github: retry release metadata fetches - #1276
Merged
Merged
Conversation
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
1 task
8 tasks
nickpell
pushed a commit
to cloudx-io/openauction
that referenced
this pull request
Aug 24, 2026
Weekly `ratchet` refresh of the SHA-pinned GitHub Actions under `.github/`. Two refs moved, both to the newest release inside their existing `# ratchet:` constraint. No constraint comment was rewritten and no workflow logic changed. ## Refs that moved | Action | File | Constraint | Version | SHA | |---|---|---|---|---| | `aws-actions/amazon-ecr-login` | `.github/workflows/docker.yml` | `@v2` (unchanged) | v2.1.6 → v2.1.7 | `d539f0932e70871a027e9d5a9d8fc38589180a64` → `03f1aad4c6c7ffd436567f42f9384779290529bd` | | `docker/setup-buildx-action` | `.github/workflows/docker.yml` | `@v4` (unchanged) | v4.2.0 → v4.3.0 | `bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` → `37fe631027851001ddb9b187196cc803df7f5f0e` | ## Upstream changelog **[aws-actions/amazon-ecr-login v2.1.7](https://github.com/aws-actions/amazon-ecr-login/releases/tag/v2.1.7)** (published 2026-08-19). The changelog entry contains a single *Dependency Updates* section — no features, fixes, or breaking-change entries. - `@aws-sdk/client-ecr`, `@aws-sdk/client-ecr-public`, `@aws-sdk/credential-providers`: 3.1065.0 → 3.1111.0 - `undici` (transitive): 6.24.0 → 6.28.0 - Development-only: `eslint`, `globals`, `@vercel/ncc`, plus upstream's own CI action pins - `action.yml` is byte-identical between v2.1.6 and v2.1.7, so inputs, outputs, and the action runtime are unchanged **[docker/setup-buildx-action v4.3.0](https://github.com/docker/setup-buildx-action/releases/tag/v4.3.0)** (published 2026-08-19). The release notes list only dependency bumps. - `@docker/actions-toolkit`: 0.92.0 → 0.95.0 - `js-yaml` 5.2.0 → 5.3.0; `brace-expansion` 1.1.13 → 1.1.18, `postcss` 8.5.10 → 8.5.25, `undici` 6.27.0 → 6.28.0 (transitive) - `action.yml` is byte-identical between v4.2.0 and v4.3.0 - The behaviour-relevant content in the toolkit range is: retries added around GitHub release-metadata fetches ([actions-toolkit#1276](docker/actions-toolkit#1276), confined to `src/github/github.ts`), an **opt-in** Rekor v2 path for cosign signing ([actions-toolkit#1176](docker/actions-toolkit#1176)), an `undock` helper update, and `@actions/cache` 6.1.0 → 6.2.0 Neither release is labelled breaking, and neither carries a breaking-change section. Both are patch/minor releases within the major this repository already pins. ## Risk assessment Low. The diff is two SHA values in one workflow file. - **No contract change.** Each action's `action.yml` is unchanged across the bump, so the inputs this repository passes — `platforms:` for the buildx setup step, and no inputs for the ECR login step — resolve exactly as before. - **No major held back.** After this update every ratchet-managed ref under `.github/` sits at the tip of its declared constraint, and no action has a newer major tag upstream than the one currently pinned. Nothing needed `ratchet upgrade`, so no `# ratchet:` constraint comment was rewritten. - **PR CI does not exercise these two steps.** Both changed refs live in `.github/workflows/docker.yml`, which is triggered by `workflow_run` after the Go workflow completes and by `workflow_dispatch`; it does not run on pull requests. PR CI therefore confirms the refs are pinned and that pinning is idempotent, but the two updated actions are first exercised by Docker Build after this merges to `main`. That is covered in the post-merge section below. - **Most likely observable effect** is the buildx toolkit's new retry on release-metadata fetches, which makes buildx setup more tolerant of transient GitHub API failures. The Rekor v2 addition is opt-in and this workflow does not enable it. - For the ECR login step, the AWS SDK bump is a routine cumulative range and the step's behaviour — authenticating the local Docker client against the account registry — is unchanged. - No open upstream issues report regressions against either version. ## Pre-merge checklist - [x] `mise run //:ratchet:update` applied; re-running it produces no further diff - [x] `mise run //:ratchet:lint` passes — every external ref is still pinned - [x] `mise run //:ratchet:pin` is idempotent — `git diff --exit-code` is clean afterwards - [x] Diff limited to two SHA pins in `.github/workflows/docker.yml`; no constraint comment changed and no unrelated workflow edits - [x] Upstream release notes reviewed for both bumps; neither is labelled breaking - [ ] PR CI green, including `Ratchet Lint` ## Post-merge verification - [ ] Workflows on `main` reference the new pins - [ ] The first Docker Build run on `main` after merge succeeds. This is where both updated actions are first exercised, since `docker.yml` does not run on pull requests: the buildx setup step on every run, and the ECR login step on a publishing run. <div><a href="https://cursor.com/agents/bc-5a0208aa-ff1b-4944-bb4b-f90b8d2aa38c?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/automations/65e8572f-8209-11f1-a7d1-d6b4613131ce"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/view-automation-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/view-automation-light.png"><img alt="View Automation" width="141" height="28" src="https://cursor.com/assets/images/view-automation-dark.png"></picture></a> </div> Co-authored-by: Cursor Agent <cursoragent@cursor.com>
![https://cursor.com/assets/images/open-in-web-dark.png"><source](https://cursor.com/assets/images/open-in-web-dark.png"><source){kind=link}
![https://cursor.com/assets/images/open-in-web-light.png"><img](https://cursor.com/assets/images/open-in-web-light.png"><img){kind=link}
![https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a](https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a){kind=link}
![https://cursor.com/assets/images/view-automation-dark.png"><source](https://cursor.com/assets/images/view-automation-dark.png"><source){kind=link}
![https://cursor.com/assets/images/view-automation-light.png"><img](https://cursor.com/assets/images/view-automation-light.png"><img){kind=link}
![https://cursor.com/assets/images/view-automation-dark.png"></picture></a> </div](https://cursor.com/assets/images/view-automation-dark.png"></picture></a> </div){kind=link}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
relates to https://github.com/docker/packaging/actions/runs/32020378125/job/95358775047?pr=496#step:7:146