Skip to content

ci(replace-wedding-standby): retry the database image pull on registry rate limits - #5855

Merged
devantler merged 2 commits into
mainfrom
claude/ci-retry-standby-image-pull-5514
Nov 4, 2026
Merged

devantler merged 2 commits into
mainfrom
claude/ci-retry-standby-image-pull-5514

Conversation

@devantler

Copy link
Copy Markdown
Contributor

Why

The standby-replacement safety job pulls one pinned database image with a single docker pull. On 28 October GHCR answered toomanyrequests for under a second during the merge-group run for #5500 (run 40693624595). That failed the job although nothing was wrong with the change, and the same thing can evict a merge-queue entry.

What

The pull now retries up to four times with a growing pause (10, 20, 30 seconds) and fails with an error only after the last attempt. It still pulls the same pinned digest, so the check examines the same image. The pauses fit well inside the job's 10-minute limit.

Validation

  • actionlint passes for the workflow.
  • I ran the step's actual script, taken from the workflow with yq, under bash -e with a fake docker and no sleeps. It succeeds with 1 call when the pull works, 3 calls after two failures and 4 calls after three failures. After four failures it stops with docker pull failed after 4 attempts and exit code 1.
  • This pull request's own run of the workflow exercises the real pull on GitHub's runner.

Fixes #5514

🤖 Generated with Claude Code

…y rate limits

GHCR briefly answered toomanyrequests on the merge-group run for #5500,
which failed the standby-replacement safety job although nothing was
wrong. Retry the pull of the same pinned digest up to four times with
backoff and fail only after the last attempt.

Fixes #5514

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@devantler

Copy link
Copy Markdown
Contributor Author

@codex review

🤖 Generated with Claude Code

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 3, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ⚠️ Failed 2026-11-04T15:24:05.030324Z
We couldn’t complete this review. Comment @codex review to try again.
c2688c9 Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 9b1bbd05bf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@devantler

devantler commented Nov 3, 2026 •

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Tried as a user, at 9b1bbd05. I took the step's actual script from the workflow with yq and ran it under bash -e with a fake docker and no sleeps:

Pull failures before success Calls Result
0 1 continues
2 3 continues
3 4 continues
4 4 ::error::docker pull failed after 4 attempts, exit 1

This PR's own run of the workflow does the real pull of the pinned digest on a GitHub runner.

🤖 Generated with Claude Code

@devantler

devantler commented Nov 3, 2026 •

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Status: held as a draft. The Codex review at the current head is clean. This change can't merge yet for two reasons outside it:

  1. Since 3 November every pull request here must pass the organization Validate Go Project workflow (Every pull request is blocked by the organization Go workflow since GitHub reclassified this repository as Go #5852). Its MegaLinter job scans the whole repository and currently fails on files this PR doesn't touch, as seen on fix(ci): validate against the current CRD catalogue again #5854 (betterleaks, checkov). ci: pass the organization Go workflow across the repository #5853 is fixing that.
  2. The merge queue already holds ten or more entries.

Next steps: once #5853 merges, update this branch from main, confirm every required check is green at the new head, re-request review at that head, then promote and enqueue it. Enqueue only one platform PR at a time, while platform-live-health.sh passes.

