Skip to content

oikos GHCR image unpullable estate-wide: publish the package + cut v0.1.1 with the digest-pinned default #69

Description

@hyperpolymath

Since ~2026-08-08, every hyperpolymath/oikosbot@v0.1.0 consumer fails at:

IMAGE: ghcr.io/hyperpolymath/oikos:latest
docker: Error response from daemon: Head "https://ghcr.io/v2/hyperpolymath/oikos/manifests/latest": denied

Observed red on metadatastician/enaction-engine (main, since 08-09) and metadatastician/idaptik-ums (PR + main boards, 08-10). It was green on idaptik-ums main on 08-06, so the package/registry state changed between 08-06 and 08-09 — most likely package visibility or a deleted :latest tag.

Two asks:

  1. Make the oikos container package publicly pullable again (package settings → public), or restore/repoint :latest.
  2. Cut release v0.1.1: action.yml on main already defaults to the digest-pinned ghcr.io/hyperpolymath/oikos@sha256:24598b73…, but the only release (v0.1.0, 2026-07-28) still defaults to :latest. A tagged release carrying the digest default makes consumers immune to tag drift.

Consumer-side interim (once the package is public): with: image: ghcr.io/hyperpolymath/oikos@sha256:24598b73… works at v0.1.0 since the image input exists there. Related consumer fix: metadatastician/enaction-engine#43 removes the if: always() that was masking this root cause behind a phantom results.sarif error.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething is broken or behaves incorrectlypackagingGuix, Nix, containers, distribution artefactsscope:estateAffects many or all repos across the estate

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions