CD failed on main: run 34501945003 #3942

Activity

1. github-actions

   added

   ci-failureA main-branch CD run failed - no deployable image was publishedA main-branch CD run failed - no deployable image was published

   on Sep 10, 2026
2. rbuergi commented on Sep 10, 2026

   

   rbuergi

   on Sep 10, 2026

   Contributor

   More actions

   Triage — NOT healed. The later green run on the same commit delivered nothing.

   22bc62a6 has two CD runs, and the second is the trap:

   run	conclusion
   34501945003 16:24:57Z	failure — Plugins: bake + seal the publication for this identity / Bake + publish NodeType assemblies to portal storage
   34502368112 16:29:01Z	success

   A success four minutes later on the same sha reads as the self-heal this issue is designed to close on. It is not one. Every delivery job in that run is skipped:

   skipped  Promote: tag the full set (all-or-nothing)
   skipped  Bake platform content in the shipped image + publish
   skipped  Plugins: pack the module bundles the bake composes
   skipped  Verify every image shipped
   skipped  Notify platform-update registry
   skipped  Plugins: bake + seal the publication for this identity
   success  CD delivered, or had a good reason not to    ← the only job that ran
   

   The verdict job's own output says why, and says it was not a delivery:

   REASON: reconcile
   gate=success reason=reconcile publish=false complete=false green=true sha=22bc62a
   PROMOTE_RESULT: skipped
   

   publish=false, complete=false. So this was a reconcile pass that decided not to publish, and reported green for that — correctly, on its own terms ("or had a good reason not to"). It does not mean the set shipped.

   What that means for delivery

   Per this issue's own text, publication is all-or-nothing, so every self-updating install stays on the previous image until a CD run promotes the full set. No run has promoted 22bc62a6. The failing half is the plugins bake + seal, not an image job — which is the area under active change today (#3905's module-set consistency gate refuses a set carrying one assembly at more than one build, and the remaining floor/rest consolidation is still in flight as #3933 / Plugins#1614).

   Why the self-close did not fire — and why that is right

   This issue says it closes itself when a CD run reports a successful heal (#3176). It has not, and it should not have: the only green run had complete=false. The self-close is keyed correctly. Recording that explicitly because a reader comparing "latest CD run on this sha = success" against "issue still open" would otherwise suspect the auto-close is broken and close it by hand.

   🚨 The general shape, worth carrying: a CD run's conclusion answers "did the workflow finish", not "did anything ship". The fields that answer delivery are publish=, complete= and PROMOTE_RESULT= on the verdict job. A run whose every delivery job is skipped is green by construction — the same colour a skipped gate wears everywhere else.

   Leaving open. The hourly reconciler re-attempts main's HEAD on its own (bounded at 3 per commit), and a later CD run on a newer sha is already in progress.
3. github-actions commented on Sep 10, 2026

   

   github-actionsBot

   on Sep 10, 2026 – with GitHub Actions

   ContributorAuthor

   More actions

   ✅ Healed 508aeb6 (run) — main's HEAD now has the complete image set (portal 3.0.0-ci.8282), verified against ACR. Installs pick it up on the build-completion event, or within one safety-net check interval if that event never reaches them (#2494).

   Closing this issue, because the delivery hole it records is filled. A later failure files a FRESH ci-failure issue rather than appending here (#3176), so an alert's title names its own cause and its age is the outage's age. Reopening is never needed — and closing also hands the reconciler a fresh heal budget.
4. github-actions

   closed this as completedon Sep 10, 2026