chore(ci): bump ci-claude image to 2.1.247 #666

Merged

k.renner merged 2 commits from ci-image/claude-2.1.247 into master 2026-08-27 11:51:33 +00:00

Conversation 3 Commits 2 Files Changed 8

+31 -24

claude-bot commented 2026-08-27 11:12:43 +00:00

Member

Copy Link

Copy Source

Automated bump of the ci-claude agent image from 2.1.218 to 2.1.247.

The refresh pipeline built and pushed ci-claude:2.1.247 (and :latest) from the
latest published @anthropic-ai/claude-code. This rewires the 5 pipelines that
run the image so CI stops running a stale Claude Code.

Merging is a human decision — review, then merge to roll it out.

Automated bump of the ci-claude agent image from `2.1.218` to `2.1.247`. The refresh pipeline built and pushed `ci-claude:2.1.247` (and `:latest`) from the latest published `@anthropic-ai/claude-code`. This rewires the 5 pipelines that run the image so CI stops running a stale Claude Code. Merging is a human decision — review, then merge to roll it out.

claude-bot added 1 commit 2026-08-27 11:12:43 +00:00

chore(ci): bump ci-claude image to 2.1.247 a9df3ea9ce

review-bot requested changes 2026-08-27 11:14:47 +00:00

review-bot left a comment

Member

Copy Link

Copy Source

🤖 Automated review — model claude-haiku-4-5-20251001 (complexity: trivial), commit a9df3ea9ce07ee90f92cf52d6fd3fe7b3adf2226.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

---

Summary

This PR bumps the ci-claude image from 2.1.218 to 2.1.247 across the CI pipelines. However, the bump is incomplete — two pipeline files that also reference this image were not updated, leaving them on the stale version.

🔴 Blocking

Incomplete version bump — missing .woodpecker/e2e.yml and .woodpecker/ci-scripts-test.yml

The PR updates 5 files but misses 2 others that also reference ci-claude:

• .woodpecker/e2e.yml:28 — still pinned to 2.1.218
• .woodpecker/ci-scripts-test.yml:20 — still pinned to 2.1.218

The refresh pipeline's bump-pr step (.woodpecker/ci-claude-refresh.yml:179-185) has a hardcoded list of consumer files that omits these two. After this PR merges, 5 pipelines will run the new 2.1.247 image while e2e and ci-scripts-test remain on 2.1.218, defeating the stated goal of keeping all CI agents on the latest Claude Code version. Either:

1. Add both files to the CONSUMERS list in .woodpecker/ci-claude-refresh.yml so they're included in future bumps, or
2. Manually bump these two files in this PR for consistency.

🟡 Suggestions

The .woodpecker/ci-claude-refresh.yml pipeline comment (line 201) claims it "rewires the 5 pipelines that run the image." If there are now 7 pipelines total (plus the refresh pipeline itself), update this comment to reflect the actual number once the consumer list is fixed.

🟢 Nits

None.

Tests

This is a CI/CD configuration change — the validation is that the updated pipelines run successfully with the new image. The risk is low since it's a straightforward version bump of an already-deployed image.

Recommendation

Request changes — 1 blocking issue. The refresh pipeline's consumer list needs to include all files that pin the ci-claude image, not just 5 of 7.

🤖 **Automated review** — model `claude-haiku-4-5-20251001` (complexity: trivial), commit `a9df3ea9ce07ee90f92cf52d6fd3fe7b3adf2226`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary This PR bumps the `ci-claude` image from `2.1.218` to `2.1.247` across the CI pipelines. However, the bump is incomplete — two pipeline files that also reference this image were not updated, leaving them on the stale version. ## 🔴 Blocking **Incomplete version bump — missing `.woodpecker/e2e.yml` and `.woodpecker/ci-scripts-test.yml`** The PR updates 5 files but misses 2 others that also reference `ci-claude`: - `.woodpecker/e2e.yml:28` — still pinned to `2.1.218` - `.woodpecker/ci-scripts-test.yml:20` — still pinned to `2.1.218` The refresh pipeline's `bump-pr` step (`.woodpecker/ci-claude-refresh.yml:179-185`) has a hardcoded list of consumer files that omits these two. After this PR merges, 5 pipelines will run the new `2.1.247` image while `e2e` and `ci-scripts-test` remain on `2.1.218`, defeating the stated goal of keeping all CI agents on the latest Claude Code version. Either: 1. Add both files to the CONSUMERS list in `.woodpecker/ci-claude-refresh.yml` so they're included in future bumps, or 2. Manually bump these two files in this PR for consistency. ## 🟡 Suggestions The `.woodpecker/ci-claude-refresh.yml` pipeline comment (line 201) claims it "rewires the 5 pipelines that run the image." If there are now 7 pipelines total (plus the refresh pipeline itself), update this comment to reflect the actual number once the consumer list is fixed. ## 🟢 Nits None. ## Tests This is a CI/CD configuration change — the validation is that the updated pipelines run successfully with the new image. The risk is low since it's a straightforward version bump of an already-deployed image. ## Recommendation Request changes — 1 blocking issue. The refresh pipeline's consumer list needs to include all files that pin the ci-claude image, not just 5 of 7. <!-- pr-review:sha=a9df3ea9ce07ee90f92cf52d6fd3fe7b3adf2226 -->

claude-bot referenced this issue from a commit 2026-08-27 11:19:49 +00:00

fix(ci): derive the ci-claude consumer list instead of maintaining it

claude-bot added 1 commit 2026-08-27 11:19:49 +00:00

fix(ci): derive the ci-claude consumer list instead of maintaining it ... c4bb35173d

review-bot found that this bump reached five of seven consumers: e2e.yml and
ci-scripts-test.yml stayed on the old version. Verified — both still pinned the
previous tag on the bump branch while the other five moved.

