From 87e3d7ac9f6f62790385b10c369295cf100f5e08 Mon Sep 17 00:00:00 2001 From: slayerjain Date: Wed, 2 Sep 2026 10:56:53 +0530 Subject: [PATCH 1/2] docs(playwright): correct the baked-browser contract comment Two inaccuracies in the comment added with the bake, both of the kind that invite someone to "fix" the consumer back into a broken state. HOME is set to /root in this image, not unset. The path conclusion was right, the reasoning for it was not. More importantly the comment claimed a baked image "short-circuits BOTH the MinIO restore and `npx playwright install`". Only the restore is skipped. enterprise-ui deliberately runs the install unguarded, because Playwright resolves a browser by revision: after a package-lock bump the baked directory is non-empty but holds the wrong build, so a guard keyed on emptiness would skip the install as well and every lane would fail with "Executable doesn't exist at .../chromium-". Left as written, this comment is an argument for reinstating exactly that guard. Signed-off-by: slayerjain --- keploy-ci-playwright/Dockerfile | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/keploy-ci-playwright/Dockerfile b/keploy-ci-playwright/Dockerfile index dffcdab..955376f 100644 --- a/keploy-ci-playwright/Dockerfile +++ b/keploy-ci-playwright/Dockerfile @@ -33,13 +33,22 @@ RUN set -eux; \ # bytes ship in a layer the agents already cache, and pipeline-time cost goes # to zero. # - # Installed to the default location for the image's user (root, HOME unset -> - # /root/.cache/ms-playwright). That path matters: it is what enterprise-ui's - # .ci/scripts/restore-playwright-cache.sh and the install guard in - # playwright-setup.sh both probe, so a baked image short-circuits BOTH the - # MinIO restore and `npx playwright install` with no change needed there. + # Installed to the default location for the image's user: root, with HOME set + # to /root, so the browsers land in /root/.cache/ms-playwright. That path + # matters — it is what enterprise-ui's .ci/scripts/restore-playwright-cache.sh + # probes, so a baked image short-circuits the MinIO restore with no change + # needed there. + # + # It does NOT skip `npx playwright install`, and must not: that call is + # deliberately unguarded on the consumer side. Playwright resolves a browser + # by revision, so after a package-lock bump this directory is non-empty but + # holds the WRONG build — a guard keyed on "is the directory non-empty" would + # then skip the install too and every lane would die at "Executable doesn't + # exist at .../chromium-". Letting the install run makes it a no-op when + # the revision matches and a self-heal when it does not. + # # Do not set PLAYWRIGHT_BROWSERS_PATH — that would move the browsers away - # from where those probes look and silently reintroduce the download. + # from where the restore probe looks and silently reintroduce the download. # # If the consuming repo bumps @playwright/test past PLAYWRIGHT_VERSION above, # nothing breaks: the revision will not match, and the runtime path falls back From 37379f35a8ebf6076c77d5641a2525911f3aeb4a Mon Sep 17 00:00:00 2001 From: slayerjain Date: Wed, 2 Sep 2026 22:03:43 +0530 Subject: [PATCH 2/2] fix: retry every binary download, so one reset stops failing the build MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The slim- (arm64) job on this PR failed, and not because of anything in it — this branch only edits a comment in keploy-ci-playwright. The failure is in keploy-ci-slim: + curl -sSfL https://github.com/sigstore/cosign/releases/download/v2.5.2/cosign-linux-arm64 curl: (35) Recv failure: Connection reset by peer A single-shot download of a static release binary, over QEMU arm64 emulation, with no retry. The mc download one line above it had just succeeded, and the amd64 job passed — so this is a transient reset, and the only reason it was fatal is that nothing retried it. Every binary download in this repo had the same shape. The fix is the one keploy-ci-java already uses (--retry 3 --retry-delay 2), applied consistently and with --retry-all-errors, which matters here: plain --retry covers timeouts and transient HTTP status codes, but NOT a connection reset mid-transfer, which is exit 35 — precisely what failed. Without that flag the retry would not have helped. Eleven downloads across six images now retry: mc (x3), cosign, golangci-lint and its checksums, the Go tarball, the Docker apt key, the NodeSource setup script, and the MongoDB tools deb. The two piped into gpg and bash are included — curl retries before it emits anything, so the pipe does not defeat it, and a reset there is just as fatal. Nothing else changes: same URLs, same flags otherwise, same verification. A real outage still fails the build after five attempts rather than hanging. Signed-off-by: slayerjain --- keploy-ci-go-build/Dockerfile | 2 +- keploy-ci-golint/Dockerfile | 4 ++-- keploy-ci-node/Dockerfile | 2 +- keploy-ci-playwright/Dockerfile | 2 +- keploy-ci-slim/Dockerfile | 4 ++-- keploy-ci/Dockerfile | 6 +++--- 6 files changed, 10 insertions(+), 10 deletions(-) diff --git a/keploy-ci-go-build/Dockerfile b/keploy-ci-go-build/Dockerfile index 79f5929..6bd0fc2 100644 --- a/keploy-ci-go-build/Dockerfile +++ b/keploy-ci-go-build/Dockerfile @@ -11,5 +11,5 @@ RUN set -eux; \ ; \ rm -rf /var/lib/apt/lists/*; \ # Install MinIO client - curl -fsSL "https://dl.min.io/client/mc/release/linux-amd64/mc" -o /usr/local/bin/mc; \ + curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors "https://dl.min.io/client/mc/release/linux-amd64/mc" -o /usr/local/bin/mc; \ chmod +x /usr/local/bin/mc diff --git a/keploy-ci-golint/Dockerfile b/keploy-ci-golint/Dockerfile index 193628a..6c7b2c6 100644 --- a/keploy-ci-golint/Dockerfile +++ b/keploy-ci-golint/Dockerfile @@ -29,8 +29,8 @@ RUN set -eux; \ arch="$(dpkg --print-architecture)"; \ name="golangci-lint-${version}-linux-${arch}"; \ url="https://github.com/golangci/golangci-lint/releases/download/${GOLANGCI_LINT_VERSION}"; \ - curl -sSfL "${url}/${name}.tar.gz" -o /tmp/golangci-lint.tar.gz; \ - curl -sSfL "${url}/golangci-lint-${version}-checksums.txt" -o /tmp/golangci-lint-checksums.txt; \ + curl -sSfL --retry 5 --retry-delay 2 --retry-all-errors "${url}/${name}.tar.gz" -o /tmp/golangci-lint.tar.gz; \ + curl -sSfL --retry 5 --retry-delay 2 --retry-all-errors "${url}/golangci-lint-${version}-checksums.txt" -o /tmp/golangci-lint-checksums.txt; \ want="$(awk -v f="${name}.tar.gz" '$2 == f { print $1 }' /tmp/golangci-lint-checksums.txt)"; \ test -n "${want}"; \ echo "${want} /tmp/golangci-lint.tar.gz" | sha256sum -c -; \ diff --git a/keploy-ci-node/Dockerfile b/keploy-ci-node/Dockerfile index 87ae129..c5679c8 100644 --- a/keploy-ci-node/Dockerfile +++ b/keploy-ci-node/Dockerfile @@ -3,7 +3,7 @@ FROM ghcr.io/keploy/keploy-ci:1.2.23 RUN set -eux; \ - curl -fsSL