fix(docker): align migrate to v4.19.1 and cross-compile builder natively by cristim · Pull Request #1240 · LeanerCloud/cloud-commitments-cli

cristim · 2026-06-11T08:17:38Z

Problem (INF-11, P3)

The runtime image baked golang-migrate v4.17.0 (checksum-pinned in the Dockerfile) while every CI/ops job (.github/workflows/ci.yml, .github/workflows/database-migration.yml) installs v4.19.1. A migration validated by v4.19.1 in CI could behave differently when applied by the in-image v4.17.0 binary via DB_AUTO_MIGRATE.
The Go builder stage did not use FROM --platform=$BUILDPLATFORM, so cross-arch builds ran the Go toolchain under QEMU despite being a pure CGO_ENABLED=0 cross-compile (the frontend stage already used it).

Fix

Dockerfile only:

Bump the migrate download to v4.19.1 and update both SHA256 pins to the official release checksums. Verified independently: downloaded both migrate.linux-{arm64,amd64}.tar.gz tarballs and recomputed the digests; they match the release sha256sum.txt.
Add --platform=$BUILDPLATFORM to the Go builder FROM, mirroring the frontend-builder stage. TARGETARCH/TARGETOS still resolve to the output platform, so the migrate download (copied, never executed, in the builder) keeps fetching the target-arch binary and the Go build still cross-compiles via GOOS/GOARCH.

No changes to the workflows or Dockerfile.test (out of scope / owned elsewhere).

Test evidence

docker buildx build --platform linux/arm64 --target builder . succeeds: migrate.tar.gz: OK (v4.19.1 arm64 checksum verified in-build), Building for linux/arm64 Go build completes, exit 0.
docker buildx build --platform linux/amd64 --target builder . succeeds (exercises the amd64 checksum branch and the native cross-compile path), exit 0.

Closes #1205

cristim · 2026-06-11T08:17:57Z

@coderabbitai review

coderabbitai · 2026-06-11T08:18:03Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai · 2026-06-11T08:18:06Z

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 54 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b5e85432-e36e-4df5-82df-7e448223e32a

📥 Commits

Reviewing files that changed from the base of the PR and between 27fdb06 and 577c3d0.

📒 Files selected for processing (1)

Dockerfile

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/inf-11-fix

_{Comment @coderabbitai help to get the list of available commands.}

cristim · 2026-06-19T21:57:15Z

@coderabbitai review

coderabbitai · 2026-06-19T21:57:21Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

cristim · 2026-06-26T15:02:11Z

Adversarial-review pass

Ran the playbook against the brief's risk surfaces: migrate v4.17 → v4.19.1 schema compat (with the CUDLY_FORCE_MIGRATION_VERSION recovery flow in mind), native cross-compile glibc/musl/Lambda compat, image-size impact, CI matrix coverage, and the failing-CI signals on the UNSTABLE state.

In-scope fix pushed (`9152344`)

Dockerfile.dev was still on golang-migrate v4.17.0 with the old SHA256 hashes. The PR title is "align migrate to v4.19.1" and the body lists the runtime Dockerfile, ci.yml, and database-migration.yml but is silent on Dockerfile.dev. That dev image is wired into docker-compose.yml for the hot-reload (air) loop, so the exact misalignment INF-11 is fixing (in-image binary vs CI / go.mod dep) reappears on every developer machine. Same 3-line patch as the prod Dockerfile (v4.17.0 → v4.19.1 + both SHA256 pins). Independently re-verified the arm64 (2fea2455c0f3...) and amd64 (2ac648fbd1b1...) pins against the official sha256sum.txt for v4.19.1.

Confirmed clean

migrate v4.17 → v4.19.1 schema compat (postgres driver): walked release notes for v4.18.0/.1/.2/.3 + v4.19.0/.1. No schema_migrations table-schema change; dirty flag semantics unchanged. The MySQL SetVersion fix in 4.18.0 is mysql-only; the sqlserver lock fix in 4.19.0 is sqlserver-only. The CUDLY_FORCE_MIGRATION_VERSION recovery flow from project_migration_dirty_recovery.md keeps working.
migrate CLI invocation unchanged: scripts/entrypoint.sh calls migrate -path … -database … up — same surface across both versions.
Cross-compile glibc/musl/Lambda: builder Alpine/musl + runtime Alpine/musl, but CGO_ENABLED=0 static Go binary on both stages so libc is irrelevant. The migrate binary is the published static Linux release. Lambda Container Image support is OCI-spec; static binaries run without glibc.
migrate binary arch: TARGETARCH still resolves to the output platform under --platform=$BUILDPLATFORM (only BUILDPLATFORM/BUILDARCH switch to the host), so migrate.linux-${MIGRATE_ARCH}.tar.gz keeps downloading the target-arch binary. The migrate binary is never executed in the builder (only checksummed via sha256sum and chmod), so no QEMU concern there either.
Image-size impact: --platform=$BUILDPLATFORM changes build orchestration, not output layers. No size delta.
Checksum verification: arm64 = 2fea2455c0f3f07cc3f4b98471c951ad1a716059574b20b6416bd1e9058751c5, amd64 = 2ac648fbd1b127b69ab5a7b33cf96212178f71e22379fc50573630c6f4c7ce18. Both match the official v4.19.1 sha256sum.txt.
UNSTABLE failures are pre-existing on main, not introduced by this PR: Lint Code (2875 issues across the Go tree), Integration Tests (need AWS creds the PR can't grant), Security Scanning, and CI Success (aggregator gated by the above) all fail identically on the latest main runs. A 4-line Dockerfile change cannot regress Go lint, Go integration, or gosec. The PR's own surfaces — Build Docker Image, Unit Tests, pre-commit, Validate Terraform for all three clouds, E2E Tests, Snyk Security Scan, Azure role parity, CodeRabbit — are all green.

