From e14e73fba0faefed34cb87196cbcd3b23bf319da Mon Sep 17 00:00:00 2001 From: Kevin Veen-Birkenbach Date: Thu, 17 Sep 2026 17:47:02 +0200 Subject: [PATCH] refactor(docker): let a moving tag declare itself with the marker it already has A pin outside semver was given its own 'docker-ref' marker on the theory that every class needs one. That holds for a digest and not for a tag. A digest pin declares something about the registry, that bytes move under a standing tag, which no other choice says. A tag outside semver declares that upstream publishes nothing orderable, which is exactly what 'docker-version' already means and what minio and the act runner already carry on their version lines. Keeping both would have put '# nocheck: docker-version, docker-ref' on every such line: two keys, two checks, one sentence said twice. 'docker-ref' is dropped instead. It lived in this one mapping, was never entered in the suppression catalog, and no check ever read it. The semver entry goes with it, because a semver pin never needs a declaration. The test that asserted three distinct rules is replaced by two that pin the separation where it is real: a digest marker differs from a tag marker, and a semver pin has no marker at all. Co-Authored-By: Claude Opus 5 (1M context) --- tests/unit/python/utils/docker/test_image_pin.py | 15 +++++++++++---- utils/docker/image/pin.py | 3 +-- 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/tests/unit/python/utils/docker/test_image_pin.py b/tests/unit/python/utils/docker/test_image_pin.py index 1b7b7e949f..a8737c8157 100644 --- a/tests/unit/python/utils/docker/test_image_pin.py +++ b/tests/unit/python/utils/docker/test_image_pin.py @@ -33,11 +33,18 @@ class TestPinClass(unittest.TestCase): self.assertEqual(pin_class(f" {DIGEST_VALUE} "), DIGEST) self.assertEqual(pin_class(" 3.0.1 "), SEMVER) - def test_every_class_has_its_own_rule(self): - rules = [RULE_BY_CLASS[SEMVER], RULE_BY_CLASS[DIGEST], RULE_BY_CLASS[REF]] + def test_a_digest_declares_itself_apart_from_a_tag(self): + self.assertNotEqual( + RULE_BY_CLASS[DIGEST], + RULE_BY_CLASS[REF], + "a digest is chosen for a reason a non-semver tag never carries, so " + "the two cannot share one marker", + ) + self.assertEqual(RULE_BY_CLASS[DIGEST], "docker-digest") + self.assertEqual(RULE_BY_CLASS[REF], "docker-version") - self.assertEqual(len(set(rules)), 3, "a shared rule cannot express intent") - self.assertEqual(rules, ["docker-version", "docker-digest", "docker-ref"]) + def test_a_semver_pin_needs_no_declaration(self): + self.assertNotIn(SEMVER, RULE_BY_CLASS) class TestPullReference(unittest.TestCase): diff --git a/utils/docker/image/pin.py b/utils/docker/image/pin.py index 4ddfce88e5..11b4ec7e41 100644 --- a/utils/docker/image/pin.py +++ b/utils/docker/image/pin.py @@ -7,9 +7,8 @@ DIGEST = "digest" REF = "ref" RULE_BY_CLASS = { - SEMVER: "docker-version", DIGEST: "docker-digest", - REF: "docker-ref", + REF: "docker-version", }