Re-pin the app image from the moving tag ghcr.io/bluesky-social/pds:0.4 to the exact released tag 0.4.219, and bump the version label 0.2.0+v0.4 → 0.3.0+v0.4.219. Two-line diff; entrypoint.sh.tmpl is intentionally unchanged.
Why
The recipe currently cannot deploy at all: the app container crash-loops Error: Cannot find module '/app/index.js' (MODULE_NOT_FOUND).
Root cause: :0.4 is a moving tag that upstream now republishes with main-branch builds. As of 2026-05-30 it is identical to latest and contains @atproto/pds0.5.1 on Node v24.15.0, with the service restructured to run TypeScript directly (/app/index.ts, CMD node --enable-source-maps index.ts — there is no index.js anymore). This recipe overrides the image entrypoint with a script that ends exec node --enable-source-maps index.js, which can no longer resolve.
0.4.219 is the newest released exact tag (upstream publishes git tags, no GitHub Releases) and keeps the layout this recipe expects: Node 20.20, /app/index.js, dumb-init, image CMD identical to the entrypoint's exec line. The recipe's env/secret interface (PDS_HOSTNAME, PDS_JWT_SECRET, PDS_ADMIN_PASSWORD, PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX, …) is unchanged across the 0.4.x line.
Evidence (reproducible):
docker run --rm --entrypoint sh ghcr.io/bluesky-social/pds:0.4 -c 'node --version; ls /app' → v24.15.0, index.ts … (no index.js)
docker run --rm --entrypoint sh ghcr.io/bluesky-social/pds:0.4.219 -c 'node --version; ls /app' → v20.20.2, index.js …
When upstream cuts real 0.5.x release tags, a follow-up upgrade should migrate the entrypoint to index.ts alongside that bump. Until then, exact-tag pinning prevents this class of breakage.
Fix authored by the cc-ci loop agents; verified via recipe CI on this PR (!testme).
## What
Re-pin the app image from the moving tag `ghcr.io/bluesky-social/pds:0.4` to the exact released tag `0.4.219`, and bump the version label `0.2.0+v0.4` → `0.3.0+v0.4.219`. Two-line diff; `entrypoint.sh.tmpl` is intentionally unchanged.
## Why
The recipe currently cannot deploy at all: the app container crash-loops `Error: Cannot find module '/app/index.js'` (MODULE_NOT_FOUND).
Root cause: `:0.4` is a **moving tag that upstream now republishes with main-branch builds**. As of 2026-05-30 it is identical to `latest` and contains `@atproto/pds` **0.5.1** on Node v24.15.0, with the service restructured to run TypeScript directly (`/app/index.ts`, `CMD node --enable-source-maps index.ts` — there is **no `index.js`** anymore). This recipe overrides the image entrypoint with a script that ends `exec node --enable-source-maps index.js`, which can no longer resolve.
`0.4.219` is the newest released exact tag (upstream publishes git tags, no GitHub Releases) and keeps the layout this recipe expects: Node 20.20, `/app/index.js`, `dumb-init`, image CMD identical to the entrypoint's exec line. The recipe's env/secret interface (PDS_HOSTNAME, PDS_JWT_SECRET, PDS_ADMIN_PASSWORD, PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX, …) is unchanged across the 0.4.x line.
Evidence (reproducible):
- `docker run --rm --entrypoint sh ghcr.io/bluesky-social/pds:0.4 -c 'node --version; ls /app'` → `v24.15.0`, `index.ts …` (no index.js)
- `docker run --rm --entrypoint sh ghcr.io/bluesky-social/pds:0.4.219 -c 'node --version; ls /app'` → `v20.20.2`, `index.js …`
- Upstream Dockerfile@main: `node:24.15-alpine3.23`, `CMD ["node", "--enable-source-maps", "index.ts"]`; Dockerfile@v0.4.219: `node:20.20-alpine3.23`, `CMD ["node", "--enable-source-maps", "index.js"]`
When upstream cuts real 0.5.x release tags, a follow-up upgrade should migrate the entrypoint to `index.ts` alongside that bump. Until then, exact-tag pinning prevents this class of breakage.
---
Fix authored by the cc-ci loop agents; verified via recipe CI on this PR (`!testme`).
Pin an exact released image tag. The previous pin :0.4 is a moving tag
that upstream now republishes with main-branch builds (currently
@atproto/pds 0.5.1 on Node 24, where the service entrypoint moved from
/app/index.js to /app/index.ts), so the recipe's entrypoint.sh
(exec node --enable-source-maps index.js) crash-loops MODULE_NOT_FOUND.
ghcr.io/bluesky-social/pds:0.4.219 is the newest released exact tag and
keeps the layout this recipe's entrypoint expects (Node 20.20,
/app/index.js, dumb-init).
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
What
Re-pin the app image from the moving tag
ghcr.io/bluesky-social/pds:0.4to the exact released tag0.4.219, and bump the version label0.2.0+v0.4→0.3.0+v0.4.219. Two-line diff;entrypoint.sh.tmplis intentionally unchanged.Why
The recipe currently cannot deploy at all: the app container crash-loops
Error: Cannot find module '/app/index.js'(MODULE_NOT_FOUND).Root cause:
:0.4is a moving tag that upstream now republishes with main-branch builds. As of 2026-05-30 it is identical tolatestand contains@atproto/pds0.5.1 on Node v24.15.0, with the service restructured to run TypeScript directly (/app/index.ts,CMD node --enable-source-maps index.ts— there is noindex.jsanymore). This recipe overrides the image entrypoint with a script that endsexec node --enable-source-maps index.js, which can no longer resolve.0.4.219is the newest released exact tag (upstream publishes git tags, no GitHub Releases) and keeps the layout this recipe expects: Node 20.20,/app/index.js,dumb-init, image CMD identical to the entrypoint's exec line. The recipe's env/secret interface (PDS_HOSTNAME, PDS_JWT_SECRET, PDS_ADMIN_PASSWORD, PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX, …) is unchanged across the 0.4.x line.Evidence (reproducible):
docker run --rm --entrypoint sh ghcr.io/bluesky-social/pds:0.4 -c 'node --version; ls /app'→v24.15.0,index.ts …(no index.js)docker run --rm --entrypoint sh ghcr.io/bluesky-social/pds:0.4.219 -c 'node --version; ls /app'→v20.20.2,index.js …node:24.15-alpine3.23,CMD ["node", "--enable-source-maps", "index.ts"]; Dockerfile@v0.4.219:node:20.20-alpine3.23,CMD ["node", "--enable-source-maps", "index.js"]When upstream cuts real 0.5.x release tags, a follow-up upgrade should migrate the entrypoint to
index.tsalongside that bump. Until then, exact-tag pinning prevents this class of breakage.Fix authored by the cc-ci loop agents; verified via recipe CI on this PR (
!testme).!testme
🌻 cc-ci —
bluesky-pds@f7b6c8df❌ failurefull logs · dashboard
!testme
🌻 cc-ci —
bluesky-pds@f7b6c8df✅ passedfull logs · dashboard
!testme
🌻 cc-ci —
bluesky-pds@f7b6c8df✅ passedfull logs · dashboard
!testme
🌻 cc-ci —
bluesky-pds@f7b6c8df✅ passedfull logs · dashboard
Pull request closed