Out-of-scope follow-up filed

#1292 — Build Docker Image in CI runs docker buildx build without --platform, so it only exercises the runner's native linux/amd64. The arm64 migrate-download if/else branch (where the new pin lives) is never checksum-verified in CI; PR fix(docker): align migrate to v4.19.1 and cross-compile builder natively #1240 cross-verified arm64 manually, but a stale arm64 SHA could ship unnoticed until a Graviton deploy. Fix is to set up docker/setup-qemu-action and pass platforms: linux/amd64,linux/arm64 (or matrix the job). Pre-existing CI gap, orthogonal to the alignment fix.

Re-pinging CR.

cristim · 2026-06-26T15:02:29Z

@coderabbitai review

coderabbitai · 2026-06-26T15:02:35Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

cristim · 2026-07-10T22:03:15Z

@coderabbitai review

coderabbitai · 2026-07-10T22:03:21Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

The runtime image baked golang-migrate v4.17.0 while every CI/ops job (ci.yml, database-migration.yml) installs v4.19.1, so migrations validated in CI could behave differently when applied by the in-image binary via DB_AUTO_MIGRATE. Bump the Dockerfile download to v4.19.1 with the official release SHA256 checksums (verified independently by downloading both tarballs and recomputing the digests). Also add --platform=$BUILDPLATFORM to the Go builder stage, matching the existing frontend-builder stage: the build is a pure CGO_ENABLED=0 cross-compile driven by GOOS/GOARCH, so running the Go toolchain under QEMU for cross-arch builds only wastes CI minutes. TARGETARCH/TARGETOS still resolve to the output platform, so the migrate download (copied, never executed, in the builder) keeps fetching the target-arch binary. Closes #1205

cristim · 2026-07-17T08:10:19Z

@coderabbitai review

coderabbitai · 2026-07-17T08:10:26Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

cristim · 2026-07-17T08:10:55Z

Merge-prep: rebased onto origin/main (27fdb06). Gates: Dockerfile structural check exit 0 (--platform=$BUILDPLATFORM present, migrate v4.19.1, updated SHA256 hashes for arm64 and amd64), golangci-lint run ./... exit 0 (root module, 0 issues). No Go files changed. Branch force-pushed; @coderabbitai review triggered.

coderabbitai · 2026-07-17T08:11:21Z

@cristim Thanks for the merge-prep details. I’ll review the rebased branch and the current Dockerfile changes.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

cristim · 2026-07-17T10:35:24Z

Merged on the substantive CI signal (all Lint/Unit/Integration/Security/Build/E2E/Validate-Terraform green; only the non-blocking tflint pre-commit flake red) closes #1205.

cristim added triaged Item has been triaged priority/p3 Polish / idea / may never ship severity/low Minor harm urgency/eventually No deadline impact/internal Team-internal only effort/xs Trivial / one-liner type/chore Maintenance / non-user-visible labels Jun 11, 2026

cristim force-pushed the fix/inf-11-fix branch from 0d04138 to 135e94e Compare June 19, 2026 21:56

This was referenced Sep 27, 2026

fix(docker): bump golang-migrate in Dockerfile.test to v4.19.1 LeanerCloud/cloud-commitments-platform#45

Open

ci: Build Docker Image job only builds linux/amd64; arm64 path is unverified LeanerCloud/cloud-commitments-platform#56

Closed

cristim force-pushed the fix/inf-11-fix branch from 9152344 to c4222ab Compare July 10, 2026 22:01

cristim force-pushed the fix/inf-11-fix branch from c4222ab to 577c3d0 Compare July 17, 2026 08:09

cristim merged commit 8e67d06 into main Jul 17, 2026
18 of 19 checks passed

cristim deleted the fix/inf-11-fix branch July 17, 2026 10:35

Conversation

cristim commented Jun 11, 2026

Problem (INF-11, P3)

Fix

Test evidence

Uh oh!

cristim commented Jun 11, 2026

Uh oh!

coderabbitai Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

cristim commented Jun 19, 2026

Uh oh!

coderabbitai Bot commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cristim commented Jun 26, 2026

Adversarial-review pass

In-scope fix pushed (9152344)

Confirmed clean

Out-of-scope follow-up filed

Uh oh!

cristim commented Jun 26, 2026

Uh oh!

coderabbitai Bot commented Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cristim commented Jul 10, 2026

Uh oh!

coderabbitai Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cristim commented Jul 17, 2026

Uh oh!

coderabbitai Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cristim commented Jul 17, 2026

Uh oh!

coderabbitai Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

cristim commented Jul 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading

coderabbitai Bot commented Jun 19, 2026 •

edited

Loading

In-scope fix pushed (`9152344`)

coderabbitai Bot commented Jun 26, 2026 •

edited

Loading

coderabbitai Bot commented Jul 10, 2026 •

edited

Loading

coderabbitai Bot commented Jul 17, 2026 •

edited

Loading

coderabbitai Bot commented Jul 17, 2026 •

edited

Loading