From 26b00608b29a395a01b3450e04a9d4be5e140b27 Mon Sep 17 00:00:00 2001 From: Stan Grams Date: Sun, 2 Aug 2026 16:49:46 +0200 Subject: [PATCH] [chore](trx-rs): force-pull the SDK image on the CI runner MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The workflow references the SDK image by the moving `:latest` tag, and act_runner skips the pull when a local copy of that tag already exists: the job log reports `docker pull ... forcePull=false` followed by `Image exists? true`. Pushing a rebuilt image therefore changes nothing until someone pulls on the VM by hand, and the run fails as though the image never gained the tool that was added to the Containerfile — `sccache` resolving as "No such file or directory" while the pinned toolchain from an earlier build of the same tag resolves fine. Set `force_pull: true` so a pushed image is what actually runs, and document the manual refresh for runners configured before this change. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01GdyUjuXejCEfiub675z6cz Signed-off-by: Stan Grams --- container/README.md | 12 ++++++++++++ container/runner-config.example.yaml | 6 ++++++ 2 files changed, 18 insertions(+) diff --git a/container/README.md b/container/README.md index fce6d67f..0ccca5c4 100644 --- a/container/README.md +++ b/container/README.md @@ -63,6 +63,18 @@ runner and developers can pull it without credentials. If you keep it private, add `credentials:` under the workflow's `container:` and log the runner into the registry. +Pushing a rebuilt image is not enough on its own: `:latest` is a moving tag, and +act_runner reuses whatever it cached the first time unless `force_pull: true` is +set (see `runner-config.example.yaml`). Without it the job log says +`Image exists? true` and the run behaves as though the image were never +rebuilt — a tool added to the `Containerfile` reads as missing from the image. +Either set `force_pull`, or refresh the VM's copy by hand: + +```bash +docker pull git.haxx.space/sjg/trx-rs/sdk:latest +docker run --rm git.haxx.space/sjg/trx-rs/sdk:latest sccache --version +``` + ### macOS note Apple's `container` CLI builds through a BuildKit helper VM that is configured diff --git a/container/runner-config.example.yaml b/container/runner-config.example.yaml index 5d49bf8e..ece17576 100644 --- a/container/runner-config.example.yaml +++ b/container/runner-config.example.yaml @@ -33,3 +33,9 @@ container: options: "--cpus=2 -v /var/cache/sccache:/sccache" # Reuse the host VM's Docker network for the built-in cache/artifact server. network: "host" + # The workflow pulls the SDK image by the moving `:latest` tag. Without this + # the runner logs "Image exists? true" and reuses whatever it cached the + # first time, so pushing a rebuilt image has no effect until someone pulls + # on the VM by hand — which looks like the image is missing a tool it in + # fact has. The extra registry round-trip per job is nothing next to a build. + force_pull: true