feat: /etc/ci-image-id marker for runtime validation #2

Merged

john merged 1 commit from feat/image-identity-marker into main

2026-07-19 03:28:19 +00:00

john commented

2026-07-19 03:24:34 +00:00

Owner

Adds an identity marker file to the CI image. Workflow guard steps check for this file to detect when the act_runner fell back to the default node:22-bookworm image (registry pull failure).

What it does

Writes /etc/ci-image-id at build time with image metadata (name, base, build date, tool versions). Guard steps in repo workflows check for this file as their first action — if missing, they emit an [INFRA] error annotation and exit 78, clearly signaling 'retry, don't fix code.'

Why

When the Forgejo registry has transient 525 SSL errors, the runner falls back to node:22-bookworm silently. Agents then see 'docker: command not found' or 'uv: command not found' and try to fix the code. This marker makes the failure self-diagnosing.

Deploy steps after merge

Rebuild the image on a self-hosted runner (CI does this automatically)
Run scripts/pull-all-runners.sh to distribute to forge + tiki
Verify: ssh forge 'docker run --rm forgejo-ci:latest cat /etc/ci-image-id'

Adds an identity marker file to the CI image. Workflow guard steps check for this file to detect when the act_runner fell back to the default node:22-bookworm image (registry pull failure). ## What it does Writes /etc/ci-image-id at build time with image metadata (name, base, build date, tool versions). Guard steps in repo workflows check for this file as their first action — if missing, they emit an [INFRA] error annotation and exit 78, clearly signaling 'retry, don't fix code.' ## Why When the Forgejo registry has transient 525 SSL errors, the runner falls back to node:22-bookworm silently. Agents then see 'docker: command not found' or 'uv: command not found' and try to fix the code. This marker makes the failure self-diagnosing. ## Deploy steps after merge 1. Rebuild the image on a self-hosted runner (CI does this automatically) 2. Run scripts/pull-all-runners.sh to distribute to forge + tiki 3. Verify: ssh forge 'docker run --rm forgejo-ci:latest cat /etc/ci-image-id'

john added 1 commit

2026-07-19 03:24:34 +00:00

feat: add /etc/ci-image-id marker for runtime image validation 7526610097

Allows CI workflow guard steps to detect when the runner fell back
to node:22-bookworm due to a registry pull failure. Without this
marker, agents see cryptic 'command not found' errors instead of
a clear [INFRA] signal to retry.