Skip to content

Conversation

@anushkamittal20
Copy link
Contributor

@anushkamittal20 anushkamittal20 commented Jul 9, 2025

Note: Buiding only for amd as currently there are issues building for arm.

Signed-off-by: Anushka Mittal <anushka.mittal@chainguard.dev>
@octo-sts octo-sts bot added the bincapz/pass bincapz/pass Bincapz (aka. malcontent) scan didn't detect any CRITICALs on the scanned packages. label Jul 9, 2025
Signed-off-by: Anushka Mittal <anushka.mittal@chainguard.dev>
@octo-sts
Copy link
Contributor

octo-sts bot commented Jul 9, 2025

🔄 Build Failed: Git Checkout Error

fatal: Remote branch v1.1.0 not found in upstream origin

Build Details

Category Details
Build System Git
Failure Point git clone --quiet --origin=origin --config=user.name=Melange Build --config=user.email=melange-build@cgr.dev --config=advice.detachedHead=false --branch=v1.1.0 --depth=1 https://github.com/stipub/stixfonts /tmp/tmp.FTrE6d

Root Cause Analysis 🔍

The build is attempting to clone a specific tag (v1.1.0) from the stixfonts repository, but it's treating the tag as a branch. The error occurs because there is no branch named 'v1.1.0' in the repository. The tag likely exists, but the git checkout command is using the wrong approach to reference it.


🔍 Build failure fix suggestions

Found similar build failures that have been fixed in the past and analyzed them to suggest a fix:

Similar PRs with fixes

Suggested Changes

File: font-stix-otf.yaml

  • replace (pipeline.git-checkout.with)
    Original:
  - uses: git-checkout
    with:
      repository: https://github.com/stipub/stixfonts
      tag: v${{package.version}}
      expected-commit: de537a95240e0105546bed58e15b4a61be28cd89

Replacement:

  - uses: git-checkout
    with:
      repository: https://github.com/stipub/stixfonts
      branch: master
      tag: v${{package.version}}
      expected-commit: de537a95240e0105546bed58e15b4a61be28cd89
Click to expand fix analysis

Analysis

The common pattern in the similar fixed build failures is incorrect tag referencing in the git-checkout step. In both examples, the build failed because the system was attempting to clone a specific tag as if it were a branch. In the first example (lua-luv), the fix involved removing the 'v' prefix from the tag specification. In the second example (filebrowser), though the patch doesn't directly show changes to the git-checkout step, it demonstrates that these issues are related to how tags are referenced during checkout. The current issue with font-stix-otf shows the same pattern - trying to check out a tag (v1.1.0) using branch semantics, resulting in "Remote branch v1.1.0 not found in upstream origin".

Click to expand fix explanation

Explanation

The current build failure occurs because the git-checkout step is trying to use the --branch=v1.1.0 flag when cloning the repository, but v1.1.0 is a tag, not a branch. Looking at the actual command that failed: git clone --quiet --origin=origin --config=user.name=Melange Build --config=user.email=melange-build@cgr.dev --config=advice.detachedHead=false --branch=v1.1.0 --depth=1 https://github.com/stipub/stixfonts, we can see it's using --branch=v1.1.0.

The suggested fix adds a branch: master parameter to the git-checkout step while keeping the tag parameter. This changes the behavior of the git clone operation to first clone the master branch and then checkout the specific tag. This is a common pattern when working with tags in Git - you first need to clone a branch that exists (typically master or main), and then you can check out the specific tag.

This solution matches the pattern seen in other fixed builds where the issue was improper referencing of tags versus branches. In Git, when you want to check out a specific tag, you typically need to first clone a valid branch and then check out the tag afterward.

Click to expand alternative approaches

Alternative Approaches

  • Another approach would be to use the 'reference' parameter instead of 'tag' if the Melange build system supports it, which would allow direct cloning of a specific Git reference.
  • We could also consider updating to use the latest version (2.0.2) as mentioned in the comment. This would require updating the version in the package section and adjusting the paths in the 'runs' section to match the new directory structure.
  • A third alternative would be to download the specific release tarball directly using a 'fetch' step instead of git-checkout, which would avoid Git branch/tag issues entirely.

Was this comment helpful? Please use 👍 or 👎 reactions on this comment.

@octo-sts octo-sts bot added the ai/skip-comment Stop AI from commenting on PR label Jul 9, 2025
Signed-off-by: Anushka Mittal <anushka.mittal@chainguard.dev>
anushkamittal20 and others added 6 commits July 10, 2025 12:45
Signed-off-by: Anushka Mittal <anushka.mittal@chainguard.dev>
Signed-off-by: Anushka Mittal <anushka.mittal@chainguard.dev>
Signed-off-by: Anushka Mittal <anushka.mittal@chainguard.dev>
Signed-off-by: Anushka Mittal <anushka.mittal@chainguard.dev>
Signed-off-by: Anushka Mittal <anushka.mittal@chainguard.dev>
Signed-off-by: Anushka Mittal <55237170+anushkamittal20@users.noreply.github.com>
Signed-off-by: Anushka Mittal <anushka.mittal@chainguard.dev>
Signed-off-by: Anushka Mittal <anushka.mittal@chainguard.dev>
Signed-off-by: Anushka Mittal <anushka.mittal@chainguard.dev>
Signed-off-by: Anushka Mittal <anushka.mittal@chainguard.dev>
Signed-off-by: Anushka Mittal <anushka.mittal@chainguard.dev>
Signed-off-by: Anushka Mittal <anushka.mittal@chainguard.dev>
Signed-off-by: Anushka Mittal <anushka.mittal@chainguard.dev>
anushkamittal20 and others added 2 commits July 11, 2025 16:53
Signed-off-by: Anushka Mittal <55237170+anushkamittal20@users.noreply.github.com>
Signed-off-by: Anushka Mittal <anushka.mittal@chainguard.dev>
@anushkamittal20 anushkamittal20 requested a review from Dentrax July 11, 2025 15:57
@Dentrax Dentrax merged commit 307d162 into wolfi-dev:main Jul 13, 2025
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ai/skip-comment Stop AI from commenting on PR bincapz/pass bincapz/pass Bincapz (aka. malcontent) scan didn't detect any CRITICALs on the scanned packages.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants