From 4354006df2028bbfdff8d00e0c27953ebfd1cdb4 Mon Sep 17 00:00:00 2001 From: Kevin Veen-Birkenbach Date: Tue, 6 Oct 2026 08:19:16 +0200 Subject: [PATCH] feat(meta): keep the matrix off arm64 for the five roles that cannot run it An undeclared role takes whatever architecture the rotation hands it, so a role whose image ships only linux/amd64 dies on an arm64 node with an exec format error. The architecture sweep reported five of them; each now declares amd64 and says why, as the pin lint requires. The reasons carry no TODO. A TODO promises a near handle, and four of these five have none: checkmk the Raw edition exists only as the vendor's appliance image, and every 2.4 and 2.5 tag answers amd64, so there is nothing to pin to and nothing to build from chess v1.0.1 is amd64, but the image is ours: its workflow now builds linux/amd64,linux/arm64, so the next release lifts the pin decidim no arm64 tag upstream; arm64 means building the Rails application from source the way web-app-pretix does pixelfed the official image does carry arm64 but serves FrankenPHP and Caddy on 8080 out of /var/www/html where this role expects nginx on 80 out of /var/www, so it is a rewrite, not a repin taiga all four of the stack's images are amd64-only, not just the two the sweep happened to name Every reason is a registry reading, not a guess: ten checkmk tags across two minor lines, the two newest numeric tags of each taiga image, and both pixelfed images' config blobs compared for entrypoint, command, ports and working directory. Co-Authored-By: Claude Opus 5 (1M context) --- roles/web-app-checkmk/meta/services.yml | 3 +++ roles/web-app-chess/meta/services.yml | 3 +++ roles/web-app-decidim/meta/services.yml | 3 +++ roles/web-app-pixelfed/meta/services.yml | 3 +++ roles/web-app-taiga/meta/services.yml | 3 +++ 5 files changed, 15 insertions(+) diff --git a/roles/web-app-checkmk/meta/services.yml b/roles/web-app-checkmk/meta/services.yml index 6173504b02..2e3a68d360 100644 --- a/roles/web-app-checkmk/meta/services.yml +++ b/roles/web-app-checkmk/meta/services.yml @@ -49,6 +49,9 @@ prometheus: shared: "{{ 'web-app-prometheus' in group_names }}" # nocheck: playwright-service-flag self-provider checkmk: + # nocheck: architecture-pin Reason: checkmk ships the Raw edition as an appliance image only, and every 2.4 and 2.5 tag of checkmk/check-mk-raw answers with a single linux/amd64 manifest, so there is nothing to pin to and nothing to build from + architectures: + - amd64 enabled: true shared: true bond: 1 diff --git a/roles/web-app-chess/meta/services.yml b/roles/web-app-chess/meta/services.yml index a147ac34e8..f74d3d5581 100644 --- a/roles/web-app-chess/meta/services.yml +++ b/roles/web-app-chess/meta/services.yml @@ -23,6 +23,9 @@ postgres: enabled: true # nocheck: dynamic-flag shared: "{{ 'svc-db-postgres' in group_names }}" chess: + # nocheck: architecture-pin Reason: the published v1.0.1 of ghcr.io/kevinveenbirkenbach/fedi-chess is a single linux/amd64 manifest; its workflow now builds linux/amd64,linux/arm64, so the next release makes this declaration removable + architectures: + - amd64 healthcheck: flavor: curl modes: diff --git a/roles/web-app-decidim/meta/services.yml b/roles/web-app-decidim/meta/services.yml index a764a122c0..5c5413298c 100644 --- a/roles/web-app-decidim/meta/services.yml +++ b/roles/web-app-decidim/meta/services.yml @@ -27,6 +27,9 @@ postgres: shared: "{{ 'svc-db-postgres' in group_names }}" enabled: true # nocheck: dynamic-flag decidim: + # nocheck: architecture-pin Reason: ghcr.io/decidim/decidim publishes a single linux/amd64 manifest and upstream offers no arm64 tag, so reaching arm64 means building the Rails application from source the way web-app-pretix does, which this role does not + architectures: + - amd64 healthcheck: flavor: curl path: up diff --git a/roles/web-app-pixelfed/meta/services.yml b/roles/web-app-pixelfed/meta/services.yml index be8a82d596..1f621849a8 100644 --- a/roles/web-app-pixelfed/meta/services.yml +++ b/roles/web-app-pixelfed/meta/services.yml @@ -40,6 +40,9 @@ mariadb: shared: "{{ 'svc-db-mariadb' in group_names }}" # nocheck: playwright-service-flag — self-provider pixelfed: + # nocheck: architecture-pin Reason: zknt/pixelfed publishes a single linux/amd64 manifest; the official ghcr.io/pixelfed/pixelfed does carry arm64 but serves FrankenPHP and Caddy on 8080 out of /var/www/html where this role expects nginx on 80 out of /var/www, so adopting it is a rewrite of the role rather than a repin + architectures: + - amd64 modes: compose: enabled: true diff --git a/roles/web-app-taiga/meta/services.yml b/roles/web-app-taiga/meta/services.yml index d66c2fe8c6..8e221004ae 100644 --- a/roles/web-app-taiga/meta/services.yml +++ b/roles/web-app-taiga/meta/services.yml @@ -35,6 +35,9 @@ postgres: enabled: true # nocheck: dynamic-flag shared: "{{ 'svc-db-postgres' in group_names }}" taiga: + # nocheck: architecture-pin Reason: every tag of taiga-back, taiga-front, taiga-events and taiga-protected answers with a single linux/amd64 manifest, so arm64 would mean building all four of the stack's images from source rather than one + architectures: + - amd64 healthcheck: test: ["CMD", "python", "-c", "import socket; socket.create_connection(('127.0.0.1',8000),5).close()"] retries: 5