timothy/ersatztv
1
0
Fork 0
Code Issues 54 Pull Requests 6 Actions Packages Projects Releases 9 Wiki Activity

docker/ci/Dockerfile's FFMPEG-bump comment still says a push publishes — and cannot be fixed on its own #854

New Issue
Open
opened 2026-08-27 20:18:44 +02:00 by timothy · 0 comments
timothy commented 2026-08-27 20:18:44 +02:00
Owner
Copy Link
Copy Source

Split out of #744, which corrected every other site but had to leave this one.

The stale lines — there are TWO, and the second is the more misleading

(a) docker/ci/Dockerfile ~line 95 (the PLAYWRIGHT_VERSION bump comment):

# when it does, bump this ARG, let ci-image.yml publish the new :<sha>, then update the five

(b) docker/ci/Dockerfile ~lines 20-22 (the rebase warning):

# Re-dispatching ci-image.yml does not help — it tags the branch HEAD, not this commit.

(b) was true when a docker/ci push republished automatically, so a dispatch was the inferior route.
Since #744 the dispatch is the only branch-side publish path, and it works exactly as
docs/ci-cd.md describes provided the docker/ci commit is at HEAD — which is the whole recovery
procedure. As written the comment tells the reader the one thing that works is useless.

Since #744 (ci.toolchain-image-publish-is-a-dispatch) a branch push publishes nothing: ci-image.yml is branches: [main], and publishing from a branch is a workflow_dispatch with the docker/ci commit as HEAD. Someone following this comment bumps the ARG, pushes, and waits for an image that never appears.

Why #744 did not just fix it

Editing any byte of docker/ci/** — a comment included — re-points ci-image-pin's expected at the editing commit, so all five container: pins in docker-build.yml go stale and a blocking job fails. Fixing a comment therefore costs a full toolchain publish-and-repin, and a rebase makes you redo it. #744 verified this on itself: the one-line comment fix was made, reddened the pin, and was reverted.

That is worth recording as a property, not just an inconvenience: docker/ci/** has no cheap-edit path. Prose in that directory is as expensive to change as the image itself.

Do this

Ride it with the next genuine toolchain bump (an FFmpeg or SDK version change, a Renovate base bump), where the publish-and-repin is being paid for anyway. Do not raise a PR whose only content is this comment.

Alternatives, if it keeps being deferred: move the instruction out of the Dockerfile into docs/ci-cd.md and leave a one-line pointer (still a docker/ci edit, but paid once and then never again), or accept it and rely on the ci-cd.md text the comment already points at.

Done-when

  • The comment names the dispatch path, or the instruction moved out of docker/ci/** with a pointer left behind
  • ci-image-pin green (the publish-and-repin completed as part of whatever change carries this)
  • Adversarial review passed
Split out of #744, which corrected every other site but had to leave this one. ## The stale lines — there are TWO, and the second is the more misleading **(a) `docker/ci/Dockerfile` ~line 95** (the `PLAYWRIGHT_VERSION` bump comment): > `# when it does, bump this ARG, let ci-image.yml publish the new :<sha>, then update the five` **(b) `docker/ci/Dockerfile` ~lines 20-22** (the rebase warning): > `# Re-dispatching ci-image.yml does not help — it tags the branch HEAD, not this commit.` (b) was true when a `docker/ci` push republished automatically, so a dispatch was the inferior route. Since #744 the dispatch **is** the only branch-side publish path, and it works exactly as `docs/ci-cd.md` describes provided the `docker/ci` commit is at HEAD — which is the whole recovery procedure. As written the comment tells the reader the one thing that works is useless. Since #744 (`ci.toolchain-image-publish-is-a-dispatch`) a branch **push** publishes nothing: `ci-image.yml` is `branches: [main]`, and publishing from a branch is a `workflow_dispatch` with the `docker/ci` commit as HEAD. Someone following this comment bumps the ARG, pushes, and waits for an image that never appears. ## Why #744 did not just fix it Editing **any** byte of `docker/ci/**` — a comment included — re-points `ci-image-pin`'s `expected` at the editing commit, so all five `container:` pins in `docker-build.yml` go stale and a **blocking** job fails. Fixing a comment therefore costs a full toolchain publish-and-repin, and a rebase makes you redo it. #744 verified this on itself: the one-line comment fix was made, reddened the pin, and was reverted. That is worth recording as a property, not just an inconvenience: **`docker/ci/**` has no cheap-edit path.** Prose in that directory is as expensive to change as the image itself. ## Do this Ride it with the **next genuine toolchain bump** (an FFmpeg or SDK version change, a Renovate base bump), where the publish-and-repin is being paid for anyway. Do not raise a PR whose only content is this comment. Alternatives, if it keeps being deferred: move the instruction out of the Dockerfile into `docs/ci-cd.md` and leave a one-line pointer (still a `docker/ci` edit, but paid once and then never again), or accept it and rely on the ci-cd.md text the comment already points at. ## Done-when - [ ] The comment names the dispatch path, or the instruction moved out of `docker/ci/**` with a pointer left behind - [ ] `ci-image-pin` green (the publish-and-repin completed as part of whatever change carries this) - [ ] Adversarial review passed
timothy added the ci-cdpriority: low labels 2026-08-27 20:18:54 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
ad-hoc
One-off / ad-hoc work not tracked by a dedicated issue
 api
REST API / HTTP endpoints
 bug
Something isn't working
 ci-cd
Build, test, deploy pipeline
 content
Channel content / schedules / playlists
 dependencies
Dependency updates (Renovate)
 enhancement
New feature or improvement
 frontend
ChicoryTV React SPA frontend
 in-progress
Claimed by an active session — do not pick up
 jellyfin
Jellyfin tuner / IPTV integration
 parked
Excluded from automatic queue pickup; work only when explicitly selected
 priority: high
priority: low
priority: medium
review
Adversarial review finding
 security
Security / vulnerability fix
No labels ci-cd priority: low
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
renovate timothy (Timothy)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: timothy/ersatztv#854