Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Child apps that set ci.image flip to root tier and fail the Railway leg (citynode.app + feedback.nearbuilders.org both failing) — make child ci.image pin the deploy instead

Chiusa
  • Qualcosa non va?
#493 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Una pull request collegata è già stata integrata.

  • #517 di @elliotBraem — integrata

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
docker, github-actions, typescript
Ambito
devops, infrastructure

Direzione di ricerca

Start with resolveRuntimeTier, resolveImageLegPlan, and resolveRailwayLeg in packages/everything-dev/src/services/deploy/legs.mjs, then read resolveImageRef and deployImageToRailway in packages/everything-dev/src/services/deploy/image.mjs and ADR 0021. Trace how child ci.image affects tier selection and Railway source deployment; done means a child pin deploys the intended image safely without requiring a root-tier digest. The issue does not name tests or a smoke-test entry point.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

Setting ci.image in a child app's bos.app.ts flips the deploy to root tier (resolveRuntimeTier — packages/everything-dev/src/services/deploy/legs.mjs:10-12: ciImage || imageEnv || hasDockerfile ? "root" : "child"). Root tier requires a pinned digest, and the shared consumer-deploy.yml workflow never passes BOS_IMAGE_DIGEST, so every child deploy with ci.image set fails:

Image skipped: no Dockerfile at the config root
Railway deploy failed: Railway deploy requires a runtime image (set ci.image, or pass BOS_IMAGE_DIGEST for a pre-pushed image)
✗ Config published, but the railway leg(s) failed

The config itself publishes fine — only the Railway leg fails.

Two consumers are broken right now by this:

  • NEARBuilders/feedback.nearbuilders.org — deploy failed 2026-10-19 with exactly this signature.
  • NEARBuilders/citynode.app — its bos.app.ts pins ci.image: ghcr.io/nearbuilders/everything-dev:sha-2fb30b2 with the same thin-wrapper consumer-deploy workflow; its Deploy workflow has failed on every run since 2026-10-14.

The child model without ci.image works (child tier: image leg soft-skips, railway redeploy --from-source succeeds with just RAILWAY_TOKEN + ci.railway.service) — but then the child has no protection from :rc float: the Railway service's dashboard-connected source decides the pulled bytes, not the child's config.

The design gap

Under the current design, a child's ci.image can't pin its deploy even in principle: the Railway leg runs railway redeploy --service <service> --from-source (image.mjs:236-242), which re-pulls the service's dashboard-connected source ref — ci.image never repoints it. It only (a) flips the tier to root and (b) names the image for the root-tier build/prebuilt + smoke path. So a child authoring ci.image as a pin ("deploy this image, not whatever :rc floats to") gets a hard failure instead, and removing it silently opts into :rc tracking.

Proposed fix

Make a child's ci.image meaningful and safe:

  1. Tier: a child that sets ci.image (and has no Dockerfile) should stay child tier — it cannot build, so demanding a digest is a dead end. Root tier should remain reserved for the actual root runtime (which owns its Dockerfile / image train).
  2. Railway leg: when a child pins ci.image, the redeploy should deploy the service pinned to that ref — e.g. repoint the service source to ci.image (or validate that the service's current source matches it and fail loudly on drift), rather than a blind redeploy --from-source. Per ADR 0021 ("Deployments should pin the digest either way"), a tag ref in ci.image could be resolved to its digest at deploy time and pinned.
  3. Smoke leg: for a pinned child, optionally smoke-boot the pinned ref (image@digest) so "pulled bytes are what this train validated" holds for children too.

References

  • ADR 0021 (universal runtime image + the 2026-10-13 amendments — image-backed Railway deploys, :rc train semantics)
  • resolveRuntimeTier / resolveImageLegPlan / resolveRailwayLeg in packages/everything-dev/src/services/deploy/legs.mjs
  • resolveImageRef / deployImageToRailway in packages/everything-dev/src/services/deploy/image.mjs
  • .github/workflows/consumer-deploy.yml (never passes BOS_IMAGE_DIGEST; header describes child-tier soft-skips)
  • Related: #489 (composition precedence — already landed in rc.12/rc.8)
Lingua principale
TypeScript
Stelle
5
Fork
3
Merge medio
9h 55m
PR unite (30g)
108

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di NEARBuilders/everything-dev

Tutte le issue di NEARBuilders/everything-dev

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.