joakimp
34cae2a1d2
ALL FOUR releases v0.74.0 -> v0.75.5 had been shipping the same image bytes due to a Docker layer-cache hit on the bare 'npm install -g @earendil-works/pi-coding-agent' command (when PI_VERSION=latest). The command string is identical across builds, so the layer-hash is identical, so registry buildcache (cache-from/cache-to) silently reuses the layer from whatever pi version was current when the cache was first populated. Verification: docker manifest inspect joakimp/pi-devbox:vX.Y.Z showed identical SHA256 digests on both linux/amd64 and linux/arm64 for v0.74.0, v0.75.3, v0.75.4, v0.75.5. Users on :latest were getting whatever pi version was baked into the v0.74.0 build. DISCOVERED 2026-05-23 by user trying to update pi-devbox on MBP-M1 and seeing pi 0.74.0 reported despite pulling v0.75.5. CHANGES .gitea/workflows/docker-publish.yml — both smoke and publish jobs get a new 'Resolve PI_VERSION from tag' step that strips the leading 'v' and any trailing letter suffix from github.ref_name. Result is passed as a build-arg to docker/build-push-action so the npm install layer's hash includes the concrete version, forcing cache miss when pi bumps. scripts/smoke-test.sh — new run_expect helper that asserts pi --version contains the EXPECTED_PI_VERSION env var. Smoke job sets this from the resolve step output. Would have caught this regression on v0.75.3. Dockerfile — comment block above ARG PI_VERSION=latest documenting the cache-hit footgun. The 'if latest' branch in the install RUN is preserved for local dev convenience but never fires in CI now. AGENTS.md — new convention bullet explaining the cache-hit class of bug and noting the latent same-bug in opencode-devbox's with-pi variants (currently masked by OPENCODE_VERSION bumps; will manifest when cutting a vN.N.Nb-style opencode-version-unchanged release that only bumps pi). CHANGELOG.md — full entry under v0.75.5b describing the recovery, the silent-failure mechanism, and the verification steps. NO IMAGE-CONTENT CHANGES vs v0.75.5 INTENT. This build produces the actual pi 0.75.5 image content that v0.75.5 was supposed to ship. NEXT FOLLOWUP (parked, not in this commit) opencode-devbox should get the same workflow change for its build-variant-with-pi and build-variant-omos-with-pi jobs. Currently masked because every release also bumps OPENCODE_VERSION which invalidates the cache, but that masking would fail on a pi-only bump release.
62 lines
2.9 KiB
Docker
62 lines
2.9 KiB
Docker
# pi-devbox — pi coding-agent container
|
|
#
|
|
# Builds on top of the opencode-devbox base image, which provides:
|
|
# Debian trixie, Node.js, AWS CLI, mempalace + MCP server, gitea-mcp,
|
|
# dev tools (neovim, tmux, bat, eza, fzf, zoxide, ripgrep, uv, rustup),
|
|
# user setup (developer/gosu), entrypoints, chromadb prewarm.
|
|
#
|
|
# This image adds only pi itself and its companion repos.
|
|
#
|
|
# Build args:
|
|
# BASE_IMAGE — base image to build from (default: base-latest)
|
|
# PI_VERSION — pi npm version: "latest" or a pinned version e.g. "0.74.0"
|
|
# PI_TOOLKIT_REF — git ref for pi-toolkit (default: main)
|
|
# PI_EXTENSIONS_REF — git ref for pi-extensions (default: main)
|
|
|
|
ARG BASE_IMAGE=joakimp/opencode-devbox:base-latest
|
|
FROM ${BASE_IMAGE}
|
|
|
|
# PI_VERSION should be passed explicitly by CI as a concrete version
|
|
# (e.g. PI_VERSION=0.75.5, derived from the git tag). The default `latest`
|
|
# is for local dev convenience only — it has a known cache-hit footgun
|
|
# when used in registry-cached CI builds. See .gitea/workflows/docker-
|
|
# publish.yml § "Resolve PI_VERSION from tag" and AGENTS.md gotcha for
|
|
# the full story (silent same-bytes-across-releases regression discovered
|
|
# 2026-05-23 affecting all builds v0.74.0..v0.75.5).
|
|
ARG PI_VERSION=latest
|
|
ARG PI_TOOLKIT_REF=main
|
|
ARG PI_EXTENSIONS_REF=main
|
|
|
|
# Install pi and clone companion repos.
|
|
# NPM_CONFIG_PREFIX is overridden to /usr so the baked binary lands at the
|
|
# system prefix — same pattern as opencode-devbox's variant Dockerfile.
|
|
# At runtime, NPM_CONFIG_PREFIX is reset to /home/developer/.pi/npm-global
|
|
# (inherited from base ENV) so user-installed packages land on the named
|
|
# volume and survive container recreate.
|
|
#
|
|
# git clone is wrapped in a retry loop because gitea.jordbo.se occasionally
|
|
# returns transient HTTP 500s on the first request after idle.
|
|
RUN set -e && \
|
|
git_clone_retry() { \
|
|
url="$1"; ref="$2"; dest="$3"; \
|
|
for i in 1 2 3 4 5; do \
|
|
if git clone --depth 1 --branch "$ref" "$url" "$dest"; then return 0; fi; \
|
|
rm -rf "$dest"; \
|
|
echo "git clone $url failed (attempt $i/5), retrying in $((i*5))s..."; \
|
|
sleep $((i*5)); \
|
|
done; \
|
|
return 1; \
|
|
} && \
|
|
if [ "${PI_VERSION}" = "latest" ]; then \
|
|
NPM_CONFIG_PREFIX=/usr npm install -g @earendil-works/pi-coding-agent ; \
|
|
else \
|
|
NPM_CONFIG_PREFIX=/usr npm install -g @earendil-works/pi-coding-agent@${PI_VERSION} ; \
|
|
fi && \
|
|
pi --version && \
|
|
git_clone_retry https://gitea.jordbo.se/joakimp/pi-toolkit.git "${PI_TOOLKIT_REF}" /opt/pi-toolkit && \
|
|
git_clone_retry https://gitea.jordbo.se/joakimp/pi-extensions.git "${PI_EXTENSIONS_REF}" /opt/pi-extensions && \
|
|
echo "pi-toolkit at $(cd /opt/pi-toolkit && git rev-parse --short HEAD)" && \
|
|
echo "pi-extensions at $(cd /opt/pi-extensions && git rev-parse --short HEAD)"
|
|
|
|
# WORKDIR / ENTRYPOINT / CMD inherited from base.
|