[PR #333] [MERGED] ci: stop PR builds from overwriting the fedora-43 tag #313

New issue

Closed

opened 2026-10-15 12:50:45 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 12:50:45 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/games-on-whales/gow/pull/333
Author: @JBailes
Created: 5/6/2026
Status: ✅ Merged
Merged: 5/12/2026
Merged by: @JBailes

Base: master ← Head: fix/fedora-raw-tag-overwrite

📝 Commits (5)

883fd95 base: prefer host-injected nvrtc over baked-in CUDA 11.0, fix toolkit log message
096559e ci: fix fork detection in docker-build-and-publish workflow
f217f24 ci: include variant suffix in fork-PR base image artifact lookup
3aebfd1 ci: stop PR builds from overwriting fedora-43 tag
e0afce0 ci: harden flaky asset downloads in steam, base-emu, pegasus, es-de

📊 Changes

12 files changed (+177 additions, -55 deletions)

View changed files

📝 .github/workflows/auto-build.yml (+8 -0)
📝 .github/workflows/docker-build-and-publish.yml (+26 -18)
📝 apps/es-de/build-fedora/Dockerfile (+20 -10)
📝 apps/es-de/build/Dockerfile (+20 -10)
📝 apps/pegasus/build-fedora/Dockerfile (+11 -3)
📝 apps/pegasus/build/Dockerfile (+12 -4)
📝 apps/steam/build-fedora/Dockerfile (+5 -1)
📝 apps/steam/build/Dockerfile (+5 -1)
📝 images/base-emu/build-fedora/Dockerfile (+20 -3)
📝 images/base-emu/build/Dockerfile (+20 -3)
📝 images/base/build-fedora/overlay/etc/cont-init.d/30-nvidia.sh (+15 -1)
📝 images/base/build/overlay/etc/cont-init.d/30-nvidia.sh (+15 -1)

📄 Description

Summary

Users have been reporting that gameonwhales/base:fedora-43 (and other :fedora-43 images) point to stale builds, forcing them to pin specific SHAs to get a current image. There are two root causes in .github/workflows/:

Same-repo PR builds were overwriting the production tag. The fork-detection in docker-build-and-publish.yml keys is_fork on head.repo.full_name != base.repo, so a PR opened from a branch inside games-on-whales/gow is treated as a non-fork and takes the production-push path (lines 189-217). Combined with type=raw,value=fedora-43 (which is unconditional in docker/metadata-action), every same-repo PR build was retagging :fedora and :fedora-43 on ghcr.io and docker.io with that PR's content.
No concurrency: group on the workflow. Concurrent runs on the same ref (PR + master push, two PRs, manual re-runs) raced when pushing mutable tags, so a slower-finishing older run could clobber a newer one.

The per-commit type=sha tag is unaffected, which is why pinning SHAs works.

Changes

docker-build-and-publish.yml: gate the type=raw,value=fedora and type=raw,value=fedora-43 entries on github.event_name == 'push' && github.ref == 'refs/heads/master' in both the build job (line ~294) and the merge job (line ~484). PR builds (same-repo or fork) no longer emit these tags. sha-<commit>-fedora is still produced on every run, so PR images remain pullable for testing.
auto-build.yml: add a workflow-level concurrency: group keyed by ${{ github.workflow }}-${{ github.ref }} with cancel-in-progress: false, so concurrent runs on the same ref serialize.

Out of scope

The nightly schedule (lines 19-20) is still commented out, so :fedora-43 won't refresh on upstream-only Fedora base-image updates without a commit. That's a separate cost/freshness decision.
Tagged-release builds (v*) are also not (re)gated to update :fedora-43. If releases should refresh it, extend the condition to include startsWith(github.ref, 'refs/tags/').

Test plan

After merge, the next push to master produces images tagged :fedora, :fedora-43, :edge-fedora, :master-fedora, and :sha-<commit>-fedora.
Open a PR (same-repo branch) that touches images/**. Verify the build runs, but :fedora and :fedora-43 on ghcr.io / docker.io are NOT updated. The :sha-<commit>-fedora tag is still pushed.
Trigger two runs back-to-back on master (e.g. quick consecutive merges). Verify they serialize via the concurrency group and the final :fedora-43 reflects the most recent commit.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/games-on-whales/gow/pull/333 **Author:** [@JBailes](https://github.com/JBailes) **Created:** 5/6/2026 **Status:** ✅ Merged **Merged:** 5/12/2026 **Merged by:** [@JBailes](https://github.com/JBailes) **Base:** `master` ← **Head:** `fix/fedora-raw-tag-overwrite` --- ### 📝 Commits (5) - [`883fd95`](https://github.com/games-on-whales/gow/commit/883fd95ff30b380aa663fce36b28d48afe98bfbf) base: prefer host-injected nvrtc over baked-in CUDA 11.0, fix toolkit log message - [`096559e`](https://github.com/games-on-whales/gow/commit/096559e785760de796bfe18625ece5b3ab2c8a80) ci: fix fork detection in docker-build-and-publish workflow - [`f217f24`](https://github.com/games-on-whales/gow/commit/f217f24042dc2bd3c120e8539e582669ebfe2cd6) ci: include variant suffix in fork-PR base image artifact lookup - [`3aebfd1`](https://github.com/games-on-whales/gow/commit/3aebfd1e205eaf2cf943847b6153e737db4dbb83) ci: stop PR builds from overwriting fedora-43 tag - [`e0afce0`](https://github.com/games-on-whales/gow/commit/e0afce02b679d51aee6a70fd84c20a0d0da60c28) ci: harden flaky asset downloads in steam, base-emu, pegasus, es-de ### 📊 Changes **12 files changed** (+177 additions, -55 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/auto-build.yml` (+8 -0) 📝 `.github/workflows/docker-build-and-publish.yml` (+26 -18) 📝 `apps/es-de/build-fedora/Dockerfile` (+20 -10) 📝 `apps/es-de/build/Dockerfile` (+20 -10) 📝 `apps/pegasus/build-fedora/Dockerfile` (+11 -3) 📝 `apps/pegasus/build/Dockerfile` (+12 -4) 📝 `apps/steam/build-fedora/Dockerfile` (+5 -1) 📝 `apps/steam/build/Dockerfile` (+5 -1) 📝 `images/base-emu/build-fedora/Dockerfile` (+20 -3) 📝 `images/base-emu/build/Dockerfile` (+20 -3) 📝 `images/base/build-fedora/overlay/etc/cont-init.d/30-nvidia.sh` (+15 -1) 📝 `images/base/build/overlay/etc/cont-init.d/30-nvidia.sh` (+15 -1) </details> ### 📄 Description ## Summary Users have been reporting that `gameonwhales/base:fedora-43` (and other `:fedora-43` images) point to stale builds, forcing them to pin specific SHAs to get a current image. There are two root causes in `.github/workflows/`: 1. **Same-repo PR builds were overwriting the production tag.** The fork-detection in `docker-build-and-publish.yml` keys `is_fork` on `head.repo.full_name != base.repo`, so a PR opened from a branch *inside* `games-on-whales/gow` is treated as a non-fork and takes the production-push path (lines 189-217). Combined with `type=raw,value=fedora-43` (which is unconditional in `docker/metadata-action`), every same-repo PR build was retagging `:fedora` and `:fedora-43` on ghcr.io and docker.io with that PR's content. 2. **No `concurrency:` group on the workflow.** Concurrent runs on the same ref (PR + master push, two PRs, manual re-runs) raced when pushing mutable tags, so a slower-finishing older run could clobber a newer one. The per-commit `type=sha` tag is unaffected, which is why pinning SHAs works. ## Changes - `docker-build-and-publish.yml`: gate the `type=raw,value=fedora` and `type=raw,value=fedora-43` entries on `github.event_name == 'push' && github.ref == 'refs/heads/master'` in both the build job (line ~294) and the merge job (line ~484). PR builds (same-repo or fork) no longer emit these tags. `sha-<commit>-fedora` is still produced on every run, so PR images remain pullable for testing. - `auto-build.yml`: add a workflow-level `concurrency:` group keyed by `${{ github.workflow }}-${{ github.ref }}` with `cancel-in-progress: false`, so concurrent runs on the same ref serialize. ## Out of scope - The nightly schedule (lines 19-20) is still commented out, so `:fedora-43` won't refresh on upstream-only Fedora base-image updates without a commit. That's a separate cost/freshness decision. - Tagged-release builds (`v*`) are also not (re)gated to update `:fedora-43`. If releases should refresh it, extend the condition to include `startsWith(github.ref, 'refs/tags/')`. ## Test plan - [ ] After merge, the next push to `master` produces images tagged `:fedora`, `:fedora-43`, `:edge-fedora`, `:master-fedora`, and `:sha-<commit>-fedora`. - [ ] Open a PR (same-repo branch) that touches `images/**`. Verify the build runs, but `:fedora` and `:fedora-43` on ghcr.io / docker.io are NOT updated. The `:sha-<commit>-fedora` tag is still pushed. - [ ] Trigger two runs back-to-back on `master` (e.g. quick consecutive merges). Verify they serialize via the concurrency group and the final `:fedora-43` reflects the most recent commit. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-15 12:50:45 +00:00