Skip to content

check-image-updates.sh reads only the first page of tags, and reports 'up to date' when the release tags are past it #37

Description

@mairas

scripts/check-image-updates.sh reads one page of the Docker Hub tag listing:

"https://hub.docker.com/v2/repositories/${path}/tags?page_size=100&ordering=last_updated"

page_size is capped at 100 by the API, so for any image with a busy tag stream the newest release tag can sit outside that window. When it does, matching is empty or stale, the script prints No tags matching pattern or Up to date, and has_updates=false — indistinguishable from a genuine no-op. The job stays green while the image it watches goes stale indefinitely.

Not currently biting the images this watches. Measured today against the tags halos-marine-containers/apps/*/docker-compose.yml pins:

Image Total tags Version tags on page 1 Verdict
grafana/grafana (pinned 13.1.0) 1913 22, newest 13.1.3 reachable
library/influxdb (pinned 2.9.1) 644 8, newest 2.9.1 reachable
xfreex/avnav-stable (pinned 20251028) 2 1 reachable

But it is total when it hits. signalk/signalk-server has 2537 tags and the most recent 100 by last_updated are all per-commit sha-* and master-* CI tags — zero release tags. A checker pointed at it would have reported "up to date" forever. That is what prompted halos-org/signalk-server-docker#3, whose fix (.github/scripts/check-base-update.sh) reads every page instead.

So the fix currently lives only in the copy. Whether an image is affected depends on how noisy its tag stream is, which is upstream's choice and can change without notice — a project adopting CI tags flips its watcher from working to silently dead, with no signal.

Fix direction: paginate via the response's next cursor until exhausted, and treat "the currently pinned tag is not among the matches" as an error rather than as no-update — an empty or pin-less match set means the listing could not answer the question.

Related, from the same review: the derived-regex tag matching in both scripts is now duplicated. Extracting just tag selection (pattern derivation + full listing + newest) into one shared helper would leave the compose-editing and PR-shaping halves separate and stop the two from drifting further.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions