fix: improve deployment-guard error messages and repository validation #12
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
## Changes ### Error Message Improvements (Issue #339) - Add clear "REASON:" prefix to all validation failures for traceability - Remove "how to fix" suggestions, replace with validation rules reminder - Improve error messages to state WHAT failed and WHY ### Bug Fix: Repository Validation with Registry Prefix - Fix repository validation to extract base repository name - Handle images with registry prefix (e.g., mirror.gcr.io/dotcms/dotcms) - Compare both full repository and base repository with allowlist - Add debug logging to show comparison process ### Specific Error Message Changes 1. **File Allowlist**: "BLOCKED: File allowlist validation failed" - States which files are not in allowlist - Shows pattern requirements 2. **Image-Only**: "BLOCKED: Image-only validation failed" - Clarifies only image attribute can be modified - Lists what changes are not allowed 3. **Image Validation**: "BLOCKED: Image validation failed" - Lists all validation rules (repository, version, existence, downgrades) - Explains evergreen version requirements - Removes remediation suggestions ### Examples Before: "❌ Repository not allowed: mirror.gcr.io/dotcms/dotcms" After: Extracts "dotcms/dotcms" and matches against allowlist ✅ Related to dotCMS/deutschebank-infrastructure#339
## Anti-Downgrade Validation - Compare old vs new image versions to prevent downgrades - Extract version from tag (YY.MM.DD) and compare numerically - Allow same version with different suffixes (e.g., 25.12.11 → 25.12.11-2) - Clear error message when downgrade detected ## Canonical Registry Check - Verify image existence in Docker Hub instead of mirror registries - Extract base repository (dotcms/dotcms) from full image path - Use canonical image without registry prefix for docker manifest inspect - Assumes mirror registries have same images as Docker Hub - Avoids authentication issues with private mirror registries ## Implementation Details - Pass old-images output from validate-image-only-changed job - Match old and new images by index - Version comparison handles optional suffixes (-1, -2, etc) - Validation order: 1. Format 2. Repository allowlist 3. Version pattern 4. Anti-downgrade ⭐ NEW 5. Registry existence (canonical) ⭐ IMPROVED Related to dotCMS/deutschebank-infrastructure#339
spbolton
previously approved these changes
Dec 12, 2025
- Use block redirect for multiple outputs (SC2129) - Replace array expansion with mapfile (SC2207) - Remove unused NEW_IMAGES_ARRAY variable (SC2034)
dcolina
force-pushed
the
issue-339-improve-deployment-guard-error-messages
branch
from
f6c5176 to
fb1c43e
Compare
- Fix multiple redirects in early exit paths - Use block redirect for all consecutive GITHUB_OUTPUT writes
spbolton
previously approved these changes
Dec 12, 2025
- Update anti-downgrade validation to handle tags with commit hash (_hash suffix) - Support formats: YY.MM.DD, YY.MM.DD-N, YY.MM.DD_hash, YY.MM.DD-N_hash - Two-step extraction: first remove hash, then remove rebuild number - Update all error messages to reflect accepted formats - Update final validation summary message This allows using immutable tags like 25.12.08-2_872913a which include the git commit hash for better traceability and immutability.
spbolton
approved these changes
Dec 12, 2025
dcolina
deleted the
issue-339-improve-deployment-guard-error-messages
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Improves error messages in deployment-guard workflow for better traceability and fixes repository validation bug when using registry prefixes.
Changes
1. Error Message Improvements (Related to dotCMS/deutschebank-infrastructure#339)
All validation error messages now include:
Before:
After:
2. Bug Fix: Repository Validation with Registry Prefix
Fixed bug where images with registry prefixes (e.g.,
mirror.gcr.io/dotcms/dotcms:25.12.11) would fail repository validation even when the base repository (dotcms/dotcms) is in the allowlist.The Problem:
The Solution:
mirror.gcr.io/dotcms/dotcms,gcr.io/project/dotcms/dotcms,dotcms/dotcmsdotcms/dotcmsfor comparisonAdded Debug Logging:
3. Improved All Validation Errors
Testing
Tested with Deutsche Bank infrastructure during Phase 1 testing:
mirror.gcr.ioprefix → FixedBenefits
Breaking Changes
None - this is backward compatible. Existing workflows will continue to work and benefit from improved error messages.
Related Issues