🤖 Generated with Claude Code

@github-actions

github-actions Bot commented Nov 3, 2026 •

Copy link
Copy Markdown
Contributor

✅⚠️MegaLinter analysis: Success with warnings

⚠️ BASH / bash-exec - 18 errors
ublish-workflow-approved-revisions.sh
✅ [SUCCESS] scripts/tests/test-publish-workflow-canonical-approvals.sh
✅ [SUCCESS] scripts/tests/test-publish-workflow-signing-revision-resolvers.sh
✅ [SUCCESS] scripts/tests/test-publish-workflow-signing-revisions.sh
✅ [SUCCESS] scripts/tests/test-pvc-prune-safety.sh
✅ [SUCCESS] scripts/tests/test-read-actual-budget-userns-maps.sh
✅ [SUCCESS] scripts/tests/test-read-cilium-api-limiter.sh
✅ [SUCCESS] scripts/tests/test-reassert-flux-root-verify.sh
✅ [SUCCESS] scripts/tests/test-redeploy-main-when-behind.sh
✅ [SUCCESS] scripts/tests/test-refresh-flux-ghcr-auth-safety.sh
✅ [SUCCESS] scripts/tests/test-regenerate-publish-workflow-approved-revisions.sh
✅ [SUCCESS] scripts/tests/test-registry-auth-lib.sh
✅ [SUCCESS] scripts/tests/test-release-recovery.sh
✅ [SUCCESS] scripts/tests/test-release-writer-refusal.sh
✅ [SUCCESS] scripts/tests/test-reloader-placement-selection.sh
✅ [SUCCESS] scripts/tests/test-reloader-rendered-placement.sh
✅ [SUCCESS] scripts/tests/test-report-kubescape-scan-orphans.sh
✅ [SUCCESS] scripts/tests/test-report-prod-convergence.sh
✅ [SUCCESS] scripts/tests/test-required-merge-workflows.sh
✅ [SUCCESS] scripts/tests/test-restart-uncapped-talos-coredns.sh
✅ [SUCCESS] scripts/tests/test-restore-stranded-prod-workflow.sh
✅ [SUCCESS] scripts/tests/test-restrict-homepage-service-groups.sh
✅ [SUCCESS] scripts/tests/test-restrict-tenant-network-policies.sh
✅ [SUCCESS] scripts/tests/test-restrict-tenant-secret-stores.sh
✅ [SUCCESS] scripts/tests/test-retire-arc-pool.sh
✅ [SUCCESS] scripts/tests/test-rgd-template-static-scan-wiring.sh
✅ [SUCCESS] scripts/tests/test-rgd-template-static-scan.sh
✅ [SUCCESS] scripts/tests/test-run-parallel-guard-cases.sh
✅ [SUCCESS] scripts/tests/test-run-publication-generator-tests.sh
✅ [SUCCESS] scripts/tests/test-setup-ksail.sh
✅ [SUCCESS] scripts/tests/test-setup-supply-chain-tools.sh
✅ [SUCCESS] scripts/tests/test-setup-talosctl.sh
✅ [SUCCESS] scripts/tests/test-shared-publish-workflow-pin-guard.sh
✅ [SUCCESS] scripts/tests/test-signing-report-publisher-families.sh
✅ [SUCCESS] scripts/tests/test-stranded-autoscaler-node-alerter.sh
✅ [SUCCESS] scripts/tests/test-stranded-volume-attach-alert.sh
✅ [SUCCESS] scripts/tests/test-summarize-sarif-findings.sh
✅ [SUCCESS] scripts/tests/test-talos-apparmor-lsm-regressions.sh
✅ [SUCCESS] scripts/tests/test-talos-apparmor-lsm.sh
✅ [SUCCESS] scripts/tests/test-talos-drain-budget.sh
✅ [SUCCESS] scripts/tests/test-talos-factory-schematic-registration.sh
✅ [SUCCESS] scripts/tests/test-talos-render-kernel-args.sh
✅ [SUCCESS] scripts/tests/test-talos-schematic-readback.sh
✅ [SUCCESS] scripts/tests/test-talos-version-pins.sh
✅ [SUCCESS] scripts/tests/test-tenant-controller-namespace-coverage.sh
✅ [SUCCESS] scripts/tests/test-tenant-edit-networkpolicy-write.sh
✅ [SUCCESS] scripts/tests/test-tenant-kro-pull-secret.sh
✅ [SUCCESS] scripts/tests/test-tenant-publication-binding.sh
✅ [SUCCESS] scripts/tests/test-tenant-route-hostname-boundary.sh
✅ [SUCCESS] scripts/tests/test-tenant-source-constructors.sh
✅ [SUCCESS] scripts/tests/test-tenant-source-discovery.sh
✅ [SUCCESS] scripts/tests/test-tenant-webapp-boundary.sh
✅ [SUCCESS] scripts/tests/test-tetragon-agent-priority.sh
✅ [SUCCESS] scripts/tests/test-tofu-controller-retirement.sh
✅ [SUCCESS] scripts/tests/test-trivyignore-configmap-content-boundary.sh
✅ [SUCCESS] scripts/tests/test-trivyignore-first-party-rbac-boundary.sh
✅ [SUCCESS] scripts/tests/test-trivyignore-private-mail-identity-boundary.sh
✅ [SUCCESS] scripts/tests/test-trivyignore-vault-backup-identity-boundary.sh
✅ [SUCCESS] scripts/tests/test-trivyignore-vault-config-identity-boundary.sh
✅ [SUCCESS] scripts/tests/test-trivyignore-vendored-operator-boundary.sh
✅ [SUCCESS] scripts/tests/test-umami-provisioning-bootstrap.sh
✅ [SUCCESS] scripts/tests/test-umami-rendered-placement.sh
✅ [SUCCESS] scripts/tests/test-umami-sso-dashboard-route.sh
✅ [SUCCESS] scripts/tests/test-umami-tracking-probe.sh
✅ [SUCCESS] scripts/tests/test-use-prod-stable-api-endpoint.sh
✅ [SUCCESS] scripts/tests/test-validate-homepage-bookmarks.sh
✅ [SUCCESS] scripts/tests/test-validate-image-verifier-liveness-workflow.sh
✅ [SUCCESS] scripts/tests/test-validate-image-verifier-liveness.sh
✅ [SUCCESS] scripts/tests/test-validate-kyverno-fixture-evaluation.sh
✅ [SUCCESS] scripts/tests/test-vault-snapshot-group-readable.sh
✅ [SUCCESS] scripts/tests/test-velero-cancellation-release.sh
✅ [SUCCESS] scripts/tests/test-velero-data-mover-resources.sh
✅ [SUCCESS] scripts/tests/test-velero-kopia-renovate-pin.sh
✅ [SUCCESS] scripts/tests/test-velero-maintenance-oom-alert.sh
✅ [SUCCESS] scripts/tests/test-velero-node-agent-priority.sh
✅ [SUCCESS] scripts/tests/test-verify-arc-transport.sh
✅ [SUCCESS] scripts/tests/test-verify-gateway-routes-applied.sh
✅ [SUCCESS] scripts/tests/test-verify-image-unsigned.sh
✅ [SUCCESS] scripts/tests/test-verify-matcher-accepts-digest.sh
✅ [SUCCESS] scripts/tests/test-verify-published-evidence.sh
✅ [SUCCESS] scripts/tests/test-verify-wedding-backup-cutover.sh
✅ [SUCCESS] scripts/tests/test-verify-wedding-backup-denial.sh
✅ [SUCCESS] scripts/tests/test-verify-wedding-shared-backup-coverage.sh
✅ [SUCCESS] scripts/tests/test-vpa-updater-event-rbac.sh
✅ [SUCCESS] scripts/tests/test-wait-for-prod-api-stability.sh
✅ [SUCCESS] scripts/tests/test-webapp-compiled-scan.sh
✅ [SUCCESS] scripts/tests/test-webapp-compiler-wiring.sh
✅ [SUCCESS] scripts/tests/test-webapp-compiler.sh
✅ [SUCCESS] scripts/tests/test-webapp-container-security.sh
✅ [SUCCESS] scripts/tests/test-webapp-inputs-wiring.sh
✅ [SUCCESS] scripts/tests/test-webapp-inputs.sh
✅ [SUCCESS] scripts/tests/test-webapp-runtime-hosted.sh
✅ [SUCCESS] scripts/tests/test-wedding-backup-denial-runtime.sh
✅ [SUCCESS] scripts/tests/test-world-zone-signatures.sh
✅ [SUCCESS] scripts/tests/test-world-zone-trial.sh
✅ [SUCCESS] scripts/tests/test-write-publish-workflow-matchers.sh
✅ [SUCCESS] scripts/update-vendored-operators.sh
✅ [SUCCESS] scripts/use-prod-stable-api-endpoint.sh
✅ [SUCCESS] scripts/validate-alert-coverage.sh
✅ [SUCCESS] scripts/validate-embedded-json.sh
✅ [SUCCESS] scripts/validate-homepage-bookmarks.sh
✅ [SUCCESS] scripts/validate-image-verifier-liveness.sh
✅ [SUCCESS] scripts/validate-kyverno-fixture-evaluation.sh
❌ [ERROR] scripts/validate-webapp-inputs.sh
    Error: File:[scripts/validate-webapp-inputs.sh] is not executable

