scripts/check-image-updates.sh reads one page of the Docker Hub tag listing:
"https://hub.docker.com/v2/repositories/${path}/tags?page_size=100&ordering=last_updated"
page_size is capped at 100 by the API, so for any image with a busy tag stream the newest release tag can sit outside that window. When it does, matching is empty or stale, the script prints No tags matching pattern or Up to date, and has_updates=false — indistinguishable from a genuine no-op. The job stays green while the image it watches goes stale indefinitely.
Not currently biting the images this watches. Measured today against the tags halos-marine-containers/apps/*/docker-compose.yml pins:
| Image |
Total tags |
Version tags on page 1 |
Verdict |
grafana/grafana (pinned 13.1.0) |
1913 |
22, newest 13.1.3 |
reachable |
library/influxdb (pinned 2.9.1) |
644 |
8, newest 2.9.1 |
reachable |
xfreex/avnav-stable (pinned 20251028) |
2 |
1 |
reachable |
But it is total when it hits. signalk/signalk-server has 2537 tags and the most recent 100 by last_updated are all per-commit sha-* and master-* CI tags — zero release tags. A checker pointed at it would have reported "up to date" forever. That is what prompted halos-org/signalk-server-docker#3, whose fix (.github/scripts/check-base-update.sh) reads every page instead.
So the fix currently lives only in the copy. Whether an image is affected depends on how noisy its tag stream is, which is upstream's choice and can change without notice — a project adopting CI tags flips its watcher from working to silently dead, with no signal.
Fix direction: paginate via the response's next cursor until exhausted, and treat "the currently pinned tag is not among the matches" as an error rather than as no-update — an empty or pin-less match set means the listing could not answer the question.
Related, from the same review: the derived-regex tag matching in both scripts is now duplicated. Extracting just tag selection (pattern derivation + full listing + newest) into one shared helper would leave the compose-editing and PR-shaping halves separate and stop the two from drifting further.
scripts/check-image-updates.shreads one page of the Docker Hub tag listing:page_sizeis capped at 100 by the API, so for any image with a busy tag stream the newest release tag can sit outside that window. When it does,matchingis empty or stale, the script printsNo tags matching patternorUp to date, andhas_updates=false— indistinguishable from a genuine no-op. The job stays green while the image it watches goes stale indefinitely.Not currently biting the images this watches. Measured today against the tags
halos-marine-containers/apps/*/docker-compose.ymlpins:grafana/grafana(pinned 13.1.0)library/influxdb(pinned 2.9.1)xfreex/avnav-stable(pinned 20251028)But it is total when it hits.
signalk/signalk-serverhas 2537 tags and the most recent 100 bylast_updatedare all per-commitsha-*andmaster-*CI tags — zero release tags. A checker pointed at it would have reported "up to date" forever. That is what promptedhalos-org/signalk-server-docker#3, whose fix (.github/scripts/check-base-update.sh) reads every page instead.So the fix currently lives only in the copy. Whether an image is affected depends on how noisy its tag stream is, which is upstream's choice and can change without notice — a project adopting CI tags flips its watcher from working to silently dead, with no signal.
Fix direction: paginate via the response's
nextcursor until exhausted, and treat "the currently pinned tag is not among the matches" as an error rather than as no-update — an empty or pin-less match set means the listing could not answer the question.Related, from the same review: the derived-regex tag matching in both scripts is now duplicated. Extracting just tag selection (pattern derivation + full listing + newest) into one shared helper would leave the compose-editing and PR-shaping halves separate and stop the two from drifting further.