fix: verify GHCR releases when image tag list is huge #34

2026-11-02T19:12:57Z

autonomic-bot commented

2026-11-02 19:12:57 +00:00

GHCR image repositories such as immich-machine-learning exceed the bounded 40,000-tag listing. The resolver now falls back to the project’s GitHub releases only when that list contains the current pin, and verifies each candidate with a GHCR manifest HEAD request before calling it an available image. If either source is unavailable, the image remains unverified.

Evidence: offline regression covers an unpublished release tag staying current and a published manifest becoming an upgrade; 4 resolver tests pass. Live GHCR returned HTTP 200 for a HEAD request on the current v3.3.5 manifest. A full live fallback requires the read-only GitHub API token, currently absent on cc-ci; without it this path fails closed as unverified.

GHCR image repositories such as immich-machine-learning exceed the bounded 40,000-tag listing. The resolver now falls back to the project’s GitHub releases only when that list contains the current pin, and verifies each candidate with a GHCR manifest HEAD request before calling it an available image. If either source is unavailable, the image remains unverified. Evidence: offline regression covers an unpublished release tag staying current and a published manifest becoming an upgrade; 4 resolver tests pass. Live GHCR returned HTTP 200 for a HEAD request on the current v3.3.5 manifest. A full live fallback requires the read-only GitHub API token, currently absent on cc-ci; without it this path fails closed as unverified.

autonomic-bot added 1 commit 2026-11-02 19:12:58 +00:00

fix: verify GHCR release manifests when tag listing is huge 9f103c3516

autonomic-bot merged commit aa6a3f095c into main

2026-11-02 19:13:04 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: recipe-maintainers/cc-ci-orchestrator#34