a scratch branch: cgwalters-bot/rhel-bootc-examples test/p0-e2e).

Generated-by: https://github.com/cgwalters/#llms

✅ dispatch ended well. Result: #185 (comment)

Triage (2026-10-21): valid, and already fixed in an open PR. It needs @cgwalters to review cgwalters-forge/rhel-bootc-examples#4. No new job is needed.

Valid and reproducible. PR composefs-rs: bootc-revdep.yml records a failed run on every push #4 (head 34a8e98, rebased on 2026-10-08) pins bootc-git/buildroot to quay.io/centos/centos:stream10@sha256:a946db53.... Quay has already garbage-collected that digest: today skopeo inspect on it returns manifest unknown.
Option A is already in that PR. The bot's review round on 2026-09-29 added bootc-git/resolve-buildroot.py, which bootc-git/Justfile build calls. It works like this:
- If the pinned image is in local storage or can still be pulled, it is used.
- If the pull fails only with "manifest unknown"/"not found", the build falls back to buildroot_tag with a loud warning and a GitHub Actions ::warning annotation.
- Any other pull error (network, rate limit, auth) still fails the build.
- just bootc-git-bump updates both pins.
The fallback works. I ran the script from the PR head against the stale pin. It printed the warning, returned quay.io/centos/centos:stream10 and exited 0.
One part of option A differs from the issue. CI (.github/workflows/build-composefs-git.yml) doesn't run bootc-git-bump or set BOOTC_BUILDROOT. It tests the pin while the pin exists and the current tag once the pin is gone. That still keeps CI green, and the annotation shows when the pin needs a bump. I don't think a separate change is needed.
What's needed: a review of PR composefs-rs: bootc-revdep.yml records a failed run on every push #4. The bot's last ask, from 2026-10-10, is still unanswered. If option B (drop the buildroot pin) is preferred, say so on the PR. When composefs-rs: bootc-revdep.yml records a failed run on every push #4 merges, this issue can be closed as completed.
Unclear: gh pr checks reports no CI runs on the PR branch bot/c10s-bootc-git, so the new workflow hasn't run in Actions yet.

Generated-by: https://github.com/cgwalters/#llms

Generated by dispatch · ◷

Navigation Menu

Repository navigation

rhel-bootc-examples: bootc-git buildroot digest pin goes stale within days #185

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

rhel-bootc-examples: bootc-git buildroot digest pin goes stale within days #185

Description

Activity

cgwalters-bot commented on Oct 22, 2026

cgwalters-bot commented on Oct 22, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions