Aman-Mittal opened a new issue, #628:
URL: https://github.com/apache/fineract-backoffice-ui/issues/628
## Summary
Both Compose files used by the E2E stack pin the backend by a floating tag:
- `deploy/docker-compose.yml:49` — `image: apache/fineract:latest`
- `deploy/docker-compose-e2e.yml:36` — `image: apache/fineract:latest`
`scripts/e2e-stack.sh` brings that up, and the `backend` and `two-factor`
Playwright projects run against it. So the backend under test is whatever
`latest` pointed at when the runner pulled, and it can change without any
commit in this repository.
## Why it matters
Two distinct costs, and the second is the expensive one:
1. **A green PR can go red on a rerun, with no diff.** An upstream Fineract
push changes behaviour, and the failure surfaces in whichever PR happens to run
next — attributed to that author's change.
2. **It makes after-the-fact diagnosis impossible.** When a real-Fineract
test fails, "did the backend change?" cannot be answered from the repository.
You can check Docker Hub's `last_updated` for the tag, but only for the
*current* `latest` — there is no record of which digest a past run actually
used, so a red run from last week can never be explained.
This came up while diagnosing a real-Fineract failure on #625. Checking
Docker Hub showed `latest` was last pushed `2026-09-25T21:25Z`, which happened
to rule the backend out — but only because the push predated every run in
question. Had it landed mid-window, there would have been no way to confirm or
deny it.
## Suggested fix
Pin by digest and record it:
```yaml
image: apache/fineract@sha256:<digest>
```
A digest is immutable, so a run is reproducible and a backend upgrade
becomes a reviewable commit that CI validates like any other. If tracking
upstream closely matters more than reproducibility, a scheduled job that bumps
the digest and opens a PR keeps both — the same shape as the existing spec-sync
workflow.
At minimum, the E2E job should print the resolved digest (`docker inspect
--format '{{index .RepoDigests 0}}' apache/fineract:latest`) so a past run's
logs say what it tested against.
## Scope
Not urgent and not a bug in the application. It is CI reproducibility, and
the cost is paid at the worst moment — while someone is trying to work out
whether a red run is theirs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
