• v1.8.9 aac4a1c323

    release: v1.8.9 — the version flag that blamed the wrong component
    Lint / hadolint (push) Successful in 15s
    Lint / actionlint (push) Successful in 18s
    Publish Docker Image / resolve-versions (push) Successful in 9s
    Publish Docker Image / base-decide (push) Successful in 9s
    Publish Docker Image / build-base (push) Successful in 41m49s
    Publish Docker Image / smoke (push) Successful in 4m51s
    Publish Docker Image / smoke-studio (push) Successful in 4m59s
    Publish Docker Image / build-variant-studio (push) Successful in 16m58s
    Publish Docker Image / build-variant (push) Successful in 28m35s
    Publish Docker Image / update-description (push) Successful in 7s
    Publish Docker Image / promote-base-latest (push) Successful in 17s

    joakimp released this 2026-08-26 18:47:03 +02:00 | 69 commits to main since this release

    Two versions, two flags. --expected-version has only ever asserted
    pi --version, but AGENTS.md step 4 spelled it X.Y.Z inside a checklist where
    every other X.Y.Z is the pi-devbox tag. Run as documented for v1.8.8 the final
    runtime gate of the release printed

    ✗ pi version mismatch: expected 1.8.8, got 0.84.3
    

    and exited 1 — a red accusing the image of being the wrong version. Not one
    reader's slip: the v1.8.8 release-readiness handoff from pi@emb-7kj4vr4g
    propagated the same wrong spelling twice while correctly calling step 4 "not
    ceremonial", so two independent readers converged on it. README.md had it right
    all along, which means the two documents disagreed.

    • new --expected-image-version asserts the pi-devbox release tag, read from
      release_tag in /etc/pi-devbox/build-manifest.json (no checkout, no network);
      leading v optional on either side
    • both flags detect being handed the other one's value, and the test is exact
      rather than heuristic: the value is compared against the other quantity the
      image itself reports, so it can only fire on a real mix-up
    • neither flag is required now. With none, live pi --version is asserted
      against the manifest's pi_version — not a tautology, since a stale pi in the
      ~/.pi/npm-global volume can shadow the baked one, exactly as a stale
      npm:pi-atelier can in packages[]
    • the header note replaced was stale and load-bearing: it claimed pi is resolved
      from 'latest' and cannot be self-derived, while Dockerfile.variant pins
      ARG PI_VERSION=0.84.3 and docker-publish.yml reads that ARG as its source of
      truth. The same withdrawn claim also sat in cli_utils' pi-devbox-sanity --help
    • argument parsing: a missing value, or a value that is another flag, is a usage
      error instead of silently consuming the next argument; --help works

    All fourteen flag combinations exercised by execution, including the two
    manifest-absent branches and the shadowing branch a healthy container cannot
    reach — mutation-tested with a doctored manifest so each failure branch was
    observed firing rather than assumed present.

    CHANGELOG also names what no commit here causes: mempalace-toolkit main moved
    e70bef2 -> 5b8d78f, so this tag ships the auto-delivered logstream mailbox
    because base_tag folds the resolved toolkit SHA. It would have landed either
    way; going unnamed is the 553d865 shape that already caused one cross-host
    misattribution. Component audit found nothing else to bump — pi, mempalace,
    pi-atelier all equal their upstream latest, and every other floating ref
    resolves to the commit already baked.

    Downloads