ivuorinen/turingpi-cluster
Watch
1
0
Fork
You've already forked turingpi-cluster
 0
Code Issues 1 Pull requests 6 Activity Actions

fix: one post-upgrade command, and a dashboard that matches its pin #63

Merged
ivuorinen merged 1 commit from ivuorinen/fix/postupgrade-needs-no-shell into main 2026-09-27 02:17:05 +00:00 AGit
Conversation 0 Commits 1 Files changed 6 +121 -26
ivuorinen commented 2026-09-27 02:12:35 +00:00
Owner
Copy link

Renovate spawns postUpgradeTasks commands directly rather than through a
shell, so REFRESH_CHECKSUMS=1 ./script && ./script was taken as an
executable named "REFRESH_CHECKSUMS=1" and failed with spawn ENOENT.

Replacing it with one invocation exposed a second fault: the generated
ConfigMap stamped # sha256: with the pin it was expecting, not the bytes
fetch() had downloaded. Under --refresh those differ, because the pins in
the script are rewritten only at the end of the run — so a single run left
the ConfigMap naming a checksum the script no longer contained. That is
what the second invocation had been quietly repairing.

fetch() now records the digest of the bytes it supplies, beside the cached
archive so every dashboard reading one tarball reports the same value, and
the ConfigMap carries that. tests/version-sync.bats gains the pairing that
was missing: the existing check compares the source URL, never the digest
next to it.

docs/07-monitoring.md and docs/11-renovate.md still said Renovate could not
bump these pins and did not manage them, which stopped being true in #57.

Renovate spawns postUpgradeTasks commands directly rather than through a shell, so `REFRESH_CHECKSUMS=1 ./script && ./script` was taken as an executable named "REFRESH_CHECKSUMS=1" and failed with spawn ENOENT. Replacing it with one invocation exposed a second fault: the generated ConfigMap stamped `# sha256:` with the pin it was expecting, not the bytes fetch() had downloaded. Under --refresh those differ, because the pins in the script are rewritten only at the end of the run — so a single run left the ConfigMap naming a checksum the script no longer contained. That is what the second invocation had been quietly repairing. fetch() now records the digest of the bytes it supplies, beside the cached archive so every dashboard reading one tarball reports the same value, and the ConfigMap carries that. tests/version-sync.bats gains the pairing that was missing: the existing check compares the source URL, never the digest next to it. docs/07-monitoring.md and docs/11-renovate.md still said Renovate could not bump these pins and did not manage them, which stopped being true in #57.
fix: one post-upgrade command, and a dashboard that matches its pin
All checks were successful
validate / render (pull_request) Successful in 1m16s
Details
validate / hooks (pull_request) Successful in 2m14s
Details
7964278900 
Renovate spawns postUpgradeTasks commands directly rather than through a
shell, so `REFRESH_CHECKSUMS=1 ./script && ./script` was taken as an
executable named "REFRESH_CHECKSUMS=1" and failed with spawn ENOENT.

Replacing it with one invocation exposed a second fault: the generated
ConfigMap stamped `# sha256:` with the pin it was expecting, not the bytes
fetch() had downloaded. Under --refresh those differ, because the pins in
the script are rewritten only at the end of the run — so a single run left
the ConfigMap naming a checksum the script no longer contained. That is
what the second invocation had been quietly repairing.

fetch() now records the digest of the bytes it supplies, beside the cached
archive so every dashboard reading one tarball reports the same value, and
the ConfigMap carries that. tests/version-sync.bats gains the pairing that
was missing: the existing check compares the source URL, never the digest
next to it.

docs/07-monitoring.md and docs/11-renovate.md still said Renovate could not
bump these pins and did not manage them, which stopped being true in #57.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
ivuorinen/turingpi-cluster!63
No description provided.