Sweep: pin floating dev-base:latest (and other unpinned image tags) fleet-wide #1293

New issue

Open

opened 2026-08-27 03:24:51 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-27 03:24:51 +00:00

Owner

Sweep: pin floating `dev-base:latest` (and other unpinned image tags) fleet-wide

Spun out of the coilyco-bridge/deploy#141 churn cleanup. The infra repo had dev-base image refs on the floating :latest tag (non-reproducible, drifts on every publish, violates the refuse-unpublished-pins guard). That is being fixed in coilyco-flight-deck/infrastructure#543 (pin to the current published version, v0.245.0 as of 2026-07-10). Other repos almost certainly have the same floating-tag pattern and need the same treatment.

The task

Sweep every repo in the fleet (coilysiren + coilyco-bridge + coilyco-flight-deck + coilyco-gaming) for floating image-tag pins and pin each to a concrete published version:

Primary target: forgejo.coilysiren.me/coilyco-flight-deck/dev-base:latest and ghcr.io/coilyco-flight-deck/dev-base:latest in CI workflows (.forgejo/workflows/*), ansible, compose files, and scripts.
Secondary: any other :latest / unpinned image tag used as a CI runner or deploy image where reproducibility matters.
Pin to the current latest published version, resolved at fix time (newest published dev-base tag / latest aos release), not a hardcoded stale value. Keep one-line-bump ergonomics where a *_image_tag variable already exists.

Known context / mechanism

Exemplar fix: coilyco-flight-deck/infrastructure#543 (grep pattern, ref locations, acceptance criteria).
A fleet mechanism may already exist: the infra ward verb that "templates the pinned aos dev-base image into managed repo gate workflows and report blockers" (infrastructure/.ward/ward.yaml, args execute=1, repo=<name>, limit=<n>). The sweep may be able to drive that verb across repos rather than hand-editing each.
Related dev-base-adoption work already open: coilyco-flight-deck/node-stats-mcp#1, coilyco-gaming/eco-app#106, coilyco-flight-deck/agentic-os#453/#452. Coordinate so the sweep does not collide with those.

Why this is filed here (inbox) and not auto-dispatched

The sweep spans the full ~50-repo fleet, which a single director surface does not have mounted (only the ~8-repo substrate slice is visible here, and infra was the only hit in that slice). Fleet-wide enumeration needs a host / control-node pass or a code-search across all repos, so this is a tracked sweep for Kai to scope and fan out (one engineer per repo, or the ward-verb driver), not a single headless run.

Acceptance

dev-base:latest returns no functional hits in any repo's CI/ansible/compose/scripts.
Every dev-base (and other reproducibility-critical) image ref names a concrete published version.
Per-repo bump ergonomics preserved.

## Sweep: pin floating `dev-base:latest` (and other unpinned image tags) fleet-wide Spun out of the `coilyco-bridge/deploy#141` churn cleanup. The infra repo had dev-base image refs on the floating `:latest` tag (non-reproducible, drifts on every publish, violates the refuse-unpublished-pins guard). That is being fixed in `coilyco-flight-deck/infrastructure#543` (pin to the current published version, `v0.245.0` as of 2026-07-10). **Other repos almost certainly have the same floating-tag pattern** and need the same treatment. ## The task Sweep every repo in the fleet (coilysiren + coilyco-bridge + coilyco-flight-deck + coilyco-gaming) for floating image-tag pins and pin each to a concrete published version: - Primary target: `forgejo.coilysiren.me/coilyco-flight-deck/dev-base:latest` and `ghcr.io/coilyco-flight-deck/dev-base:latest` in CI workflows (`.forgejo/workflows/*`), ansible, compose files, and scripts. - Secondary: any other `:latest` / unpinned image tag used as a CI runner or deploy image where reproducibility matters. - Pin to the **current latest published version**, resolved at fix time (newest published dev-base tag / latest aos release), not a hardcoded stale value. Keep one-line-bump ergonomics where a `*_image_tag` variable already exists. ## Known context / mechanism - Exemplar fix: `coilyco-flight-deck/infrastructure#543` (grep pattern, ref locations, acceptance criteria). - A fleet mechanism may already exist: the infra ward verb that "templates the pinned aos dev-base image into managed repo gate workflows and report blockers" (`infrastructure/.ward/ward.yaml`, args `execute=1`, `repo=<name>`, `limit=<n>`). The sweep may be able to drive that verb across repos rather than hand-editing each. - Related dev-base-adoption work already open: `coilyco-flight-deck/node-stats-mcp#1`, `coilyco-gaming/eco-app#106`, `coilyco-flight-deck/agentic-os#453`/`#452`. Coordinate so the sweep does not collide with those. ## Why this is filed here (inbox) and not auto-dispatched The sweep spans the full ~50-repo fleet, which a single director surface does not have mounted (only the ~8-repo substrate slice is visible here, and infra was the only hit in that slice). Fleet-wide enumeration needs a host / control-node pass or a code-search across all repos, so this is a tracked sweep for Kai to scope and fan out (one engineer per repo, or the ward-verb driver), not a single headless run. ## Acceptance - `dev-base:latest` returns no functional hits in any repo's CI/ansible/compose/scripts. - Every dev-base (and other reproducibility-critical) image ref names a concrete published version. - Per-repo bump ergonomics preserved.

coilyco-ops added the

labels

2026-08-29 07:02:43 +00:00