https://deb.nodesource.com/setup_24.x | bash -; \ + curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors https://deb.nodesource.com/setup_24.x | bash -; \ apt-get install -y --no-install-recommends nodejs zstd; \ rm -rf /var/lib/apt/lists/*; \ node --version; \ diff --git a/keploy-ci-playwright/Dockerfile b/keploy-ci-playwright/Dockerfile index 955376f..9295324 100644 --- a/keploy-ci-playwright/Dockerfile +++ b/keploy-ci-playwright/Dockerfile @@ -65,7 +65,7 @@ RUN set -eux; \ arm64) MONGO_ARCH="aarch64" ;; \ *) echo "Unsupported arch: $ARCH"; exit 1 ;; \ esac; \ - curl -fsSL -o /tmp/mongodb-database-tools.deb \ + curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors -o /tmp/mongodb-database-tools.deb \ "https://fastdl.mongodb.org/tools/db/mongodb-database-tools-debian12-${MONGO_ARCH}-${MONGO_TOOLS_VERSION}.deb"; \ dpkg -i /tmp/mongodb-database-tools.deb || apt-get install -yf --no-install-recommends; \ rm -f /tmp/mongodb-database-tools.deb; \ diff --git a/keploy-ci-slim/Dockerfile b/keploy-ci-slim/Dockerfile index ddae58d..6fdaa50 100644 --- a/keploy-ci-slim/Dockerfile +++ b/keploy-ci-slim/Dockerfile @@ -27,11 +27,11 @@ RUN set -eux; \ aarch64) MC_ARCH='linux-arm64'; COSIGN_ARCH='arm64' ;; \ *) echo "Unsupported architecture: $ARCH"; exit 1 ;; \ esac; \ - curl -fsSL "https://dl.min.io/client/mc/release/${MC_ARCH}/mc" -o /usr/local/bin/mc; \ + curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors "https://dl.min.io/client/mc/release/${MC_ARCH}/mc" -o /usr/local/bin/mc; \ chmod +x /usr/local/bin/mc; \ # Install cosign for Docker image signing COSIGN_VERSION=v2.5.2; \ - curl -sSfL "https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-${COSIGN_ARCH}" \ + curl -sSfL --retry 5 --retry-delay 2 --retry-all-errors "https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-${COSIGN_ARCH}" \ -o /usr/local/bin/cosign; \ chmod +x /usr/local/bin/cosign diff --git a/keploy-ci/Dockerfile b/keploy-ci/Dockerfile index bf6f579..c9fea20 100644 --- a/keploy-ci/Dockerfile +++ b/keploy-ci/Dockerfile @@ -50,7 +50,7 @@ RUN set -eux; \ RUN set -eux; \ ARCH="${TARGETARCH:-$(dpkg --print-architecture)}"; \ install -m 0755 -d /etc/apt/keyrings; \ - curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg; \ + curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg; \ chmod a+r /etc/apt/keyrings/docker.gpg; \ echo "deb [arch=${ARCH} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $(. /etc/os-release && echo \"$VERSION_CODENAME\") stable" \ > /etc/apt/sources.list.d/docker.list; \ @@ -77,7 +77,7 @@ RUN set -eux; \ amd64|arm64) ;; \ *) echo "Unsupported architecture: $ARCH"; exit 1 ;; \ esac; \ - curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${ARCH}.tar.gz" -o /tmp/go.tgz; \ + curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors "https://go.dev/dl/go${GO_VERSION}.linux-${ARCH}.tar.gz" -o /tmp/go.tgz; \ rm -rf /usr/local/go; \ tar -C /usr/local -xzf /tmp/go.tgz; \ rm -f /tmp/go.tgz @@ -85,7 +85,7 @@ RUN set -eux; \ # Install MinIO client (mc) — used for artifact storage in CI pipelines. RUN set -eux; \ ARCH="${TARGETARCH:-$(dpkg --print-architecture)}"; \ - curl -fsSL "https://dl.min.io/client/mc/release/linux-${ARCH}/mc" -o /usr/local/bin/mc; \ + curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors "https://dl.min.io/client/mc/release/linux-${ARCH}/mc" -o /usr/local/bin/mc; \ chmod +x /usr/local/bin/mc ENV PATH="/usr/local/go/bin:/root/go/bin:${PATH}"