potiuk opened a new pull request, #71746: URL: https://github.com/apache/airflow/pull/71746
The `airflow-pgbouncer-exporter` image builds upstream source fetched from a mutable git tag: ```dockerfile RUN URL="https://github.com/jbub/pgbouncer_exporter/archive/v${PGBOUNCER_EXPORTER_VERSION}.tar.gz"; \ && curl -L "${URL}" | tar -zx --strip-components 1 \ ``` `v0.18.0` is a **lightweight tag** — it points straight at a commit and can be force-moved to different content. `build_and_push.sh` pins only the version string (`0.18.0`), so if that tag were ever moved upstream, the next image rebuild would inherit the change with nothing in this repository differing. The tarball is also piped straight into `tar`, so it never lands on disk where it could be checked. The exporter container runs in the pgbouncer pod, which is mounted with the metadata-DB stats credentials and sits on the connection path to the metadata database, so it is worth being able to say exactly what went into it. ### Change Build from the commit the reviewed tag points at, rather than from the tag: ```dockerfile RUN URL="https://github.com/jbub/pgbouncer_exporter/archive/${PGBOUNCER_EXPORTER_COMMIT_SHA}.tar.gz"; \ ``` `PGBOUNCER_EXPORTER_COMMIT_SHA` sits next to `PGBOUNCER_EXPORTER_VERSION` in `build_and_push.sh` with a comment saying the two are updated together. The commit is also recorded as an image label, so a published image states which source it was built from. ### Why not a checksum The obvious move is to copy the sibling `pgbouncer` image, which does pin one: ```dockerfile RUN wget ... && echo "${PGBOUNCER_SHA256} pgbouncer-${VERSION}.tar.gz" | sha256sum -c - ``` That works there because it downloads an **uploaded release asset**, which is a stable file. This image downloads a GitHub **auto-generated archive**, and those are not guaranteed to be byte-stable — GitHub has changed archive generation before, which broke pinned checksums across the ecosystem. A sha256 here could fail the build without the source having changed. Pinning the commit gives the property actually wanted — the build no longer depends on a tag continuing to mean what it meant when reviewed — without that failure mode. If you would rather carry a checksum as well, it can go on top; I did not want to add a maintenance burden with a known false-positive mode without asking. ### Verification - Confirmed `v0.18.0` is a lightweight tag pointing at `1b1faecd80fdeb0f4d8baa0d423e8b58e4ab9aa5` (2024-10-10). - Confirmed the commit-pinned reference yields the **same 34-file set** as the tag, so this is not a content change. - Confirmed the archive still has a single top-level directory, so the existing `--strip-components 1` continues to apply. Not build-tested locally — building requires `docker buildx` with the multi-platform setup this script uses. The change is to the source URL and one build arg, so CI's image build is the real check. `lint-helm-chart` and `kubeconform` were skipped at commit time: both need a local `helm` binary that is not installed here, and both trigger on any `chart/**` path even though this change touches only `chart/dockerfiles/` and no chart templates. --- Generated-by: Claude Opus 5 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
