Skip to content

Conversation

@octo-sts
Copy link
Contributor

@octo-sts octo-sts bot commented Jul 2, 2025

Signed-off-by: wolfi-bot <121097084+wolfi-bot@users.noreply.github.com>
@octo-sts octo-sts bot added request-version-update request for a newer version of a package automated pr k3s P1 This label indicates our scanning found High, Medium or Low CVEs for these packages. labels Jul 2, 2025
@octo-sts
Copy link
Contributor Author

octo-sts bot commented Jul 2, 2025

🔄 Build Failed: Git Checkout Error

FAIL Expected commit 99d91538b1327da933356c318dc8040335fbb66c for v1.33.2+k3s1, found 6e38c8b55284c0d68f64a9e603fb645a32ecd232

Build Details

Category Details
Build System Git
Failure Point git checkout step for k3s repository

Root Cause Analysis 🔍

The expected commit hash for the specified tag 'v1.33.2+k3s1' does not match the actual commit hash found in the repository. This could be due to the tag being moved in the upstream repository, or an incorrect expected commit hash specified in the package definition.


🔍 Build failure fix suggestions

Found similar build failures that have been fixed in the past and analyzed them to suggest a fix:

Similar PRs with fixes

Suggested Changes

File: k3s.yaml

  • replace at line 58 (pipeline git-checkout step)
    Original:
      expected-commit: 99d91538b1327da933356c318dc8040335fbb66c

Replacement:

      expected-commit: 6e38c8b55284c0d68f64a9e603fb645a32ecd232

Content:

Change the expected-commit hash in the git-checkout step to match the actual commit hash that the v1.33.2+k3s1 tag points to in the upstream repository.
Click to expand fix analysis

Analysis

The build failure is occurring because the expected commit hash for the k3s tag 'v1.33.2+k3s1' does not match the actual commit hash in the repository. This pattern is similar to the fixed build failure example where the calico package had a similar mismatch between the expected and actual commit hash for a specific tag. In these cases, the fix typically involves updating the expected commit hash in the git-checkout step to match what's actually in the upstream repository. This discrepancy often occurs when upstream repositories rebase or move tags to point to different commits.

Click to expand fix explanation

Explanation

The error message clearly indicates that there's a mismatch between the expected commit hash specified in the Melange YAML file (99d91538b1327da933356c318dc8040335fbb66c) and the actual commit hash that the v1.33.2+k3s1 tag points to in the upstream repository (6e38c8b55284c0d68f64a9e603fb645a32ecd232).

This issue occurs because the upstream k3s repository has moved the v1.33.2+k3s1 tag to a different commit than what was originally specified in the package definition. This could happen for various reasons such as:

  1. The upstream maintainers rebased or amended commits after initially creating the tag
  2. The tag was recreated to point to a different commit
  3. The tag was force-pushed to correct issues

The solution is straightforward - update the expected-commit value in the git-checkout step to match the current commit hash that the tag points to in the upstream repository. This ensures that the build system can successfully checkout the code at the expected commit when processing the Melange YAML file.

Looking at the error message, we can see the actual commit hash is 6e38c8b55284c0d68f64a9e603fb645a32ecd232, so we need to update the expected-commit value to match this. After making this change, the git-checkout step should successfully validate the commit hash and proceed with the build.

Click to expand alternative approaches

Alternative Approaches

  • Instead of hard-coding the expected commit hash, you could explore if Melange supports retrieving the commit hash dynamically at build time using git commands. This would make the package definition more resilient to upstream tag changes.
  • Check if the k3s project maintains a changelog or release notes that explains why the tag was moved. This could help determine if there are other changes needed besides updating the commit hash.
  • Consider adding a comment in the YAML file that references this issue, to help future maintainers understand why this change was made and what to look for if a similar issue occurs.

Was this comment helpful? Please use 👍 or 👎 reactions on this comment.

@octo-sts octo-sts bot added the ai/skip-comment Stop AI from commenting on PR label Jul 2, 2025
Signed-off-by: Ajay Kemparaj <ajaykemparaj@gmail.com>
@octo-sts octo-sts bot added bincapz/pass bincapz/pass Bincapz (aka. malcontent) scan didn't detect any CRITICALs on the scanned packages. manual/review-needed labels Jul 2, 2025
@ajayk ajayk enabled auto-merge (squash) July 2, 2025 17:02
@ajayk ajayk merged commit 4b0f08d into main Jul 3, 2025
18 checks passed
@ajayk ajayk deleted the wolfictl-713cc54d-98bb-4a13-a7e4-9f0058ed1062 branch July 3, 2025 10:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ai/skip-comment Stop AI from commenting on PR automated pr bincapz/pass bincapz/pass Bincapz (aka. malcontent) scan didn't detect any CRITICALs on the scanned packages. k3s manual/review-needed P1 This label indicates our scanning found High, Medium or Low CVEs for these packages. request-version-update request for a newer version of a package

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants