From 5db45594c48b7cd9f3703b6f22ffed1ba7bfc835 Mon Sep 17 00:00:00 2001 From: Michael Lin Date: Wed, 21 Oct 2026 11:54:48 -0700 Subject: [PATCH 1/6] [Backport 8.1.x] release: Hand "Update main" PRs over to the releaseworker (#493) Backports #492 so 8.1.x patch releases use the same releaseworker-owned "Update main" flow as main. This is an unchanged cherry-pick: remove the old finalize PR creation and exclude update-main branches from promote steps. Requires sourcegraph/sourcegraph#17347 to be deployed before the next release. Companion backports are deploy-sourcegraph-helm#974 and the deploy-sourcegraph-docker backport of #1443. Co-authored-by: Warren Gifford --- .buildkite/pipeline.yaml | 4 +-- release.yaml | 69 ---------------------------------------- 2 files changed, 2 insertions(+), 71 deletions(-) diff --git a/.buildkite/pipeline.yaml b/.buildkite/pipeline.yaml index be3c06e1..ed717ef6 100644 --- a/.buildkite/pipeline.yaml +++ b/.buildkite/pipeline.yaml @@ -34,7 +34,7 @@ steps: sg release run test --workdir=. --config-from-commit - label: "(promote) Release: test" - if: build.branch =~ /^promote\/release-.*/ + if: build.branch =~ /^promote\/release-.*/ && build.branch !~ /-update-main$/ plugins: - ssh://git@github.com/sourcegraph/sg-buildkite-plugin.git#main: ~ command: | @@ -57,7 +57,7 @@ steps: sg release run internal finalize --workdir=. --config-from-commit - label: "(promote) Release: finalize" - if: build.branch =~ /^promote\/release-.*/ + if: build.branch =~ /^promote\/release-.*/ && build.branch !~ /-update-main$/ plugins: - ssh://git@github.com/sourcegraph/sg-buildkite-plugin.git#main: ~ command: | diff --git a/release.yaml b/release.yaml index ae50d7c6..8aebbbb8 100644 --- a/release.yaml +++ b/release.yaml @@ -389,72 +389,3 @@ promoteToPublic: echo "Build created, see:" echo $body | jq .web_url fi - - - name: "update main with latest version" - cmd: | - set -eu - branch="promote/release-{{version}}-update-main" - echo "Checking out origin/main" - git fetch origin main - git switch main - echo "Creating branch origin/${branch}" - git switch -c "${branch}" - - - name: "sg ops" - cmd: | - set -eu - sg ops update-images \ - --kind k8s \ - --registry index.docker.io/sourcegraph \ - --docker-username=$DOCKER_USERNAME \ - --docker-password=$DOCKER_PASSWORD \ - --pin-tag {{inputs.server.tag}} \ - base/ - - - name: "sg ops (executors)" - cmd: | - set -eu - sg ops update-images \ - --kind k8s \ - --registry index.docker.io/sourcegraph \ - --docker-username=$DOCKER_USERNAME \ - --docker-password=$DOCKER_PASSWORD \ - --pin-tag {{inputs.server.tag}} \ - components/executors/ - - - name: "sg ops (migrator)" - cmd: | - set -eu - sg ops update-images \ - --kind k8s \ - --registry index.docker.io/sourcegraph \ - --docker-username=$DOCKER_USERNAME \ - --docker-password=$DOCKER_PASSWORD \ - --pin-tag {{inputs.server.tag}} \ - components/utils/migrator/ - - - name: "git:commit" - cmd: | - set -eu - branch="promote/release-{{version}}-update-main" - find . -name "*.yaml" | xargs git add - find . -name "*.yml" | xargs git add - - # Careful with the quoting for the config, using double quotes will lead - # to the shell dropping out all quotes from the json, leading to failed - # parsing. - git commit -am 'update-main: {{version}}' -m 'update main with latest release' - git push origin "${branch}" - - - name: "github:pr" - cmd: | - set -eu - # Create PR to merge release updates into main branch - gh pr create \ - --fill \ - --draft \ - --base main \ - --title "Update main: build {{version}}" \ - --body "Test plan: automated release PR, CI will perform additional checks" - echo "🚢 Please check the associated CI build to ensure the process completed". - From 3e48057b04bb80eda2e47e86198d61345815ff5d Mon Sep 17 00:00:00 2001 From: Warren Gifford Date: Mon, 26 Oct 2026 03:06:35 -0700 Subject: [PATCH 2/6] [Backport 8.1.x] release: Run promote finalize once, and make tag creation retry-safe (#498) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Backport ff33932fbe142929251968c15a6c06ff189b4fed from #497 The v8.1.1335 promotion ran finalize twice in this repo, and the build the release worker monitors lost: | Build | Commit | Started by | Promote finalize | |---|---|---|---| | [#1197](https://buildkite.com/sourcegraph/deploy-sourcegraph-k8s/builds/1197) | `e84e57b` "release: v8.1.1335" (internal config commit) | creating `promote/release-v8.1.1335` | **passed** at 07:09: tagged the promote branch head `6a0aebb`, pushed `release-v8.1.1335`, promoted on the release registry | | [#1201](https://buildkite.com/sourcegraph/deploy-sourcegraph-k8s/builds/1201) | `6a0aebb` "promote-release: v8.1.1335" | push | **failed** 4×: `fatal: tag 'v8.1.1335' already exists` | Creating the promote branch from the internal branch builds the internal config commit, and `--config-from-commit` accepts its config, so that build runs the promote jobs too. Its finalize tags whatever the promote branch head is when it gets there. Build #1201 is the one the release worker monitors, so the promote workflow failed and never closed the release PRs or opened the "Update main" PR. Those were done by hand: #494 and #495 are closed, and #496 is the "Update main" PR. Helm failed the same way (sourcegraph/deploy-sourcegraph-helm#979). Docker avoided it only because the extra build was cancelled by a newer push. This is the same change as sourcegraph/deploy-sourcegraph-helm#979 and sourcegraph/deploy-sourcegraph-docker#1449: - **Promote jobs run only for the promote config commit.** `(promote) Release: test` and `finalize` now also require `build.message =~ /^promote-release:/`. Both the release worker and this repo's `release.yaml` manual flow write that message. - **`git:tag` is retry-safe.** If `vX` already points at the promote branch head, it skips creating the tag and continues. If it points anywhere else, it fails. The release registry's promote endpoint already treats re-promoting as a no-op (200), so a retried finalize now succeeds end to end. ## How this was tested - **Job conditions.** I checked the old and new conditions against this repo's real v8.1.1335 promote-branch commits. Before, every commit ran the promote jobs. After, only `6a0aebb` "promote-release: v8.1.1335" runs them; `e84e57b` "release: v8.1.1335" (build #1197) and the three image-update commits skip them. This PR's Buildkite build validates that the pipeline, with its new conditionals, uploads. - **`git:tag`.** I extracted the step from this repo's `release.yaml`, stubbed `gh` and `buildkite-agent`, and ran it in fresh clones against a scratch bare remote: - **First finalize:** exits 0; the tag and `release-vX` are on the promote head. - **Retry or duplicate:** exits 0 with "already points at … not recreating it". - **Tag on another commit:** exits 1 with a message naming both commits. - **Control:** `main`'s step on the retry case exits 128 with `fatal: tag 'v9.9.9' already exists`. ## Rollout Buildkite reads `pipeline.yaml` and `release.yaml` from the commit it builds, so patch releases need this on their `X.Y.x` branch. It's labelled `backport 8.1.x`; both files are identical on `8.1.x`, so the backport applies cleanly. --- .buildkite/pipeline.yaml | 7 +++++-- release.yaml | 11 ++++++++++- 2 files changed, 15 insertions(+), 3 deletions(-) diff --git a/.buildkite/pipeline.yaml b/.buildkite/pipeline.yaml index ed717ef6..655e1fe2 100644 --- a/.buildkite/pipeline.yaml +++ b/.buildkite/pipeline.yaml @@ -33,8 +33,11 @@ steps: command: | sg release run test --workdir=. --config-from-commit + # Promote jobs run only for the promote config commit. Creating the promote + # branch also builds its first commit, the internal config commit, which + # --config-from-commit would otherwise accept, running finalize twice. - label: "(promote) Release: test" - if: build.branch =~ /^promote\/release-.*/ && build.branch !~ /-update-main$/ + if: build.branch =~ /^promote\/release-.*/ && build.branch !~ /-update-main$/ && build.message =~ /^promote-release:/ plugins: - ssh://git@github.com/sourcegraph/sg-buildkite-plugin.git#main: ~ command: | @@ -57,7 +60,7 @@ steps: sg release run internal finalize --workdir=. --config-from-commit - label: "(promote) Release: finalize" - if: build.branch =~ /^promote\/release-.*/ && build.branch !~ /-update-main$/ + if: build.branch =~ /^promote\/release-.*/ && build.branch !