Stop optional image pruning after failed Tea login setup #2

2026-10-09T19:56:44Z

dfritz commented

2026-10-09 19:56:44 +00:00

Outcome

Failed cleanup login setup now emits only a fixed login_setup warning and stops before package listing or deletion, including when an earlier login exists. The existing optional continue-on-error semantics remain unchanged.

Changes

The production change guards the existing Tea login-add exit status. Its raw output remains suppressed; no credentials, authentication method, scopes, trust, or configuration are repaired or replaced. All other parsed action fields and the successful prune suffix are unchanged, including pagination, package/numeric-tag selection, retention, registry upload and local Docker cleanup. Tests use only a fake Tea executable and isolated disposable configuration.

Verification

The unchanged required local contract command passed all five tests with pinned PyYAML6.0.3. git diff --check and Bash syntax checks passed. Fake original-versus-repaired controls demonstrate that failed setup previously reached dependent package calls, including two fake deletions through a previous login; the repaired control issues none. Successful fake pagination, numeric ordering and keep=1/3/5 targets pass. No real cleanup action, Tea login, package operation, durable deletion, registry push or CI credentials were executed in local verification. Native PR CI remains required and is not claimed successful before its actual result.

Limits

This is a bounded failure-stage diagnostic and fail-stop safeguard, not a repair of the hidden login cause. The actual suppressed cause and runtime Tea state remain unknown. The existing v1 reference still targets older cc717790; this PR does not move release tags or consumer references, so merging main alone does not establish activation in existing v1 consumers. A preliminary disposable original-control harness assertion failed because unittest setUpClass reloaded the repaired source; the helper was corrected to execute the original control directly, and the valid original-versus-repaired results above were then observed.

Tracking

Ticket: https://agenthub.fritzlab.net/t-c1070dtgpqqy
Instance: ai-4d4kv6ydp9x8

Attribution

Authored-By: Codex (GPT-5) noreply@openai.com

## Outcome Failed cleanup login setup now emits only a fixed login_setup warning and stops before package listing or deletion, including when an earlier login exists. The existing optional continue-on-error semantics remain unchanged. ## Changes The production change guards the existing Tea login-add exit status. Its raw output remains suppressed; no credentials, authentication method, scopes, trust, or configuration are repaired or replaced. All other parsed action fields and the successful prune suffix are unchanged, including pagination, package/numeric-tag selection, retention, registry upload and local Docker cleanup. Tests use only a fake Tea executable and isolated disposable configuration. ## Verification The unchanged required local contract command passed all five tests with pinned PyYAML6.0.3. git diff --check and Bash syntax checks passed. Fake original-versus-repaired controls demonstrate that failed setup previously reached dependent package calls, including two fake deletions through a previous login; the repaired control issues none. Successful fake pagination, numeric ordering and keep=1/3/5 targets pass. No real cleanup action, Tea login, package operation, durable deletion, registry push or CI credentials were executed in local verification. Native PR CI remains required and is not claimed successful before its actual result. ## Limits This is a bounded failure-stage diagnostic and fail-stop safeguard, not a repair of the hidden login cause. The actual suppressed cause and runtime Tea state remain unknown. The existing v1 reference still targets older cc717790; this PR does not move release tags or consumer references, so merging main alone does not establish activation in existing v1 consumers. A preliminary disposable original-control harness assertion failed because unittest setUpClass reloaded the repaired source; the helper was corrected to execute the original control directly, and the valid original-versus-repaired results above were then observed. ## Tracking Ticket: https://agenthub.fritzlab.net/t-c1070dtgpqqy Instance: ai-4d4kv6ydp9x8 ## Attribution Authored-By: Codex (GPT-5) <noreply@openai.com>

dfritz added 1 commit 2026-10-09 19:56:44 +00:00

Stop package cleanup after failed Tea login setup

pr / contract (pull_request) Successful in 10s

Details

2d8a13840f

Emit a fixed credential-free login_setup warning and fail the optional prune
step before any dependent package API calls if its existing login setup fails.
Preserve successful pruning, retention, registry upload and local cleanup.

Exercise the extracted prune shell with fake Tea and disposable configuration,
including failed setup with a previous login and unchanged successful targets.
This identifies the failed stage, not the suppressed authentication cause.

Ticket: https://agenthub.fritzlab.net/t-c1070dtgpqqy

Authored-By: Codex (GPT-5) <noreply@openai.com>

architect approved these changes

2026-10-09 19:59:53 +00:00

architect left a comment

The failure boundary is now where the risk is: a failed tea login add used to be swallowed by || true and the step walked straight into package listing and deletion, including against a stale login left over from an earlier job on the same runner. Now the step checks the exit status itself, emits one fixed warning with no raw tea output, and exits before any dependent tea api call — verified by the fake-tea test for both a fresh and a pre-existing login marker. continue-on-error: true still lives on the step, so the job-level optional-cleanup contract is unchanged; this only tightens what counts as "skipped" instead of "best-effort continued with whatever credentials happen to be lying around". The registry credential (docker/login-action) and the Tea package-API credential stay on their own steps, so this doesn't blur ownership between push and prune. Pagination, numeric selection, and keep-retention are untouched and still covered by the success-path tests. Residual, correctly scoped out of this PR: the underlying cause of the login failure itself, and the fact that main moving does not retag the v1 reference, so existing v1 consumers won't see this fail-stop behavior until that reference is advanced.

The failure boundary is now where the risk is: a failed `tea login add` used to be swallowed by `|| true` and the step walked straight into package listing and deletion, including against a stale login left over from an earlier job on the same runner. Now the step checks the exit status itself, emits one fixed warning with no raw tea output, and exits before any dependent `tea api` call — verified by the fake-tea test for both a fresh and a pre-existing login marker. `continue-on-error: true` still lives on the step, so the job-level optional-cleanup contract is unchanged; this only tightens what counts as "skipped" instead of "best-effort continued with whatever credentials happen to be lying around". The registry credential (docker/login-action) and the Tea package-API credential stay on their own steps, so this doesn't blur ownership between push and prune. Pagination, numeric selection, and keep-retention are untouched and still covered by the success-path tests. Residual, correctly scoped out of this PR: the underlying cause of the login failure itself, and the fact that main moving does not retag the v1 reference, so existing v1 consumers won't see this fail-stop behavior until that reference is advanced.

dfritz merged commit 536765f5b9 into main

2026-10-09 20:06:22 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: action/image-push#2