module-pack: the --bind-to-image probe captures the tester's usage before judging it (no grep -q on a live pipe) by rbuergi · Pull Request #3364 · Systemorph/MeshWeaver

rbuergi · 2026-09-05T19:48:55Z

Summary

The --bind-to-image probe added in #3358 was written as docker run … build-project --help 2>&1 | grep -q -- '--bind-to-image' inside a step that runs under set -euo pipefail. grep -q exits on its first match and closes the pipe; docker run then dies with EPIPE on its next write and pipefail reports the pipeline as failed although the flag was printed. It is a coin toss on timing: MeshWeaver.Plugins#1371's first run passed the probe and its second failed it with the same tester and the same image, and both print the flag when run by hand (3.1.0-ci.7835's tester inside its own portal image). The probe also swallowed the output it judged, so the failure could not say why.

Now the usage is captured first (usage=$(docker run …), no live pipe). A non-zero exit prints the tail and names the tester app and platform image, saying that a cache entry restored broken reads exactly like this; only a clean run whose usage lacks the flag names the pin to move.

Verification

actionlint: the same 7 pre-existing shellcheck infos as main, nothing new; check-workflow-shell.py --root . 0 live findings; check-workflow-timeouts.py 65 jobs, 0 violations.
Shape proven locally: a pipefail pipeline into grep -q returns 141 (SIGPIPE) on a producer that keeps writing after the match.

No What's New entry: CI lane plumbing, nothing a user can notice.

Pairs-with: none — a workflow-only change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JuXoLRvG9TfKh5mgnjGfmo

…fore judging it `docker run … build-project --help 2>&1 | grep -q -- '--bind-to-image'` under `set -o pipefail` is a coin toss: grep -q exits on its first match and closes the pipe, docker dies with EPIPE on its next write, and the pipeline reports failure although the flag was printed. Plugins#1371's first run passed the probe and its second failed it, same tester, same image — and both print the flag when run by hand (measured on 3.1.0-ci.7835's tester inside its portal image). The probe also swallowed the output it judged, so a failure could not say why. Now the usage is captured first; a non-zero exit prints the tail and names the tester app / image (the cache-entry shape reads exactly like this), and only a clean run without the flag names the pin to move. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JuXoLRvG9TfKh5mgnjGfmo

Copilot

🟢 Approval recommended

The change is a targeted workflow robustness fix consistent with the stated failure mode, and only raises an optional maintainability nit.

Pull request overview

This PR fixes a flaky CI probe in the node-repo-module-pack workflow where docker run … | grep -q could fail under set -euo pipefail due to grep -q closing the pipe early (SIGPIPE/EPIPE), even when the probed flag is present. It changes the probe to capture the tester’s --help output first and only then evaluate it, while also emitting actionable diagnostics when the probe cannot run.

Changes:

Capture build-project --help output into a variable (no live pipe) before checking for --bind-to-image.
Add clearer error reporting for the “tester cannot run in pinned image” case, including a tail of output and pin/cache hints.
Print a snippet of usage when the flag is absent, so failures explain what was actually observed.

File summaries

File	Description
.github/workflows/node-repo-module-pack.yml	Makes the `--bind-to-image` capability probe deterministic under `pipefail` and improves failure diagnostics.

Review details

Files reviewed: 1/1 changed files
Comments generated: 1
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

github-actions · 2026-09-05T19:53:12Z