Pin dev-base image refs to current published version (drop floating :latest) #543

New issue

Closed

opened 2026-07-11 01:02:22 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-07-11 01:02:22 +00:00

Member

Problem

Several dev-base image references in this repo use the floating :latest tag, which is non-reproducible and drifts on every dev-base publish. This landed in f55d4192 (fix(ci): use published dev-base latest) and cuts against Kai's own same-day guard 80025c21 (fix(dev-base): refuse unpublished pins). See the aftermath review in coilyco-bridge/deploy#141.

Do

Pin every dev-base image reference in this repo to the current latest published dev-base version, dropping the floating :latest. As of 2026-07-10 the newest published tag is v0.245.0 (the aos release under which dev-base publishes). Resolve/confirm the newest published tag at implementation time (query the Forgejo container registry / the latest coilyco-flight-deck/agentic-os release) and pin to that exact version - do not hardcode a stale one, and do not revert to the old v0.195-era pin. The intent is "current latest, pinned," not "whatever floats."

Known references to update (grep dev-base to catch any I missed):

ansible/ dev-harness role default dev_harness_image_ref / dev_harness_image_tag - currently forgejo.coilysiren.me/coilyco-flight-deck/dev-base:latest. Pin the tag.
The CI/workflow refs introduced by f55d4192.
scripts/ward_eval.py:34 - a stray ghcr.io/coilyco-flight-deck/dev-base:latest (WARD_EVAL_IMAGE default). Different registry, but same floating-tag problem - pin it too (or align it to the forgejo registry if that GHCR path is dead).
Docs that quote the :latest ref (docs/ansible-dev-harness-role.md, docs/ansible-wsl-agent-stack.md, etc.) - update to the pinned form so docs and defaults agree.

Acceptance

git grep 'dev-base:latest' returns nothing functional (only intentional historical/prose mentions, if any).
Every dev-base ref names a concrete published version tag.
The dev_harness_image_tag one-line-bump ergonomics stay intact (a future bump is still a single tag change).
Satisfies the 80025c21 refuse-unpublished-pins guard.

Context

This is the infra half of the deploy#141 churn cleanup. Kai asked to swap infra to the current latest, pinned, rather than revert to the older pin. Root-cause fix for the churn that produced this: coilyco-flight-deck/ward#1105 + coilyco-flight-deck/agentic-os#462 (burndown repo-exclusion filter).

## Problem Several dev-base image references in this repo use the floating `:latest` tag, which is non-reproducible and drifts on every dev-base publish. This landed in `f55d4192` (`fix(ci): use published dev-base latest`) and cuts against Kai's own same-day guard `80025c21` (`fix(dev-base): refuse unpublished pins`). See the aftermath review in `coilyco-bridge/deploy#141`. ## Do Pin **every** dev-base image reference in this repo to the **current latest published dev-base version**, dropping the floating `:latest`. As of 2026-07-10 the newest published tag is **`v0.245.0`** (the aos release under which dev-base publishes). Resolve/confirm the newest published tag at implementation time (query the Forgejo container registry / the latest `coilyco-flight-deck/agentic-os` release) and pin to that exact version - do **not** hardcode a stale one, and do **not** revert to the old `v0.195`-era pin. The intent is "current latest, pinned," not "whatever floats." Known references to update (grep `dev-base` to catch any I missed): - `ansible/` dev-harness role default `dev_harness_image_ref` / `dev_harness_image_tag` - currently `forgejo.coilysiren.me/coilyco-flight-deck/dev-base:latest`. Pin the tag. - The CI/workflow refs introduced by `f55d4192`. - `scripts/ward_eval.py:34` - a stray `ghcr.io/coilyco-flight-deck/dev-base:latest` (`WARD_EVAL_IMAGE` default). Different registry, but same floating-tag problem - pin it too (or align it to the forgejo registry if that GHCR path is dead). - Docs that quote the `:latest` ref (`docs/ansible-dev-harness-role.md`, `docs/ansible-wsl-agent-stack.md`, etc.) - update to the pinned form so docs and defaults agree. ## Acceptance - `git grep 'dev-base:latest'` returns nothing functional (only intentional historical/prose mentions, if any). - Every dev-base ref names a concrete published version tag. - The `dev_harness_image_tag` one-line-bump ergonomics stay intact (a future bump is still a single tag change). - Satisfies the `80025c21` refuse-unpublished-pins guard. ## Context This is the infra half of the `deploy#141` churn cleanup. Kai asked to swap infra to the current latest, pinned, rather than revert to the older pin. Root-cause fix for the churn that produced this: `coilyco-flight-deck/ward#1105` + `coilyco-flight-deck/agentic-os#462` (burndown repo-exclusion filter).

coilyco-ops added the

headless

labels

2026-07-11 01:02:22 +00:00

coilyco-ops commented

2026-07-11 01:02:34 +00:00

Author

Member

WARD-RESERVATION: held 🔒

reservation details

Holder: container engineer-claude-infrastructure-543 on host KAI-DESKTOP-TOWER.

Reserved by ward agent --harness claude (reserved 2026-07-11T01:02:34Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (1h TTL). --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/infrastructure#543 · branch issue-543 · harness claude · workflow direct-main
Run: engineer-claude-infrastructure-543 · ward v0.605.0 · dispatched 2026-07-11T01:02:34Z
Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.605.0).

— Claude (she/her), via ward agent

WARD-RESERVATION: held 🔒 <details><summary>reservation details</summary> Holder: container `engineer-claude-infrastructure-543` on host `KAI-DESKTOP-TOWER`. Reserved by `ward agent --harness claude` (reserved 2026-07-11T01:02:34Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (1h TTL). `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/infrastructure#543` · branch `issue-543` · harness `claude` · workflow `direct-main` - **Run:** `engineer-claude-infrastructure-543` · ward `v0.605.0` · dispatched `2026-07-11T01:02:34Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.605.0). </details> </details>  — Claude (she/her), via `ward agent`

coilyco-ops referenced this issue from a commit

2026-07-11 01:09:53 +00:00

fix(ci): pin dev-base image refs to published v0.242.0, drop floating :latest

coilyco-ops closed this issue

2026-07-11 01:09:53 +00:00