Skip to content
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions .github/workflows/build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,8 @@ on:

env:
MANYLINUX_VERSION: manylinux_2_28
# Pinned to 2025.08.15-1 since manylinux 2025.08.22 onward removes setuptools
MANYLINUX_PIN: 2025.08.15-1

jobs:
python-wheel-mac:
Expand Down Expand Up @@ -60,12 +62,12 @@ jobs:

- if: matrix.build-arch == 'aarch64'
name: Build in Docker (aarch64)
run: make wheel-manylinux-aarch64 IMAGE=messense/"$MANYLINUX_VERSION"-cross:aarch64-amd64
run: make wheel-manylinux-aarch64 IMAGE=messense/"$MANYLINUX_VERSION"-cross:aarch64-amd64:"$MANYLINUX_PIN"

- if: matrix.build-arch == 'x86_64'
name: Build in Docker (x86_64)
run: make wheel-manylinux IMAGE=quay.io/pypa/"$MANYLINUX_VERSION"_x86_64

run: make wheel-manylinux IMAGE=quay.io/pypa/"$MANYLINUX_VERSION"_x86_64:"$MANYLINUX_PIN"

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Potential bug: Appending :$MANYLINUX_PIN to Docker image names creates an invalid reference for the aarch64 build and likely references a non-existent tag for the x86_64 build.
  • Description: The change appends the MANYLINUX_PIN variable to the Docker image names for both the aarch64 and x86_64 wheel builds. For the aarch64 build on line 65, this results in an invalid image reference messense/manylinux_2_28-cross:aarch64-amd64:2025.08.15-1, which contains multiple colons and violates Docker's repository:tag format. For the x86_64 build on line 70, it creates a reference to quay.io/pypa/manylinux_2_28_x86_64:2025.08.15-1. This date-based tagging scheme does not appear to be used by the pypa/manylinux repository. In both cases, the docker command will fail when it cannot pull the specified image, causing the build pipeline to crash.

  • Suggested fix: The MANYLINUX_PIN variable should not be appended directly. Instead, verify the correct tagging scheme for both messense/manylinux-cross and quay.io/pypa/manylinux images. The image references should be updated to use existing, valid tags that contain the required version of setuptools. This may involve finding a different base image or using a different pinning strategy.
    severity: 0.9, confidence: 0.95

Did we get this right? 👍 / 👎 to inform future reviews.

- uses: actions/upload-artifact@v4
with:
name: artifact-linux-${{ matrix.build-arch }}
Expand Down
Loading