fix: push supplemental images on release builds again (0.3.5 regression) #35

2026-10-13T22:05:40Z

KofTwentyTwo commented

2026-10-13 22:05:40 +00:00

(Migrated from github.com)

Regression in 0.3.5: supplemental images (db-backup, migrations, geoip, ...) are built and scanned on release builds but never pushed. kof22 0.1.75 went into ImagePullBackOff; its docker job log ends with All supplemental images built and scanned (push=1).

Root cause: #32 added a boolean push parameter (default true) passed as PUSH_IMAGES: << parameters.push >>. CircleCI renders it as 1/0 in the step environment, but the script only pushed when PUSH_IMAGES was the string true.

Fix: build_push_supplemental.sh normalizes the value: true|1|yes|on pushes, false|0|no|off|empty doesn't, unset still means push (release behavior as in 0.3.4), and anything else fails before building. The scan still runs and gates before any push. Only the PR docker_scan job sets push: false.

Tests (tests/test_docker_scan.sh, 12/12 locally):

release mode with PUSH_IMAGES 1, true or TRUE pushes every supplemental image (version and environment tags);
PR mode with 0, false or empty pushes nothing;
an invalid value fails without building;
the existing HIGH/CRITICAL gate tests still pass.

Then: release 0.3.6, and a Website-Backend orb bump 0.3.4 → 0.3.6.

🤖 Generated with Claude Code

**Regression in 0.3.5:** supplemental images (db-backup, migrations, geoip, ...) are built and scanned on release builds but **never pushed**. kof22 0.1.75 went into ImagePullBackOff; its docker job log ends with `All supplemental images built and scanned (push=1)`. **Root cause:** #32 added a boolean `push` parameter (default `true`) passed as `PUSH_IMAGES: << parameters.push >>`. CircleCI renders it as `1`/`0` in the step environment, but the script only pushed when `PUSH_IMAGES` was the string `true`. **Fix:** `build_push_supplemental.sh` normalizes the value: `true|1|yes|on` pushes, `false|0|no|off|empty` doesn't, unset still means push (release behavior as in 0.3.4), and anything else fails before building. The scan still runs and gates before any push. Only the PR `docker_scan` job sets `push: false`. **Tests** (`tests/test_docker_scan.sh`, 12/12 locally): - release mode with `PUSH_IMAGES` 1, true or TRUE pushes every supplemental image (version and environment tags); - PR mode with 0, false or empty pushes nothing; - an invalid value fails without building; - the existing HIGH/CRITICAL gate tests still pass. Then: release 0.3.6, and a Website-Backend orb bump 0.3.4 → 0.3.6. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/Munitor#35