Repository navigation
fix(managed): unblock GCP image mirroring and project preflight - #6212
Conversation
Signed-off-by: Guillaume Loret <guillaume@openworklabs.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. 4 Skipped Deployments
|
GitHub Actions
Inactive
OpenWork evidence
Run details · Open the preview to inspect evidence and sandbox options. |
![diff-warden[bot]](https://avatars.githubusercontent.com/u/118544361?s=60&v=4){kind=small}
There was a problem hiding this comment.
Warden clearance. Complete security and confidentiality review of ce9127926fdbdc627bc3c2aceea5bf228c308e95 found no high or medium security findings and no confidentiality findings. Any new push dismisses this approval. Analysis run
Warden: approvedNo high or medium security findings and no confidentiality findings. Reviewed |
Signed-off-by: Guillaume Loret <guillaume@openworklabs.com>
GitHub Actions
Inactive
There was a problem hiding this comment.
Warden clearance. Complete security and confidentiality review of 5a410419eee2a7e875e6f45d68e0dd4f58d73d99 found no high or medium security findings and no confidentiality findings. Any new push dismisses this approval. Analysis run
yomgui
changed the title
GitHub Actions
Inactive
Summary
Managed Google Cloud installs can fail at image mirroring because Docker reports an official image as
python@sha256:…while the verified source isdocker.io/library/python@sha256:…. Found live: the correct Linux/amd64 health image was rejected by the string-only comparison. Normalize Docker Hub registry/default-namespace aliases while retaining exact repository and digest equality. A second live-found failure exposed a missing prerequisite: bootstrap now enablescloudresourcemanager.googleapis.combefore Terraform'sdata.google_projectlookup.This changes only the existing GCP bootstrap/mirror runner and their regression tests. It contains no shared-module adoption, provider, IAM, launcher, image-pin or rollout changes. Other registries and all platform, immutable-ID and destination-digest checks remain strict. No runner permission is broadened and the missing API is not manually pre-enabled as a workaround. This does not certify a successful live install; shared-module adoption remains separate.
Verification
python -m unittest discover -s infra/managed-deployments/tests -p 'test_gcp*.py').data.google_project.targetand previously omitted the required API.For isolated comparison, this commit is labelled dev + fixes (digest normalization + required API), not an unmodified published-release baseline.