Repository navigation
ci(repo): upload slim natives to S3 without waiting on the ECR mirror - #6717
Conversation
`upload-natives-s3` needed the `mirror` job to succeed, so any ECR Public failure (missing `cli/*` repositories or push permissions) also kept every native out of the S3 bucket. The job now runs alongside the ECR copy and verifies the source image digest itself, so nothing reaches the bucket from a dispatch whose claimed image digest does not match GHCR. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016ctyhVP3n3xNy7YRtGYp4p
There was a problem hiding this comment.
🤖 AI Review
No correctness or security defect was found. The PR safely makes the S3 upload job independent while retaining its source-digest gate. One confirmed maintainability nit remains: the new digest-check step expands an already duplicated setup sequence across both jobs.
Findings
| Severity | Location | Category | Sources | Claim |
|---|---|---|---|---|
| ⚪ NIT | .github/workflows/mirror-slim-image.yml:198 |
maintainability |
claude | Adding the S3 job's source-digest check leaves both jobs with duplicated payload-validation, regctl-installation, GHCR-login, and digest-verification setup that must be kept synchronized. |
Stats
Claude findings: 1 · Codex findings: 0 · Confirmed: 1 · Refuted: 0 · Uncertain: 0
Models: claude-opus-5 + gpt-5.6-sol · Trigger: auto · Workflow run
This review runs once per PR. A maintainer can request another with a /ai-review comment.
|
Run CLI end-to-end tests (shard 1/3) failed in
No fix is needed here: pinning the version would defeat what the test checks. I'll re-run the failed job once, after the tarball is downloadable. Generated by Claude Code |
Summary
In
mirror-slim-image.yml,upload-natives-s3needed themirrorjob to succeed. The ECR Publiccli/*repositories don't exist yet, so every dispatch fails at "Ensure ECR Public repository exists" and no native ever reaches the S3 bucket.The S3 job now runs alongside the ECR copy. It checks the source image digest on GHCR itself, so nothing reaches the bucket from a dispatch whose claimed image digest doesn't match. The ECR job is unchanged.
This is split out of #6716 so the S3 mirror can start filling before the CLI fallback lands. Once this merges, #6716 carries the same change with no remaining diff.
Linked issue
None; maintainer change.
🤖 Generated with Claude Code
https://claude.ai/code/session_016ctyhVP3n3xNy7YRtGYp4p
Generated by Claude Code