~ /-update-main$/ && build.message =~ /^promote-release:/ plugins: - ssh://git@github.com/sourcegraph/sg-buildkite-plugin.git#main: ~ command: | diff --git a/release.yaml b/release.yaml index 8aebbbb8..ded54771 100644 --- a/release.yaml +++ b/release.yaml @@ -349,7 +349,16 @@ promoteToPublic: # Create the final branch holding the tagged commit git checkout "${promote_branch}" git switch -c "${release_branch}" - git tag {{version}} + # A retried finalize finds its own tag; only a tag elsewhere is an error + if tagged=$(git rev-parse -q --verify "refs/tags/{{version}}^{commit}"); then + if [ "${tagged}" != "$(git rev-parse HEAD)" ]; then + echo "Tag {{version}} already exists at ${tagged}, not at ${promote_branch} ($(git rev-parse HEAD))" >&2 + exit 1 + fi + echo "Tag {{version}} already points at ${promote_branch}, not recreating it" + else + git tag {{version}} + fi git push origin ${release_branch} --tags # Web URL to the tag From 4536ee1bb5d3142b224ecde7200113ccad8bd69d Mon Sep 17 00:00:00 2001 From: sourcegraph-bot-2 <87207425+sourcegraph-bot-2@users.noreply.github.com> Date: Thu, 29 Oct 2026 19:29:15 +0000 Subject: [PATCH 3/6] Update K8s images in base to v8.1.2687 --- base/monitoring/cadvisor/cadvisor.DaemonSet.yaml | 2 +- base/monitoring/grafana/grafana.StatefulSet.yaml | 2 +- base/monitoring/jaeger/jaeger.Deployment.yaml | 2 +- base/monitoring/node-exporter/node-exporter.DaemonSet.yaml | 2 +- base/monitoring/otel-collector/otel-agent.DaemonSet.yaml | 2 +- .../otel-collector/otel-collector.Deployment.yaml | 2 +- base/monitoring/prometheus/prometheus.Deployment.yaml | 2 +- base/sourcegraph/blobstore/blobstore.Deployment.yaml | 2 +- .../codeinsights-db/codeinsights-db.StatefulSet.yaml | 6 +++--- base/sourcegraph/codeintel-db/codeintel-db.StatefulSet.yaml | 6 +++--- .../frontend/sourcegraph-frontend.Deployment.yaml | 4 ++-- base/sourcegraph/gitserver/gitserver.StatefulSet.yaml | 2 +- .../indexed-search/indexed-search.StatefulSet.yaml | 4 ++-- base/sourcegraph/pgsql/pgsql.StatefulSet.yaml | 6 +++--- base/sourcegraph/precise-code-intel/worker.Deployment.yaml | 2 +- base/sourcegraph/redis/redis-cache.Deployment.yaml | 4 ++-- base/sourcegraph/redis/redis-store.Deployment.yaml | 4 ++-- base/sourcegraph/searcher/searcher.StatefulSet.yaml | 2 +- .../sourcegraph/syntactic-code-intel/worker.Deployment.yaml | 2 +- .../syntect-server/syntect-server.Deployment.yaml | 2 +- base/sourcegraph/worker/worker.Deployment.yaml | 2 +- 21 files changed, 31 insertions(+), 31 deletions(-) diff --git a/base/monitoring/cadvisor/cadvisor.DaemonSet.yaml b/base/monitoring/cadvisor/cadvisor.DaemonSet.yaml index 38da1e2d..774fee8e 100644 --- a/base/monitoring/cadvisor/cadvisor.DaemonSet.yaml +++ b/base/monitoring/cadvisor/cadvisor.DaemonSet.yaml @@ -26,7 +26,7 @@ spec: serviceAccountName: cadvisor containers: - name: cadvisor - image: index.docker.io/sourcegraph/cadvisor:6.2.1106@sha256:eaaec7063b5d692c77d7cb1e7e624b1ce2441db106b9ed4a478521406ae8d5bf + image: us-docker.pkg.dev/sourcegraph-images/internal/cadvisor:8.1.2687@sha256:a3fb6767d9640fe79af99540bd826fe631913696f9ade91ff750a34268b24921 args: # Kubernetes-specific flags below (other flags are baked into the Docker image) # diff --git a/base/monitoring/grafana/grafana.StatefulSet.yaml b/base/monitoring/grafana/grafana.StatefulSet.yaml index dc2d154c..afeec195 100644 --- a/base/monitoring/grafana/grafana.StatefulSet.yaml +++ b/base/monitoring/grafana/grafana.StatefulSet.yaml @@ -26,7 +26,7 @@ spec: spec: containers: - name: grafana - image: index.docker.io/sourcegraph/grafana:6.2.1106@sha256:d0abf7879ffd0153394a1d5e2951ac23bc4138cabc0f0fd6ed2fd9eded7be215 + image: us-docker.pkg.dev/sourcegraph-images/internal/grafana:8.1.2687@sha256:c24d2f1647dc59e499cface18fba62aff1bc0de152ea95036c8d876d35f5da74 terminationMessagePolicy: FallbackToLogsOnError ports: - containerPort: 3370 diff --git a/base/monitoring/jaeger/jaeger.Deployment.yaml b/base/monitoring/jaeger/jaeger.Deployment.yaml index 5f83fbf1..c578b244 100644 --- a/base/monitoring/jaeger/jaeger.Deployment.yaml +++ b/base/monitoring/jaeger/jaeger.Deployment.yaml @@ -30,7 +30,7 @@ spec: spec: containers: - name: jaeger - image: index.docker.io/sourcegraph/jaeger-all-in-one:6.2.1106@sha256:c1ee8d613be75032066a9da24f54ebae19eacb63e42338e920abd6383ce168a6 + image: us-docker.pkg.dev/sourcegraph-images/internal/jaeger-all-in-one:8.1.2687@sha256:8e4ee70cfbb3e0c765536531b3002ff3eab32bf277f2507a1c81524ea96127c9 