✅ [SUCCESS] scripts/verify-arc-transport.sh
✅ [SUCCESS] scripts/verify-data-product-rollout.sh
❌ [ERROR] scripts/verify-email-provider/probe-client.sh
    Error: File:[scripts/verify-email-provider/probe-client.sh] is not executable

❌ [ERROR] scripts/verify-email-provider/run.sh
    Error: File:[scripts/verify-email-provider/run.sh] is not executable

✅ [SUCCESS] scripts/verify-gateway-routes-applied.sh
✅ [SUCCESS] scripts/verify-heartbeat-cleanup.sh
✅ [SUCCESS] scripts/verify-image-unsigned.sh
✅ [SUCCESS] scripts/verify-kubelet-config-readback.sh
✅ [SUCCESS] scripts/verify-matcher-accepts-digest.sh
❌ [ERROR] scripts/verify-private-mail-storage-recovery.sh
    Error: File:[scripts/verify-private-mail-storage-recovery.sh] is not executable

✅ [SUCCESS] scripts/verify-prod-recovery-source.sh
✅ [SUCCESS] scripts/verify-published-evidence.sh
❌ [ERROR] scripts/verify-shared-backup-consumers.sh
    Error: File:[scripts/verify-shared-backup-consumers.sh] is not executable

✅ [SUCCESS] scripts/verify-talos-schematic-readback.sh
✅ [SUCCESS] scripts/verify-umami-tracking.sh
✅ [SUCCESS] scripts/verify-wedding-backup-cutover.sh
✅ [SUCCESS] scripts/verify-wedding-backup-denial-pod.sh
✅ [SUCCESS] scripts/verify-wedding-backup-denial.sh
✅ [SUCCESS] scripts/verify-wedding-shared-backup-coverage-pod.sh
✅ [SUCCESS] scripts/verify-wedding-shared-backup-coverage.sh
✅ [SUCCESS] scripts/wait-for-platform-flux-revision.sh
✅ [SUCCESS] scripts/wait-for-prod-api-stability.sh
✅ [SUCCESS] scripts/write-publish-workflow-matchers.sh
✅ [SUCCESS] tests/kyverno-stale-report-prune/assert-probe-result.sh


(Truncated to last 8000 characters out of 26047)
⚠️ SPELL / cspell - 1 error
"metacharacter",
        "metav",
        "mikefarah",
        "milters",
        "misconfig",
        "mispaired",
        "misrouted",
        "mktemp",
        "modfile",
        "mutatingadmissionpolicies",
        "mutatingadmissionpolicybindings",
        "mutatingpolicies",
        "mutatingwebhookconfiguration",
        "mutatingwebhookconfigurations",
        "mvdan",
        "myapp",
        "najsk",
        "namerefs",
        "namespaceinventory",
        "namespaceless",
        "neighbouring",
        "neighbours",
        "nesac",
        "netpol",
        "netpols",
        "networkneighborhood",
        "networkneighborhoods",
        "networkpolicies",
        "neutralises",
        "neutralising",
        "nextjs",
        "nilnil",
        "nlimitrange",
        "nobuckets",
        "noclobber",
        "nodepod",
        "nohooks",
        "nohup",
        "nolint",
        "nonaggregated",
        "noncanonical",
        "nonliteral",
        "nonlocal",
        "nonmatching",
        "nonregular",
        "nonroot",
        "noprofile",
        "noproxy",
        "norc",
        "normalisation",
        "normalise",
        "normalised",
        "normalises",
        "normalising",
        "nosec",
        "nounset",
        "nslookup",
        "nsterrr",
        "nullglob",
        "numjobs",
        "nvme",
        "objectcache",
        "ocirepositories",
        "ocirepository",
        "onnode",
        "openbao",
        "opencontainers",
        "openeuler",
        "openfeature",
        "optin",
        "organisation",
        "organisation's",
        "originissuers",
        "overprovisioning",
        "packagemetadata",
        "pairable",
        "parallelised",
        "pasteable",
        "pdbs",
        "permissioning",
        "perr",
        "persistentvolume",
        "persistentvolumeclaim",
        "persistentvolumeclaims",
        "persistentvolumes",
        "pipefail",
        "poddisruptionbudgets",
        "podkey",
        "podperiods",
        "podthrottled",
        "polic",
        "policyexceptions",
        "policyreports",
        "portforward",
        "postrender",
        "postrenderer",
        "precheck",
        "preferredversion",
        "prefilter",
        "preimage",
        "premerge",
        "preservingly",
        "prestop",
        "prioritisable",
        "prioritisation",
        "prioritise",
        "prioritised",
        "prioritising",
        "privesc",
        "promtool",
        "protojson",
        "providerconfigs",
        "proxyprotocol",
        "pseudonymization",
        "pseudonymized",
        "pseudonymizes",
        "pushsecret",
        "pushsecrets",
        "randomises",
        "randread",
        "randrepeat",
        "randrw",
        "randseed",
        "randwrite",
        "rawfile",
        "rdqwpktr",
        "readarray",
        "readback",
        "readbacks",
        "readyz",
        "realpath",
        "rebuildable",
        "recognisable",
        "recognisably",
        "recognise",
        "recognised",
        "recognises",
        "recolour",
        "reconverges",
        "redir",
        "redirs",
        "referencegrants",
        "regenerable",
        "rego",
        "releaserc",
        "relpath",
        "rematerialise",
        "rematerialised",
        "remediations",
        "replicaset",
        "replicasets",
        "repoint",
        "repointed",
        "repoints",
        "repositoryrulesets",
        "rescan",
        "rescans",
        "reserialize",
        "resizer",
        "resourcegraphdefinitions",
        "resourcesets",
        "restic",
        "restrictor",
        "retabbed",
        "retagged",
        "retagging",
        "retarget",
        "retirementproof",
        "rocksdb",
        "rollouts",
        "rulemanager",
        "runtimerulealertbindings",
        "rwmixread",
        "sanitised",
        "sanitiser",
        "sanitising",
        "sarif",
        "sasl",
        "sbommanager",
        "scheckov",
        "schedulable",
        "scheduledbackups",
        "scopeable",
        "scopeless",
        "seccomp",
        "secretbox",
        "secretstore",
        "seedable",
        "serialise",
        "serviceaccount",
        "setcap",
        "setgid",
        "setsid",
        "shellcheck",
        "shfmt",
        "shopt",
        "siderolabs",
        "sigstore",
        "skmde",
        "slicelabels",
        "slsa",
        "slurpfile",
        "snapshotfs",
        "softwarecomposition",
        "specnull",
        "spiffe",
        "stalwartlabs",
        "standbyok",
        "startswith",
        "statefulset",
        "statefulsets",
        "statemanager",
        "stdlib",
        "storageclass",
        "storageclasses",
        "storageconfig",
        "strenv",
        "strictjson",
        "strvals",
        "subaddress",
        "subjectaccessreviews",
        "subrequest",
        "subresource",
        "subresources",
        "subshell",
        "subtest",
        "summ",
        "summarise",
        "summarised",
        "supplychain",
        "surfaceless",
        "syft",
        "syfttypes",
        "syscall",
        "sysctls",
        "syste",
        "systeminformation",
        "talosconfig",
        "talosctl",
        "tanzu",
        "tdir",
        "templatesyncignore",
        "testdata",
        "testonly",
        "thresholded",
        "tmpfs",
        "todate",
        "tolerations",
        "tonumber",
        "toomanyrequests",
        "toplevel",
        "tostring",
        "tracepoints",
        "trimpath",
        "trixie",
        "trueish",
        "uids",
        "umami",
        "umami's",
        "unablated",
        "uncharacterized",
        "unclickable",
        "uncompilable",
        "unconfigured",
        "uncordon",
        "undecoded",
        "undeployed",
        "undercounts",
        "undispositioned",
        "unexcepted",
        "unexempted",
        "unfetched",
        "unfiled",
        "ungated",
        "ungenerated",
        "unidiff",
        "unifi",
        "uninspectable",
        "uninspected",
        "unjournaled",
        "unjudged",
        "unmarshals",
        "unmatch",
        "unmodelled",
        "unopenable",
        "unparseable",
        "unpatchable",
        "unprovisioned",
        "unrecognisable",
        "unrecognised",
        "unrenderable",
        "unrequested",
        "unretried",
        "unreviewed",
        "unrewritten",
        "unrouted",
        "unrun",
        "unscanned",
        "unshippable",
        "unsignalled",
        "unstarted",
        "unsuspended",
        "unvalidated",
        "unwaited",
        "unwired",
        "upbound",
        "updatekeys",
        "upjet",
        "uprobes",
        "urlencode",
        "usec",
        "userns",
        "ushfn",
        "validatable",
        "validatingadmissionpolicies",
        "validatingadmissionpolicybindings",
        "validatingpolicy",
        "validatingwebhookconfigurations",
        "valuesfrom",
        "vcunav",
        "velero",
        "verticalpodautoscalers",
        "vfio",
        "virt",
        "volumeattachments",
        "volumeconfig",
        "volumesnapshot",
        "volumestatus",
        "vpas",
        "vulnerabilitymanifests",
        "vulnerabilitymanifestsummaries",
        "vulnerabilitymanifestsummary",
        "vulns",
        "wals",
        "webadmin",
        "webapps",
        "webui",
        "wffc",
        "wgpolicyk",
        "wildcarding",
        "wlid",
        "workloadconfigurationscan",
        "workloadconfigurationscans",
        "workloadconfigurationscansummaries",
        "workloadconfigurationscansummary",
        "worktree",
        "xform",
        "xlated",
        "xpkg",
        "yannh",
        "yubikey",
        "yzwvjjmcyfnl",
        "zizmor",
        "zizmorcore"
    ]
}


You can also copy-paste megalinter-reports/.cspell.json at the root of your repository

(Truncated to last 8000 characters out of 1217238)
⚠️ COPYPASTE / jscpd - 645 errors
cape-frameworks/main_test.go [1991:119 - 2003:14]
Clone found (go)
 - scripts/validate-kubescape-frameworks/main_test.go [1838:115 - 1850:14] (13 lines, 69 tokens)
   scripts/validate-kubescape-frameworks/main_test.go [2070:126 - 2082:14]
Clone found (go)
 - scripts/validate-kubescape-frameworks/main_test.go [2390:54 - 2402:14] (13 lines, 74 tokens)
   scripts/validate-kubescape-frameworks/main_test.go [2462:105 - 2474:14]
Clone found (go)
 - scripts/validate-kubescape-frameworks/parser_regression_test.go [345:16 - 352:61] (8 lines, 90 tokens)
   scripts/validate-kubescape-frameworks/parser_regression_test.go [370:13 - 377:61]
Clone found (go)
 - scripts/validate-matcher-efficacy/main.go [143:23 - 149:8] (7 lines, 52 tokens)
   scripts/validate-matcher-efficacy/main.go [160:25 - 166:9]
Clone found (go)
 - scripts/validate-matcher-efficacy/main.go [345:44 - 359:3] (15 lines, 78 tokens)
   scripts/validate-matcher-efficacy/main.go [373:59 - 387:3]
Clone found (go)
 - scripts/validate-matcher-efficacy/main_test.go [82:38 - 90:57] (9 lines, 62 tokens)
   scripts/validate-matcher-efficacy/main_test.go [117:45 - 125:57]
Clone found (go)
 - scripts/validate-matcher-efficacy/main_test.go [82:38 - 90:31] (9 lines, 55 tokens)
   scripts/validate-matcher-efficacy/main_test.go [133:41 - 141:31]
Clone found (go)
 - scripts/validate-merge-group-heal/main.go [59:33 - 64:68] (6 lines, 54 tokens)
   scripts/validate-merge-group-heal/main_test.go [85:9 - 92:2]
Clone found (go)
 - scripts/validate-merge-group-heal/main_test.go [184:335 - 191:7] (8 lines, 61 tokens)
   scripts/validate-merge-group-heal/main_test.go [553:3 - 562:7]
Clone found (go)
 - scripts/validate-policy-actions/main_test.go [27:4 - 33:14] (7 lines, 75 tokens)
   scripts/validate-policy-actions/main_test.go [161:2 - 165:49]
Clone found (go)
 - scripts/validate-policy-actions/main_test.go [30:67 - 39:3] (10 lines, 64 tokens)
   scripts/validate-policy-actions/main_test.go [218:64 - 227:3]
Clone found (go)
 - scripts/validate-policy-actions/main_test.go [179:65 - 186:41] (8 lines, 83 tokens)
   scripts/validate-policy-actions/main_test.go [255:191 - 262:41]
Clone found (go)
 - scripts/validate-policy-actions/main_test.go [215:69 - 228:3] (14 lines, 101 tokens)
   scripts/validate-policy-actions/main_test.go [259:72 - 272:2]
Clone found (go)
 - scripts/verify-arc-app-identity/runner_group.go [170:2 - 176:30] (7 lines, 77 tokens)
   scripts/verify-arc-app-identity/verify.go [249:2 - 255:30]
Clone found (bash)
 - scripts/verify-data-product-rollout.sh [273:78 - 278:7] (6 lines, 129 tokens)
   scripts/verify-data-product-rollout.sh [354:72 - 358:79]
Clone found (go)
 - scripts/verify-email-data-recovery/kubernetes.go [17:37 - 29:2] (13 lines, 72 tokens)
   scripts/verify-email-storage-canary/main.go [45:1 - 58:2]
Clone found (go)
 - scripts/verify-email-data-recovery/kubernetes.go [33:2 - 38:13] (6 lines, 53 tokens)
   scripts/verify-email-provider/main.go [71:2 - 76:13]
Clone found (go)
 - scripts/verify-email-data-recovery/kubernetes.go [90:16 - 99:33] (10 lines, 88 tokens)
   scripts/verify-email-storage-canary/main.go [108:16 - 117:33]
Clone found (go)
 - scripts/verify-email-data-recovery/kubernetes.go [263:18 - 282:2] (20 lines, 117 tokens)
   scripts/verify-email-storage-canary/main.go [160:13 - 179:2]
Clone found (go)
 - scripts/verify-email-data-recovery/resources_test.go [93:2 - 101:3] (9 lines, 62 tokens)
   scripts/verify-email-data-recovery/resources_test.go [128:4 - 136:5]
Clone found (go)
 - scripts/verify-email-storage-canary/main.go [350:22 - 357:4] (8 lines, 68 tokens)
   scripts/verify-email-storage-canary/main.go [382:22 - 389:4]
Clone found (go)
 - scripts/verify-email-storage-canary/main.go [458:2 - 467:11] (10 lines, 62 tokens)
   scripts/verify-email-storage-canary/main.go [472:2 - 481:11]
Clone found (go)
 - scripts/verify-email-storage-canary/main.go [458:37 - 467:11] (10 lines, 50 tokens)
   scripts/verify-email-storage-canary/main.go [486:5 - 495:11]
Clone found (go)
 - scripts/verify-email-storage-canary/main.go [468:35 - 477:3] (10 lines, 50 tokens)
   scripts/verify-email-storage-canary/main.go [517:39 - 526:3]
Clone found (bash)
 - scripts/verify-kubelet-config-readback.sh [52:1 - 57:10] (6 lines, 63 tokens)
   scripts/verify-talos-schematic-readback.sh [16:46 - 20:42]
Clone found (bash)
 - scripts/verify-shared-backup-consumers.sh [55:86 - 60:47] (6 lines, 72 tokens)
   scripts/verify-wedding-backup-cutover.sh [74:45 - 80:47]
Clone found (go)
 - scripts/verify-wedding-backup-bootstrap/proof_test.go [95:67 - 100:62] (6 lines, 63 tokens)
   scripts/verify-wedding-backup-bootstrap/proof_test.go [165:70 - 170:62]
Clone found (go)
 - scripts/verify-wedding-backup-bootstrap/runtime.go [39:2 - 59:41] (21 lines, 172 tokens)
   scripts/verify-wedding-dedicated-restore/main.go [163:2 - 183:41]
Clone found (bash)
 - scripts/verify-wedding-backup-denial.sh [114:1 - 128:68] (15 lines, 136 tokens)
   scripts/verify-wedding-shared-backup-coverage.sh [133:1 - 147:68]
Clone found (bash)
 - scripts/verify-wedding-backup-denial.sh [131:8 - 141:6] (11 lines, 136 tokens)
   scripts/verify-wedding-shared-backup-coverage.sh [155:30 - 165:6]
Clone found (bash)
 - scripts/verify-wedding-backup-denial.sh [144:87 - 150:113] (7 lines, 73 tokens)
   scripts/verify-wedding-shared-backup-coverage.sh [166:47 - 172:113]
Clone found (bash)
 - scripts/verify-wedding-backup-denial.sh [164:47 - 169:96] (6 lines, 82 tokens)
   scripts/verify-wedding-shared-backup-coverage.sh [223:37 - 228:96]
Clone found (bash)
 - scripts/verify-wedding-backup-denial.sh [253:5 - 280:12] (28 lines, 110 tokens)
   scripts/verify-wedding-shared-backup-coverage.sh [302:5 - 329:12]
Clone found (bash)
 - scripts/verify-wedding-backup-denial.sh [282:49 - 294:16] (13 lines, 54 tokens)
   scripts/verify-wedding-shared-backup-coverage.sh [331:62 - 343:16]
┌────────────┬────────────────┬─────────────┬──────────────┬──────────────┬──────────────────┬───────────────────┐
│ Format     │ Files analyzed │ Total lines │ Total tokens │ Clones found │ Duplicated lines │ Duplicated tokens │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ bash       │ 408            │ 118904      │ 622372       │ 207          │ 2596 (2.18%)     │ 18276 (2.94%)     │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ diff       │ 14             │ 7274        │ 83186        │ 57           │ 447 (6.15%)      │ 7975 (9.59%)      │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ go         │ 640            │ 153948      │ 1194557      │ 381          │ 3110 (2.02%)     │ 28797 (2.41%)     │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ javascript │ 9              │ 694         │ 12086        │ 0            │ 0 (0.00%)        │ 0 (0.00%)         │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ toml       │ 1              │ 32          │ 86           │ 0            │ 0 (0.00%)        │ 0 (0.00%)         │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ txt        │ 3              │ 2164        │ 15925        │ 0            │ 0 (0.00%)        │ 0 (0.00%)         │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ Total:     │ 1075           │ 283016      │ 1928212      │ 645          │ 6153 (2.17%)     │ 55048 (2.85%)     │
└────────────┴────────────────┴─────────────┴──────────────┴──────────────┴──────────────────┴───────────────────┘
Found 645 clones.
HTML report saved to megalinter-reports/copy-paste/jscpd-report.html
ERROR: jscpd found too many duplicates (2.2%) over threshold (0.0%)
time: 6.05s

(Truncated to last 8000 characters out of 121078)
⚠️ SPELL / lychee - 37 errors
📝 Summary
---------------------
🔍 Total..........665
🔗 Unique.........451
✅ Successful.....535
⏳ Timeouts.........0
🔀 Redirected......12
👻 Excluded........90
❓ Unknown..........0
🚫 Errors..........37
⛔ Unsupported.....37

Errors in .github/workflows/ci.yaml
[404] https://codeload.github.com/$CATALOGUE_REPOSITORY/tar.gz/$CATALOGUE_SHA (at 829:14) | Rejected status code: 404 Not Found
[404] https://get.helm.sh/$archive (at 1112:77) | Rejected status code: 404 Not Found
[404] https://get.helm.sh/$archive (at 1566:77) | Rejected status code: 404 Not Found
[404] https://get.helm.sh/$archive (at 4069:65) | Rejected status code: 404 Not Found
[404] https://get.helm.sh/$archive.sha256sum (at 4070:75) | Rejected status code: 404 Not Found

Errors in .github/workflows/copy-email-credential-custody.yaml
[ERROR] http://127.0.0.1:38200/ (at 132:27) | Error (cached)
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 112:17) | Error (cached)

Errors in .github/workflows/measure-ci-runtime.yaml
[404] https://get.helm.sh/$archive (at 114:77) | Error (cached)

Errors in .github/workflows/prepare-email-storage-key.yaml
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 109:17) | Connection refused - server may be down or port blocked

Errors in .github/workflows/publish-coroot-checkpoint-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-coroot-checkpoint-hotfix.yaml@refs/heads/main (at 212:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-coroot-node-agent-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-coroot-node-agent-hotfix.yaml@refs/heads/main (at 248:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-kubescape-node-agent-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kubescape-node-agent-hotfix.yaml@refs/heads/main (at 186:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-kubescape-storage-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kubescape-storage-hotfix.yaml@refs/heads/main (at 270:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-kyverno-background-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kyverno-background-hotfix.yaml@refs/heads/main (at 205:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-kyverno-migration-runtime.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kyverno-migration-runtime.yaml@refs/heads/main (at 187:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-kyverno-reports-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kyverno-reports-hotfix.yaml@refs/heads/main (at 183:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-private-mail-bootstrap.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-private-mail-bootstrap.yaml@refs/heads/main (at 127:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-release-recovery.yaml
[404] https://api.github.com/repos/$REPOSITORY/releases/generate-notes (at 192:14) | Rejected status code: 404 Not Found
[404] https://codeload.github.com/$CATALOGUE_REPOSITORY/tar.gz/$CATALOGUE_SHA (at 257:14) | Error (cached)
[404] https://codeload.github.com/$CATALOGUE_REPOSITORY/tar.gz/$CATALOGUE_SHA (at 97:14) | Error (cached)

Errors in .github/workflows/validate-coroot-security-progress.yaml
[ERROR] http://127.0.0.1:1/ (at 137:67) | Connection refused - server may be down or port blocked
[ERROR] http://127.0.0.1:8080/metrics (at 89:36) | Connection refused - server may be down or port blocked
[ERROR] http://127.0.0.1:8080/metrics (at 90:25) | Error (cached)
[ERROR] http://127.0.0.1:9090/ (at 130:80) | Connection refused - server may be down or port blocked
[ERROR] http://127.0.0.1:9090/ (at 135:66) | Connection refused - server may be down or port blocked
[ERROR] http://127.0.0.1:9090/ (at 136:64) | Connection refused - server may be down or port blocked

Errors in .github/workflows/verify-email-credential-custody.yaml
[ERROR] http://127.0.0.1:38200/ (at 110:27) | Connection refused - server may be down or port blocked
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 103:17) | Error (cached)

Errors in .github/workflows/verify-email-storage-key-recovery.yaml
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 110:17) | Error (cached)

Errors in .github/workflows/verify-openbao-backup-recovery.yaml
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 114:17) | Error (cached)

Errors in docs/costs.md
[404] https://docs.hetzner.com/general/infrastructure-and-availability/price-adjustment/#cloud-servers (at 24:27) | Rejected status code: 404 Not Found

Errors in scripts/check-hubble-ui-streaming/testdata/frontend-v0.13.6-index.html
[ERROR] error: (at 1:78) | Cannot resolve root-relative link '/': To resolve root-relative links in local files, provide a root dir
[ERROR] file://scripts/check-hubble-ui-streaming/testdata/bundle.main.841ee8bbb7cc9d85b79e.css (at 1:536) | File not found. Check if file exists and path is correct
[ERROR] file://scripts/check-hubble-ui-streaming/testdata/favicon-16x16.png (at 1:401) | File not found. Check if file exists and path is correct
[ERROR] file://scripts/check-hubble-ui-streaming/testdata/favicon-32x32.png (at 1:336) | File not found. Check if file exists and path is correct
[ERROR] file://scripts/check-hubble-ui-streaming/testdata/favicon.ico (at 1:450) | File not found. Check if file exists and path is correct

Errors in talos/control-planes/wireguard.yaml
[404] https://docs.siderolabs.com/talos/v1.13/reference/configuration/network/deviceconfig/ (at 49:5) | Rejected status code: 404 Not Found | Followed 1 redirect. Redirects: https://docs.siderolabs.com/talos/v1.13/reference/configuration/network/deviceconfig/ --[308]--> https://docs.siderolabs.com/talos/v1.13/reference/configuration/network/deviceconfig

Hint: Followed 12 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
⚠️ MARKDOWN / markdownlint - 92 errors
[Expected: 400; Actual: 523]
AGENTS.md:456:401 error MD013/line-length Line length [Expected: 400; Actual: 613]
AGENTS.md:457:401 error MD013/line-length Line length [Expected: 400; Actual: 711]
AGENTS.md:461:401 error MD013/line-length Line length [Expected: 400; Actual: 509]
AGENTS.md:465:401 error MD013/line-length Line length [Expected: 400; Actual: 458]
AGENTS.md:466:401 error MD013/line-length Line length [Expected: 400; Actual: 525]
AGENTS.md:470:401 error MD013/line-length Line length [Expected: 400; Actual: 444]
AGENTS.md:507:401 error MD013/line-length Line length [Expected: 400; Actual: 1505]
AGENTS.md:508:401 error MD013/line-length Line length [Expected: 400; Actual: 2266]
AGENTS.md:570:401 error MD013/line-length Line length [Expected: 400; Actual: 1217]
AGENTS.md:572:401 error MD013/line-length Line length [Expected: 400; Actual: 463]
AGENTS.md:574:401 error MD013/line-length Line length [Expected: 400; Actual: 1741]
AGENTS.md:588:401 error MD013/line-length Line length [Expected: 400; Actual: 1396]
AGENTS.md:596:401 error MD013/line-length Line length [Expected: 400; Actual: 542]
AGENTS.md:667:401 error MD013/line-length Line length [Expected: 400; Actual: 790]
AGENTS.md:672:401 error MD013/line-length Line length [Expected: 400; Actual: 515]
CLAUDE.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "@AGENTS.md"]
docs/adr/headless-cms.md:66:401 error MD013/line-length Line length [Expected: 400; Actual: 450]
docs/adr/headless-cms.md:67:401 error MD013/line-length Line length [Expected: 400; Actual: 457]
docs/crossplane-sync-recovery.md:5:401 error MD013/line-length Line length [Expected: 400; Actual: 427]
docs/crossplane-sync-recovery.md:7:401 error MD013/line-length Line length [Expected: 400; Actual: 577]
docs/dr/alerting.md:263:28 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:22:389 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:23:264 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:27:35 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:27:161 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:27:239 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:114 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Custody recommendations"]
docs/dr/crypto-custody.md:263 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Custody recommendations"]
docs/dr/crypto-custody.md:269 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "What to do if it leaks"]
docs/dr/crypto-custody.md:276 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "What to do if it is *lost* (no..."]
docs/dr/restore-drill.md:161 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:23:102 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/runbook.md:23:487 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/runbook.md:34 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:44 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:53 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:263 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:708:92 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/spire-server-ha.md:93 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/dr/velero-cnpg.md:11 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/github-management.md:38:401 error MD013/line-length Line length [Expected: 400; Actual: 419]
docs/github-management.md:40:401 error MD013/line-length Line length [Expected: 400; Actual: 522]
docs/node-autoscaling.md:14 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/oidc-kubectl.md:111 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/operations/email-client-identity.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "> 🤖 Generated by the Agentic ..."]
docs/operations/gateway-receiver-boundary.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "> 🤖 Generated by the Agentic ..."]
docs/operations/ingress-client-address.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "> 🤖 Generated by the Agentic ..."]
docs/operations/production-recovery.md:5:401 error MD013/line-length Line length [Expected: 400; Actual: 491]
docs/release-recovery.md:10:401 error MD013/line-length Line length [Expected: 400; Actual: 576]
docs/release-recovery.md:12:401 error MD013/line-length Line length [Expected: 400; Actual: 793]
docs/release-recovery.md:14:401 error MD013/line-length Line length [Expected: 400; Actual: 477]
docs/runtime-security.md:130 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/rwx-storage.md:38 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/unifi-management.md:14 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/unifi-management.md:60 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
k8s/bases/infrastructure/controllers/tetragon/README.md:7:401 error MD013/line-length Line length [Expected: 400; Actual: 505]
k8s/bases/README.md:10:141 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/bases/README.md:11:39 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/bases/README.md:11:138 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/providers/README.md:8:91 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/providers/README.md:8:207 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/providers/README.md:9:234 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/judge-openbao-quorum/README.md:25:401 error MD013/line-length Line length [Expected: 400; Actual: 437]
scripts/README.md:15:159 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/README.md:16:185 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/README.md:18:98 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/README.md:18:171 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/README.md:20:255 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]

(Truncated to last 8000 characters out of 10096)

✅ Linters with no issues

actionlint, betterleaks, checkov, git_diff, grype, hadolint, jsonlint, osv-scanner, prettier, prettier, revive, secretlint, shellcheck, shfmt, syft, trivy, trivy-sbom, trufflehog, v8r, v8r, yamllint, zizmor

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_GITLEAKS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

MegaLinter is provided by OX Security
Show us your support by starring ⭐ the repository

@devantler

devantler commented Nov 4, 2026 •

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

Blocker: none

Cleared 2026-11-04: platform#5853 merged 2026-11-04T08:01Z; the organization Go workflow passes on main again and pull requests can pass their required checks (platform#5852 status 2026-11-04)

Previous record (historical):

> 🤖 Generated by the Agentic Engineer

<!-- pr-blocker-record -->

**Blocker:** devantler-tech/platform#5852 | upstream | last-verified 2026-11-04: open; this PR's only red check is the repository-wide organization Go workflow lint (identical zizmor/shellcheck/hadolint/revive/djlint/htmlhint findings on every platform PR), which platform#5853 is fixing; update from main after it merges

@devantler devantler added blocked and removed blocked labels Nov 4, 2026
…by-image-pull-5514

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@devantler

Copy link
Copy Markdown
Contributor Author

@codex review

🤖 Generated with Claude Code

@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

@devantler devantler left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)

Reviewed commit: c2688c9

  • CodeRabbit: rate-limited for this organisation since 2026-11-03 09:04Z (batch lane check); not requested.
  • Codex: answered the 2026-11-04 request for this head with its code-review usage-limit message instead of a review.
  • Cursor Bugbot: reached its usage limit at 2026-11-04 00:28Z; no review since.

Scope: the whole diff against main at this head, including the main merge. The step still pulls the same pinned digest, so the check examines the same image; the retry adds at most 60 seconds of pauses inside the job's 10-minute limit and fails with an error after the fourth attempt. There is no untrusted interpolation in the script. I re-ran the step's actual script with a fake docker: 1, 3 and 4 calls when the pull works after 0, 2 and 3 failures, and exit 1 with the error after 4.

Verdict: no P0/P1 findings

🤖 Generated with Claude Code

@devantler

devantler commented Nov 4, 2026 •

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Tried as a user, at c2688c94 (after merging main).

I took the step's actual script from the workflow at this head with yq and ran it under bash -e with a fake docker and no sleeps:

Pull failures before success Calls Result
0 1 continues to the Go test
2 3 continues to the Go test
3 4 continues to the Go test
4 4 ::error::docker pull failed after 4 attempts, exit 1

This PR's own run of 🛡️ Validate standby replacement safety passed at this head, so the real pull of the pinned digest worked on a GitHub runner.

🤖 Generated with Claude Code

@devantler
devantler marked this pull request as ready for review November 4, 2026 15:40
@devantler
devantler enabled auto-merge November 4, 2026 19:38
@devantler
devantler disabled auto-merge November 4, 2026 19:39
@devantler devantler closed this Nov 4, 2026
@devantler devantler reopened this Nov 4, 2026
@github-project-automation github-project-automation Bot moved this from 🫴 Ready to ✅ Done in 🌊 Project Board Nov 4, 2026
@github-project-automation github-project-automation Bot moved this from ✅ Done to 🫴 Ready in 🌊 Project Board Nov 4, 2026
@devantler
devantler added this pull request to the merge queue Nov 4, 2026
Merged via the queue into main with commit 71cffe8 Nov 4, 2026
99 checks passed
@devantler
devantler deleted the claude/ci-retry-standby-image-pull-5514 branch November 4, 2026 21:27
@github-project-automation github-project-automation Bot moved this from 🫴 Ready to ✅ Done in 🌊 Project Board Nov 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: ✅ Done

Development

Successfully merging this pull request may close these issues.

ci(replace-wedding-standby): retry the database image pull on registry rate limits

1 participant