ci: warn loudly when the public image mirror is skipped (PSA-58) #455

Merged

longjacksonle merged 1 commit from fix/PSA-58-warn-on-skipped-mirror into main

2026-07-30 21:00:47 +02:00

longjacksonle commented

2026-07-30 20:55:01 +02:00

Owner

PSA-58: warn loudly when the public image mirror is skipped

The Mirror image to public registry step is gated on PSA_SYSTEMS_PUBLIC_PACKAGE_OWNER. When that var is empty the step is skipped and the job still passes green, so the public :latest silently freezes while private builds keep succeeding - the drift noticed during PMS-687.

Adds a step that emits a ::warning run annotation on a real (non-dry-run) push whenever the owner var is empty, so the skip is visible and deliberate.

It intentionally does not fail the build:

an unset owner (no public image published yet) is a valid config, and
the internal nc-01/c-01 deployment pulls the private path directly, so a public mirror gap doesn't break prod - a hard fail would be wrong here.

Scope: mokosh-apps is the only psa-systems image with a public-mirror step (bunyip uses build-api/build-web with none; mokosh-server has none), so this is the single place the pattern exists.

## PSA-58: warn loudly when the public image mirror is skipped The `Mirror image to public registry` step is gated on `PSA_SYSTEMS_PUBLIC_PACKAGE_OWNER`. When that var is empty the step is **skipped and the job still passes green**, so the public `:latest` silently freezes while private builds keep succeeding - the drift noticed during PMS-687. Adds a step that emits a `::warning` run annotation on a real (non-dry-run) push whenever the owner var is empty, so the skip is **visible and deliberate**. It intentionally does **not** fail the build: - an unset owner (no public image published yet) is a valid config, and - the internal nc-01/c-01 deployment pulls the **private** path directly, so a public mirror gap doesn't break prod - a hard fail would be wrong here. Scope: mokosh-apps is the only psa-systems image with a public-mirror step (bunyip uses `build-api`/`build-web` with none; mokosh-server has none), so this is the single place the pattern exists.

longjacksonle added 1 commit

2026-07-30 20:55:01 +02:00

ci: warn loudly when the public image mirror is skipped (PSA-58)

Check / fmt + clippy + tests (pull_request) Successful in 2m35s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

6dd6026cc1

The "Mirror image to public registry" step is gated on PSA_SYSTEMS_PUBLIC_PACKAGE_OWNER, so an empty var silently skips it and the job still goes green - the public :latest then freezes while private builds keep succeeding (how the public path drifted stale, noticed during PMS-687). Add a step that emits a `::warning` run annotation on a real (non-dry-run) push whenever the owner var is empty, so the skip is visible and deliberate. It does not fail the build: an intentionally-unset owner (no public image yet) is a valid config, and the internal deployment pulls the private path directly, so a hard fail would be wrong. mokosh-apps is the only psa-systems image with a public mirror step (bunyip uses build-api/web with none; mokosh-server has none).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QvB249F2SV9SBe3cBKRjcS