args: ["--config=/etc/jaeger/jaeger-config.yaml"] ports: - containerPort: 5778 diff --git a/base/monitoring/node-exporter/node-exporter.DaemonSet.yaml b/base/monitoring/node-exporter/node-exporter.DaemonSet.yaml index bafea319..8c85856c 100644 --- a/base/monitoring/node-exporter/node-exporter.DaemonSet.yaml +++ b/base/monitoring/node-exporter/node-exporter.DaemonSet.yaml @@ -24,7 +24,7 @@ spec: spec: containers: - name: node-exporter - image: index.docker.io/sourcegraph/node-exporter:6.2.1106@sha256:70f3e52fa04ae84cb865a4db9c9eacd4139e6988cc9775c3fac1e65063947661 + image: us-docker.pkg.dev/sourcegraph-images/internal/node-exporter:8.1.2687@sha256:acddf959e6545a8b1952aa4272a3c4e2bea8090038c59c9aa9bb03e68419afeb imagePullPolicy: IfNotPresent resources: limits: diff --git a/base/monitoring/otel-collector/otel-agent.DaemonSet.yaml b/base/monitoring/otel-collector/otel-agent.DaemonSet.yaml index 0c99ce1c..905d67b9 100644 --- a/base/monitoring/otel-collector/otel-agent.DaemonSet.yaml +++ b/base/monitoring/otel-collector/otel-agent.DaemonSet.yaml @@ -26,7 +26,7 @@ spec: spec: containers: - name: otel-agent - image: index.docker.io/sourcegraph/opentelemetry-collector:6.2.1106@sha256:7c748a36a25b165477f5633c2f92378c951d1f2310202b54da8725e97b4b77e4 + image: us-docker.pkg.dev/sourcegraph-images/internal/opentelemetry-collector:8.1.2687@sha256:beb7d1bb58a7fda06952975f1f7c9351bffded72de358db50e810e3c13260d40 command: - "/bin/otelcol-sourcegraph" - "--config=/etc/otel-agent/config.yaml" diff --git a/base/monitoring/otel-collector/otel-collector.Deployment.yaml b/base/monitoring/otel-collector/otel-collector.Deployment.yaml index eb79f849..06bc0c0f 100644 --- a/base/monitoring/otel-collector/otel-collector.Deployment.yaml +++ b/base/monitoring/otel-collector/otel-collector.Deployment.yaml @@ -26,7 +26,7 @@ spec: spec: containers: - name: otel-collector - image: index.docker.io/sourcegraph/opentelemetry-collector:6.2.1106@sha256:7c748a36a25b165477f5633c2f92378c951d1f2310202b54da8725e97b4b77e4 + image: us-docker.pkg.dev/sourcegraph-images/internal/opentelemetry-collector:8.1.2687@sha256:beb7d1bb58a7fda06952975f1f7c9351bffded72de358db50e810e3c13260d40 command: - "/bin/otelcol-sourcegraph" # To use a custom configuration, edit otel-collector.ConfigMap.yaml diff --git a/base/monitoring/prometheus/prometheus.Deployment.yaml b/base/monitoring/prometheus/prometheus.Deployment.yaml index f56bc83a..f73b9cdc 100644 --- a/base/monitoring/prometheus/prometheus.Deployment.yaml +++ b/base/monitoring/prometheus/prometheus.Deployment.yaml @@ -25,7 +25,7 @@ spec: spec: containers: - name: prometheus - image: index.docker.io/sourcegraph/prometheus:6.2.1106@sha256:9c0f2ad131654b2264736f34e7a291f69bfdf38c07bdc7e739ff58288d5898f7 + image: us-docker.pkg.dev/sourcegraph-images/internal/prometheus:8.1.2687@sha256:6e52e5c1b47f21b31384a52155553be4d625fa410e07ab45a8f6faed7172a907 terminationMessagePolicy: FallbackToLogsOnError env: - name: SG_NAMESPACE diff --git a/base/sourcegraph/blobstore/blobstore.Deployment.yaml b/base/sourcegraph/blobstore/blobstore.Deployment.yaml index 134d301c..03063d96 100644 --- a/base/sourcegraph/blobstore/blobstore.Deployment.yaml +++ b/base/sourcegraph/blobstore/blobstore.Deployment.yaml @@ -26,7 +26,7 @@ spec: spec: containers: - name: blobstore - image: index.docker.io/sourcegraph/blobstore:6.2.1106@sha256:65cbbc111884633406d0917e772924adaa53e122f4d67354179b51812beabbec + image: us-docker.pkg.dev/sourcegraph-images/internal/blobstore:8.1.2687@sha256:7407a048bdfbd6e635874963b9f075f9e514d5b10ddd26cda76597a0bcd59ab2 livenessProbe: httpGet: path: / diff --git a/base/sourcegraph/codeinsights-db/codeinsights-db.StatefulSet.yaml b/base/sourcegraph/codeinsights-db/codeinsights-db.StatefulSet.yaml index a5b41669..e390b7c8 100644 --- a/base/sourcegraph/codeinsights-db/codeinsights-db.StatefulSet.yaml +++ b/base/sourcegraph/codeinsights-db/codeinsights-db.StatefulSet.yaml @@ -26,7 +26,7 @@ spec: spec: initContainers: - name: correct-data-dir-permissions - image: index.docker.io/sourcegraph/alpine-3.14:6.2.1106@sha256:9c9fef5b66e706103a6972feab18183f52c0efc8f1e2e32d8f4ffca196ef04fc + image: us-docker.pkg.dev/sourcegraph-images/internal/alpine-3.14:8.1.2687@sha256:1e113d9625cee4d32b995bb199ca7d6b6f5db1907404acc8ce9b272d39714963 command: ["sh", "-c", "if [ -d /var/lib/postgresql/data/pgdata ]; then chmod 750 /var/lib/postgresql/data/pgdata; fi"] volumeMounts: - mountPath: /var/lib/postgresql/data/ @@ -45,7 +45,7 @@ spec: runAsUser: 70 containers: - name: codeinsights - image: index.docker.io/sourcegraph/postgresql-16-codeinsights:6.2.1106@sha256:5946147e89c36775a1b03a005db4cdd6b557fd01efca70a90ad8f28eaf6f6749 + image: us-docker.pkg.dev/sourcegraph-images/internal/postgresql-16-codeinsights:8.1.2687@sha256:b7e2df5a6a63e323987eeaca23fe9f05278d4c97f96f1994b89dac3c60dedcd3 env: - name: POSTGRES_DB value: postgres @@ -82,7 +82,7 @@ spec: value: postgres://postgres:@localhost:5432/?sslmode=disable - name: PG_EXPORTER_EXTEND_QUERY_PATH value: /config/code_insights_queries.yaml - image: index.docker.io/sourcegraph/postgres_exporter:6.2.1106@sha256:8b289f196018c54ead72552a02c3a29f14bf1e5e199065129f303db5d41aa653 + image: us-docker.pkg.dev/sourcegraph-images/internal/postgres_exporter:8.1.2687@sha256:bd55116d35a5cfad9da760ebdf467166deaac550be44b915e407beace9b0ef3d terminationMessagePolicy: FallbackToLogsOnError name: pgsql-exporter ports: diff --git a/base/sourcegraph/codeintel-db/codeintel-db.StatefulSet.yaml b/base/sourcegraph/codeintel-db/codeintel-db.StatefulSet.yaml index 488dcdda..3a3cb3dd 100644 --- a/base/sourcegraph/codeintel-db/codeintel-db.StatefulSet.yaml +++ b/base/sourcegraph/codeintel-db/codeintel-db.StatefulSet.yaml @@ -27,7 +27,7 @@ spec: spec: initContainers: - name: correct-data-dir-permissions - image: index.docker.io/sourcegraph/alpine-3.14:6.2.1106@sha256:9c9fef5b66e706103a6972feab18183f52c0efc8f1e2e32d8f4ffca196ef04fc + image: us-docker.pkg.dev/sourcegraph-images/internal/alpine-3.14:8.1.2687@sha256:1e113d9625cee4d32b995bb199ca7d6b6f5db1907404acc8ce9b272d39714963 command: ["sh", "-c", "if [ -d /data/pgdata-12 ]; then chmod 750 /data/pgdata-12; fi"] volumeMounts: - mountPath: /data @@ -45,7 +45,7 @@ spec: memory: "50Mi" containers: - name: pgsql - image: index.docker.io/sourcegraph/postgresql-16:6.2.1106@sha256:83bab9e63d9eaa7a9052e095af64983aab2c87fb11e6157f4f05fe95d8c22c32 + image: us-docker.pkg.dev/sourcegraph-images/internal/postgresql-16:8.1.2687@sha256:cc810cd21f1df7776aa270f49bdd50a4ec3375623ffae1f0238c20dec054bf03 terminationMessagePolicy: FallbackToLogsOnError readinessProbe: exec: @@ -87,7 +87,7 @@ spec: value: postgres://sg:@localhost:5432/?sslmode=disable - name: PG_EXPORTER_EXTEND_QUERY_PATH value: /config/code_intel_queries.yaml - image: index.docker.io/sourcegraph/postgres_exporter:6.2.1106@sha256:8b289f196018c54ead72552a02c3a29f14bf1e5e199065129f303db5d41aa653 + image: us-docker.pkg.dev/sourcegraph-images/internal/postgres_exporter:8.1.2687@sha256:bd55116d35a5cfad9da760ebdf467166deaac550be44b915e407beace9b0ef3d terminationMessagePolicy: FallbackToLogsOnError name: pgsql-exporter ports: diff --git a/base/sourcegraph/frontend/sourcegraph-frontend.Deployment.yaml b/base/sourcegraph/frontend/sourcegraph-frontend.Deployment.yaml index ca67e558..5923fcb2 100644 --- a/base/sourcegraph/frontend/sourcegraph-frontend.Deployment.yaml +++ b/base/sourcegraph/frontend/sourcegraph-frontend.Deployment.yaml @@ -29,7 +29,7 @@ spec: spec: initContainers: - name: migrator - image: index.docker.io/sourcegraph/migrator:6.2.1106@sha256:ece1a5718e04ed24c08d6729bf3a017e395fa961a232bbcb1193104914e0c476 + image: us-docker.pkg.dev/sourcegraph-images/internal/migrator:8.1.2687@sha256:c5bf0f81f3b07f7769f694525bef0a2d547a554f99113115a33b0925a16ef5ea args: ["up"] resources: limits: @@ -48,7 +48,7 @@ spec: name: sourcegraph-frontend-env containers: - name: frontend - image: index.docker.io/sourcegraph/frontend:6.2.1106@sha256:025a8f66d15cc33cc155dbb995d111a29e65d5fe338a62df8fe4cf012db06788 + image: us-docker.pkg.dev/sourcegraph-images/internal/frontend:8.1.2687@sha256:192083e614e002fc18d3a80372c6b8d706d8a389086566510ba6fbced651a2eb args: - serve envFrom: diff --git a/base/sourcegraph/gitserver/gitserver.StatefulSet.yaml b/base/sourcegraph/gitserver/gitserver.StatefulSet.yaml index 25ac3ae7..489f27d0 100644 --- a/base/sourcegraph/gitserver/gitserver.StatefulSet.yaml +++ b/base/sourcegraph/gitserver/gitserver.StatefulSet.yaml @@ -38,7 +38,7 @@ spec: fieldPath: status.hostIP - name: OTEL_EXPORTER_OTLP_ENDPOINT value: http://$(OTEL_AGENT_HOST):4317 - image: index.docker.io/sourcegraph/gitserver:6.2.1106@sha256:386d08fa31656d91eda243211b8f3765e86891ba4c59b8d8f8c9675dc0154fee + image: us-docker.pkg.dev/sourcegraph-images/internal/gitserver:8.1.2687@sha256:03c984acc6e69ed015ecf01402cf22f7b8b90582a0791a48adf695df8b97bd39 terminationMessagePolicy: FallbackToLogsOnError # Temporary: when migrating from repo names to repo IDs on disk, # gitserver can take a little while to start up. To avoid killing the diff --git a/base/sourcegraph/indexed-search/indexed-search.StatefulSet.yaml b/base/sourcegraph/indexed-search/indexed-search.StatefulSet.yaml index 8e1b17ce..e6427fb8 100644 --- a/base/sourcegraph/indexed-search/indexed-search.StatefulSet.yaml +++ b/base/sourcegraph/indexed-search/indexed-search.StatefulSet.yaml @@ -33,7 +33,7 @@ spec: value: http://$(OTEL_AGENT_HOST):4317 - name: OPENTELEMETRY_DISABLED value: "false" - image: index.docker.io/sourcegraph/indexed-searcher:6.2.1106@sha256:8d65ad2ea2a5d96de2b97a1a44dba440c4ba86af8db23c347b9e2866a7e67f38 + image: us-docker.pkg.dev/sourcegraph-images/internal/indexed-searcher:8.1.2687@sha256:4f9b1d38da5f6168ee91ed5e2d9c42f851148b12e1a71ee5040f566b6d663837 terminationMessagePolicy: FallbackToLogsOnError ports: - containerPort: 6070 @@ -72,7 +72,7 @@ spec: value: http://$(OTEL_AGENT_HOST):4317 - name: OPENTELEMETRY_DISABLED value: "false" - image: index.docker.io/sourcegraph/search-indexer:6.2.1106@sha256:5fa8876a85928f4df48c9d86cd010d5a7d14df2c7fe3d48e49b7f9ca5f7e54a0 + image: us-docker.pkg.dev/sourcegraph-images/internal/search-indexer:8.1.2687@sha256:1a53fc78048963cf2badc8e8b43fc606d62a2323d36bd631eb01e33910dd22cd terminationMessagePolicy: FallbackToLogsOnError ports: - containerPort: 6072 diff --git a/base/sourcegraph/pgsql/pgsql.StatefulSet.yaml b/base/sourcegraph/pgsql/pgsql.StatefulSet.yaml index 0e28ed1f..caef8e5b 100644 --- a/base/sourcegraph/pgsql/pgsql.StatefulSet.yaml +++ b/base/sourcegraph/pgsql/pgsql.StatefulSet.yaml @@ -27,7 +27,7 @@ spec: spec: initContainers: - name: correct-data-dir-permissions - image: index.docker.io/sourcegraph/alpine-3.14:6.2.1106@sha256:9c9fef5b66e706103a6972feab18183f52c0efc8f1e2e32d8f4ffca196ef04fc + image: us-docker.pkg.dev/sourcegraph-images/internal/alpine-3.14:8.1.2687@sha256:1e113d9625cee4d32b995bb199ca7d6b6f5db1907404acc8ce9b272d39714963 command: ["sh", "-c", "if [ -d /data/pgdata-12 ]; then chmod 750 /data/pgdata-12; fi"] volumeMounts: - mountPath: /data @@ -46,7 +46,7 @@ spec: memory: "50Mi" containers: - name: pgsql - image: index.docker.io/sourcegraph/postgresql-16:6.2.1106@sha256:83bab9e63d9eaa7a9052e095af64983aab2c87fb11e6157f4f05fe95d8c22c32 + image: us-docker.pkg.dev/sourcegraph-images/internal/postgresql-16:8.1.2687@sha256:cc810cd21f1df7776aa270f49bdd50a4ec3375623ffae1f0238c20dec054bf03 terminationMessagePolicy: FallbackToLogsOnError readinessProbe: exec: @@ -90,7 +90,7 @@ spec: value: postgres://sg:@localhost:5432/?sslmode=disable - name: PG_EXPORTER_EXTEND_QUERY_PATH value: /config/queries.yaml - image: index.docker.io/sourcegraph/postgres_exporter:6.2.1106@sha256:8b289f196018c54ead72552a02c3a29f14bf1e5e199065129f303db5d41aa653 + image: us-docker.pkg.dev/sourcegraph-images/internal/postgres_exporter:8.1.2687@sha256:bd55116d35a5cfad9da760ebdf467166deaac550be44b915e407beace9b0ef3d terminationMessagePolicy: FallbackToLogsOnError name: pgsql-exporter ports: diff --git a/base/sourcegraph/precise-code-intel/worker.Deployment.yaml b/base/sourcegraph/precise-code-intel/worker.Deployment.yaml index 51933f3e..f3b66acb 100644 --- a/base/sourcegraph/precise-code-intel/worker.Deployment.yaml +++ b/base/sourcegraph/precise-code-intel/worker.Deployment.yaml @@ -49,7 +49,7 @@ spec: fieldPath: status.hostIP - name: OTEL_EXPORTER_OTLP_ENDPOINT value: http://$(OTEL_AGENT_HOST):4317 - image: index.docker.io/sourcegraph/precise-code-intel-worker:6.2.1106@sha256:f43dad61709c87c02bc0d3b43f1419529d76d0035362b5859b79a284191fcbe6 + image: us-docker.pkg.dev/sourcegraph-images/internal/precise-code-intel-worker:8.1.2687@sha256:560ef1edc769959af11f24d220b0dbd5c5c798be1d635e6e4fe06ff560b7835c terminationMessagePolicy: FallbackToLogsOnError livenessProbe: httpGet: diff --git a/base/sourcegraph/redis/redis-cache.Deployment.yaml b/base/sourcegraph/redis/redis-cache.Deployment.yaml index a1bb201a..f5bd9bee 100644 --- a/base/sourcegraph/redis/redis-cache.Deployment.yaml +++ b/base/sourcegraph/redis/redis-cache.Deployment.yaml @@ -26,7 +26,7 @@ spec: spec: containers: - name: redis-cache - image: index.docker.io/sourcegraph/redis-cache:6.2.1106@sha256:57b3318d4587f66582bf9c02756c67460e6c3d809aa0763f30cac18609cdbecc + image: us-docker.pkg.dev/sourcegraph-images/internal/redis-cache:8.1.2687@sha256:41035baa91623dff4275a5d496eb916c46bee260301d9991bbd1914c09c217f8 terminationMessagePolicy: FallbackToLogsOnError livenessProbe: initialDelaySeconds: 30 @@ -70,7 +70,7 @@ spec: - mountPath: /redis-data name: redis-data - name: redis-exporter - image: index.docker.io/sourcegraph/redis_exporter:6.2.1106@sha256:5974c85aae470ecd7c565862a16592887f4d111a28ef0e3bb1e400323540a397 + image: us-docker.pkg.dev/sourcegraph-images/internal/redis_exporter:8.1.2687@sha256:898666a0c7fc28b6b90f1f01893cb35668a97dbcc4f18056ca5f8d2ac89b2292 terminationMessagePolicy: FallbackToLogsOnError ports: - containerPort: 9121 diff --git a/base/sourcegraph/redis/redis-store.Deployment.yaml b/base/sourcegraph/redis/redis-store.Deployment.yaml index fc7d2281..3669e5d0 100644 --- a/base/sourcegraph/redis/redis-store.Deployment.yaml +++ b/base/sourcegraph/redis/redis-store.Deployment.yaml @@ -25,7 +25,7 @@ spec: spec: containers: - name: redis-store - image: index.docker.io/sourcegraph/redis-store:6.2.1106@sha256:74ce6130fa0e11e4c853129f24bcba6a4044def3d18f86e389b3064ec2193175 + image: us-docker.pkg.dev/sourcegraph-images/internal/redis-store:8.1.2687@sha256:b733fceadfa1863671ab11704e354573241217c4aa604aba64533c7bae101127 terminationMessagePolicy: FallbackToLogsOnError livenessProbe: initialDelaySeconds: 30 @@ -69,7 +69,7 @@ spec: - mountPath: /redis-data name: redis-data - name: redis-exporter - image: index.docker.io/sourcegraph/redis_exporter:6.2.1106@sha256:5974c85aae470ecd7c565862a16592887f4d111a28ef0e3bb1e400323540a397 + image: us-docker.pkg.dev/sourcegraph-images/internal/redis_exporter:8.1.2687@sha256:898666a0c7fc28b6b90f1f01893cb35668a97dbcc4f18056ca5f8d2ac89b2292 terminationMessagePolicy: FallbackToLogsOnError ports: - containerPort: 9121 diff --git a/base/sourcegraph/searcher/searcher.StatefulSet.yaml b/base/sourcegraph/searcher/searcher.StatefulSet.yaml index 5659d5a0..4d117dbf 100644 --- a/base/sourcegraph/searcher/searcher.StatefulSet.yaml +++ b/base/sourcegraph/searcher/searcher.StatefulSet.yaml @@ -49,7 +49,7 @@ spec: fieldPath: status.hostIP - name: OTEL_EXPORTER_OTLP_ENDPOINT value: http://$(OTEL_AGENT_HOST):4317 - image: index.docker.io/sourcegraph/searcher:6.2.1106@sha256:026fca70bfe2f2a91e867877a01f962adf3948a1cc5512c216ec45a5e41f164b + image: us-docker.pkg.dev/sourcegraph-images/internal/searcher:8.1.2687@sha256:acfbc9c127ebdbd4053ac835bcf90093f9d8bf4834a6275a549384db4eacd66f terminationMessagePolicy: FallbackToLogsOnError ports: - containerPort: 3181 diff --git a/base/sourcegraph/syntactic-code-intel/worker.Deployment.yaml b/base/sourcegraph/syntactic-code-intel/worker.Deployment.yaml index 66003da9..e6c10d17 100644 --- a/base/sourcegraph/syntactic-code-intel/worker.Deployment.yaml +++ b/base/sourcegraph/syntactic-code-intel/worker.Deployment.yaml @@ -40,7 +40,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.name - image: index.docker.io/sourcegraph/syntactic-code-intel-worker:6.0.0@sha256:50bdeb38b196f0fc21404969016bf8263f78144292e905867e93480f66c8251c + image: us-docker.pkg.dev/sourcegraph-images/internal/syntactic-code-intel-worker:8.1.2687@sha256:702609626636fd06c204a8a7e18941eb13df096784cea732d1c036069866cc40 terminationMessagePath: FallbackToLogsOnError livenessProbe: httpGet: diff --git a/base/sourcegraph/syntect-server/syntect-server.Deployment.yaml b/base/sourcegraph/syntect-server/syntect-server.Deployment.yaml index d4aada4f..e7420f11 100644 --- a/base/sourcegraph/syntect-server/syntect-server.Deployment.yaml +++ b/base/sourcegraph/syntect-server/syntect-server.Deployment.yaml @@ -32,7 +32,7 @@ spec: allowPrivilegeEscalation: false runAsGroup: 101 runAsUser: 100 - image: index.docker.io/sourcegraph/syntax-highlighter:6.2.1106@sha256:d44d14de2484019ee2a4f0c31d4000613fb299fc9447ec71f0e164224c176cd5 + image: us-docker.pkg.dev/sourcegraph-images/internal/syntax-highlighter:8.1.2687@sha256:9bbe53c18c2d864358ba95e4c89d000df60759e5d9fc0814b30d576efde55d95 terminationMessagePolicy: FallbackToLogsOnError livenessProbe: httpGet: diff --git a/base/sourcegraph/worker/worker.Deployment.yaml b/base/sourcegraph/worker/worker.Deployment.yaml index 19ceb147..44b46f20 100644 --- a/base/sourcegraph/worker/worker.Deployment.yaml +++ b/base/sourcegraph/worker/worker.Deployment.yaml @@ -51,7 +51,7 @@ spec: fieldPath: status.hostIP - name: OTEL_EXPORTER_OTLP_ENDPOINT value: http://$(OTEL_AGENT_HOST):4317 - image: index.docker.io/sourcegraph/worker:6.2.1106@sha256:fd6be67ea22f842246dbe81f64a60db027e5202f0ce863a0be4a82b12f908620 + image: us-docker.pkg.dev/sourcegraph-images/internal/worker:8.1.2687@sha256:5aa40853fc6a8223c373f291ce940f7258d2e882e8ffca7e31af04ec2f2f7922 terminationMessagePolicy: FallbackToLogsOnError livenessProbe: httpGet: From 1236a798369fc7b333b6aab45aad549a82962805 Mon Sep 17 00:00:00 2001 From: sourcegraph-bot-2 <87207425+sourcegraph-bot-2@users.noreply.github.com> Date: Thu, 29 Oct 2026 19:29:23 +0000 Subject: [PATCH 4/6] Update K8s images in executors to v8.1.2687 --- components/executors/dind/executor.Deployment.yaml | 4 ++-- components/executors/k8s/executor.Deployment.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/components/executors/dind/executor.Deployment.yaml b/components/executors/dind/executor.Deployment.yaml index 624c6938..87e43963 100644 --- a/components/executors/dind/executor.Deployment.yaml +++ b/components/executors/dind/executor.Deployment.yaml @@ -28,7 +28,7 @@ spec: spec: containers: - name: executor - image: index.docker.io/sourcegraph/executor:6.2.1106@sha256:1363cce32f2002594cad461380b223670e17de1f4466edee956a3404c7bbd172 + image: us-docker.pkg.dev/sourcegraph-images/internal/executor:8.1.2687@sha256:e9d0d598c1a7ab346fb7e9ccb341036fa71cce15e96b84a453e16a7831987e87 imagePullPolicy: Always livenessProbe: exec: @@ -60,7 +60,7 @@ spec: - mountPath: /scratch name: executor-scratch - name: dind - image: index.docker.io/sourcegraph/dind:6.2.1106@sha256:c64b5efff14ccd82cd6957283b116ef195d374ec911ea7fe56787b93143810fd + image: us-docker.pkg.dev/sourcegraph-images/internal/dind:8.1.2687@sha256:5145a833a7c0afbb9c2681ea7d49c997ba4a7bd75fe29f79fea42a43718356ee imagePullPolicy: Always securityContext: privileged: true diff --git a/components/executors/k8s/executor.Deployment.yaml b/components/executors/k8s/executor.Deployment.yaml index 1fc0277b..b8c9718f 100644 --- a/components/executors/k8s/executor.Deployment.yaml +++ b/components/executors/k8s/executor.Deployment.yaml @@ -29,7 +29,7 @@ spec: serviceAccountName: executor containers: - name: executor - image: index.docker.io/sourcegraph/executor-kubernetes:6.2.1106@sha256:6b9967ae0a57ccd54bb85347929692f709f921880e1ee4366f5114d8d6f0b59c + image: us-docker.pkg.dev/sourcegraph-images/internal/executor-kubernetes:8.1.2687@sha256:59168747fea24f4636c581d1731c06e80d9e0de9c396cb925959c7450c4ab514 imagePullPolicy: Always livenessProbe: exec: From e4a1885536fca699645f9ad1a681f0fa51b180ae Mon Sep 17 00:00:00 2001 From: sourcegraph-bot-2 <87207425+sourcegraph-bot-2@users.noreply.github.com> Date: Thu, 29 Oct 2026 19:29:27 +0000 Subject: [PATCH 5/6] Update K8s images in migrator to v8.1.2687 --- components/utils/migrator/resources/migrator.Job.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/utils/migrator/resources/migrator.Job.yaml b/components/utils/migrator/resources/migrator.Job.yaml index 2f01a9d6..5c7fdcf1 100644 --- a/components/utils/migrator/resources/migrator.Job.yaml +++ b/components/utils/migrator/resources/migrator.Job.yaml @@ -12,7 +12,7 @@ spec: spec: containers: - name: migrator - image: index.docker.io/sourcegraph/migrator:5.1.6@sha256:76facd38029ee611e5bee723736e42eedb633b2c31d4494711c55f59906a5f93 + image: us-docker.pkg.dev/sourcegraph-images/internal/migrator:8.1.2687@sha256:c5bf0f81f3b07f7769f694525bef0a2d547a554f99113115a33b0925a16ef5ea args: ["up"] envFrom: - configMapRef: From 9841425e4e46721cf0f3816eec3d15a688c4ad52 Mon Sep 17 00:00:00 2001 From: sourcegraph-bot-2 <87207425+sourcegraph-bot-2@users.noreply.github.com> Date: Thu, 29 Oct 2026 19:29:28 +0000 Subject: [PATCH 6/6] release: v8.1.2687 {"version":"v8.1.2687","inputs":"server=v8.1.2687","type":"patch"}