Jinemi/thermograph
4
0
Fork 0
Code Issues 2 Pull requests 4 Projects Releases Packages Wiki Activity Actions

deploy.sh: fix the daemon-binary probe, which always dropped daemon
All checks were successful
PR build (required check) / changes (pull_request) Successful in 6s
Details
secrets-guard / encrypted (pull_request) Successful in 6s
Details
PR build (required check) / build-backend (pull_request) Has been skipped
Details
PR build (required check) / build-frontend (pull_request) Has been skipped
Details
shell-lint / shellcheck (pull_request) Successful in 8s
Details
PR build (required check) / validate-observability (pull_request) Has been skipped
Details
PR build (required check) / gate (pull_request) Successful in 2s
Details

Browse source 
Found while checking live status: beta's thermograph-daemon container was
still running an old backend image tag while backend/lake had rolled
forward twice. Reproduced directly against the host rather than guessing --
`docker compose config --images daemon` does NOT filter to the named
service on this host's Compose v5.3.1: it prints every service's image,
one per line, in file order, so `| head -1` was silently grabbing db's
image (timescaledb) instead of daemon's. The probe then always found no
/usr/local/bin/thermograph-daemon in a Postgres image and concluded "this
image predates the daemon binary," dropping daemon from every single
backend deploy regardless of what the real backend image actually
contained -- the exact /internal/* version-skew this guard was written to
prevent, caused by the guard itself.

Fixed by building the image reference directly from the same vars
docker-compose.yml's daemon.image: already interpolates
(REGISTRY_HOST/BACKEND_IMAGE_PATH/BACKEND_IMAGE_TAG) instead of going
through `docker compose config` at all -- no dependency on that command's
filtering behavior, and it can't disagree with what compose will actually
run.

Verified directly against beta: the old code's exact command sequence
reproduced with real secrets sourced, confirmed the wrong (db) image was
selected; the new construction resolves to the correct backend image and
the binary probe passes.
This commit is contained in:
Emi Griffith 2026-07-23 21:02:33 -07:00
parent b83bfdbd67
commit cf0fa01892
1 changed files with 11 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
infra/deploy/deploy.sh
View file

@ -247,9 +247,17 @@ fi
# next deploy of a tag that has it picks it up with no further action. # next deploy of a tag that has it picks it up with no further action.
case " ${TARGETS[*]} " in case " ${TARGETS[*]} " in
*" daemon "*) *" daemon "*)
daemon_img="$(docker compose config --images daemon 2>/dev/null | head -1 || true)" # Built directly from the same vars docker-compose.yml's `daemon.image:`
if [ -n "$daemon_img" ] \ # interpolates (REGISTRY_HOST/BACKEND_IMAGE_PATH/BACKEND_IMAGE_TAG),
&& ! docker run --rm --entrypoint sh "$daemon_img" -c 'test -x /usr/local/bin/thermograph-daemon' 2>/dev/null; then # NOT via `docker compose config --images daemon`: that command does not
# actually filter to the named service (confirmed live on Compose
# v5.3.1 -- it prints every service's image, one per line, in file
# order) so `| head -1` silently grabbed db's image instead. The probe
# then always found no daemon binary in a Postgres image and dropped
# daemon from EVERY backend deploy, regardless of what the real backend
# image contained -- reproduced and confirmed against beta directly.
daemon_img="${REGISTRY_HOST:-git.thermograph.org}/${BACKEND_IMAGE_PATH:-emi/thermograph/backend}:${BACKEND_IMAGE_TAG}"
if ! docker run --rm --entrypoint sh "$daemon_img" -c 'test -x /usr/local/bin/thermograph-daemon' 2>/dev/null; then
echo "==> $daemon_img predates the daemon binary; rolling without the daemon service this run" echo "==> $daemon_img predates the daemon binary; rolling without the daemon service this run"
kept=() kept=()
for t in "${TARGETS[@]}"; do for t in "${TARGETS[@]}"; do