-
release: v1.8.9 — the version flag that blamed the wrong component
Lint / hadolint (push) Successful in 15sLint / actionlint (push) Successful in 18sPublish Docker Image / resolve-versions (push) Successful in 9sPublish Docker Image / base-decide (push) Successful in 9sPublish Docker Image / build-base (push) Successful in 41m49sPublish Docker Image / smoke (push) Successful in 4m51sPublish Docker Image / smoke-studio (push) Successful in 4m59sPublish Docker Image / build-variant-studio (push) Successful in 16m58sPublish Docker Image / build-variant (push) Successful in 28m35sPublish Docker Image / update-description (push) Successful in 7sPublish Docker Image / promote-base-latest (push) Successful in 17sreleased this
2026-08-26 18:47:03 +02:00 | 69 commits to main since this releaseTwo versions, two flags.
--expected-versionhas only ever asserted
pi --version, but AGENTS.md step 4 spelled itX.Y.Zinside a checklist where
every other X.Y.Z is the pi-devbox tag. Run as documented for v1.8.8 the final
runtime gate of the release printed✗ pi version mismatch: expected 1.8.8, got 0.84.3and exited 1 — a red accusing the image of being the wrong version. Not one
reader's slip: the v1.8.8 release-readiness handoff from pi@emb-7kj4vr4g
propagated the same wrong spelling twice while correctly calling step 4 "not
ceremonial", so two independent readers converged on it. README.md had it right
all along, which means the two documents disagreed.- new --expected-image-version asserts the pi-devbox release tag, read from
release_tag in /etc/pi-devbox/build-manifest.json (no checkout, no network);
leadingvoptional on either side - both flags detect being handed the other one's value, and the test is exact
rather than heuristic: the value is compared against the other quantity the
image itself reports, so it can only fire on a real mix-up - neither flag is required now. With none, live
pi --versionis asserted
against the manifest's pi_version — not a tautology, since a stale pi in the
~/.pi/npm-global volume can shadow the baked one, exactly as a stale
npm:pi-atelier can in packages[] - the header note replaced was stale and load-bearing: it claimed pi is resolved
from 'latest' and cannot be self-derived, while Dockerfile.variant pins
ARG PI_VERSION=0.84.3 and docker-publish.yml reads that ARG as its source of
truth. The same withdrawn claim also sat in cli_utils' pi-devbox-sanity --help - argument parsing: a missing value, or a value that is another flag, is a usage
error instead of silently consuming the next argument; --help works
All fourteen flag combinations exercised by execution, including the two
manifest-absent branches and the shadowing branch a healthy container cannot
reach — mutation-tested with a doctored manifest so each failure branch was
observed firing rather than assumed present.CHANGELOG also names what no commit here causes: mempalace-toolkit main moved
e70bef2 -> 5b8d78f, so this tag ships the auto-delivered logstream mailbox
because base_tag folds the resolved toolkit SHA. It would have landed either
way; going unnamed is the 553d865 shape that already caused one cross-host
misattribution. Component audit found nothing else to bump — pi, mempalace,
pi-atelier all equal their upstream latest, and every other floating ref
resolves to the commit already baked.Downloads
- new --expected-image-version asserts the pi-devbox release tag, read from