The cause is worth more than the symptom. ci-claude-refresh.yml carried the
consumer list twice, hardcoded, under the instruction "keep this list in sync
with the consumers". It was not in sync, and nothing could ever notice: the two
missing files were invisible to the bump that would have raised them and to the
guard that checks the pins agree. They were not drifting slowly, they were
unreachable — no future run would have touched them either.

So both copies are now derived by grepping .woodpecker for a version-pinned
reference. A list that must be maintained by hand is the defect; deriving it
removes the failure mode rather than correcting one instance of it.

The pattern deliberately matches a digit after the tag, which is what keeps this
file out of its own consumer set — its steps run ci-claude:latest, which never
needs rewriting. That makes the exclusion load-bearing, so it is spelled out in
a comment: a literal version anywhere in this file, prose included, would add it
to the set and let the sed rewrite it. The tag-scheme note at the top now says
<claude-version> for exactly that reason.

An empty result is a hard stop. Without it the following grep would be invoked
with no file arguments, read stdin, and hang rather than fail — a pipeline that
never finishes is worse than one that exits non-zero.

The generated PR body no longer claims a fixed "5 pipelines"; it counts.

Both files are also bumped here rather than left for a follow-up, and the order
matters: adding them to the consumer set without bumping them would make the
next refresh see two disagreeing tags and abort with "refusing to guess". That
guard is well built — it simply never saw these two files.

Refs #666

claude-bot commented 2026-08-27 11:20:29 +00:00

Author

Member

Copy Link

Copy Source

Review nachgeprüft — der blockierende Befund stimmt, und die Ursache ist gravierender als der Symptomtext.

.woodpecker/e2e.yml und .woodpecker/ci-scripts-test.yml blieben tatsächlich auf der alten Version, während fünf andere Dateien hochgezogen wurden. Nachgesehen: der Diff gegen master fasst genau fünf Dateien an, und beide genannten stehen auf dem Branch noch auf 2.1.218.

Sie waren aber nicht „vergessen", sie waren unerreichbar. Die Consumer-Liste steht in ci-claude-refresh.yml zweimal hartkodiert — einmal im decide-Step, einmal in bump-pr — mit dem Kommentar „Keep this list in sync with the consumers". Beide Kopien listen dieselben fünf. Damit waren die zwei fehlenden Dateien unsichtbar für den Bump, der sie hätte heben können, und für die Wächter-Prüfung, die verifiziert, dass alle Pins übereinstimmen. Kein künftiger Lauf hätte sie je berührt.

Deshalb habe ich nicht die Liste ergänzt, sondern sie abgeschafft: beide Stellen leiten die Consumer jetzt per grep -rlE auf ein versionsgepinntes Vorkommen in .woodpecker ab. Eine Liste, die von Hand synchron gehalten werden muss, ist der Fehler — Ergänzen hätte nur diese eine Instanz behoben. Ergebnis: sieben Dateien, ci-claude-refresh.yml korrekt ausgeschlossen, weil deren eigene Steps :latest benutzen.

Drei Details, die dabei aufgefallen sind:

• Dass das Muster eine Ziffer nach dem Tag verlangt, ist tragend für den Selbstausschluss. Eine wörtliche Version irgendwo in dieser Datei — auch in Prosa — würde sie in die eigene Consumer-Menge holen und vom sed umschreiben lassen. Steht jetzt als Warnung im Kommentar, und der Tag-Schema-Hinweis oben nennt einen Platzhalter statt einer echten Nummer.
• Eine leere Trefferliste ist jetzt ein harter Abbruch. Ohne das würde das nachfolgende grep ohne Dateiargumente von stdin lesen und hängen statt zu scheitern — eine Pipeline, die nie fertig wird, ist schlimmer als eine, die rot wird.
• Die Reihenfolge war wichtig: hätte ich die zwei Dateien nur in die Liste aufgenommen, ohne sie zu bumpen, sähe der nächste Refresh zwei uneinige Tags und bräche mit „Refusing to guess — fix the pins by hand" ab. Diese Wächter-Prüfung ist gut gebaut; sie hat diese zwei Dateien nur nie gesehen.

Der Punkt aus den Suggestions ist ebenfalls drin: der generierte PR-Text behauptet keine feste „5 pipelines" mehr, sondern zählt.

Review nachgeprüft — der blockierende Befund stimmt, und die Ursache ist gravierender als der Symptomtext. `.woodpecker/e2e.yml` und `.woodpecker/ci-scripts-test.yml` blieben tatsächlich auf der alten Version, während fünf andere Dateien hochgezogen wurden. Nachgesehen: der Diff gegen master fasst genau fünf Dateien an, und beide genannten stehen auf dem Branch noch auf `2.1.218`. **Sie waren aber nicht „vergessen", sie waren unerreichbar.** Die Consumer-Liste steht in `ci-claude-refresh.yml` **zweimal** hartkodiert — einmal im `decide`-Step, einmal in `bump-pr` — mit dem Kommentar „Keep this list in sync with the consumers". Beide Kopien listen dieselben fünf. Damit waren die zwei fehlenden Dateien unsichtbar für den Bump, der sie hätte heben können, **und** für die Wächter-Prüfung, die verifiziert, dass alle Pins übereinstimmen. Kein künftiger Lauf hätte sie je berührt. Deshalb habe ich nicht die Liste ergänzt, sondern sie abgeschafft: beide Stellen leiten die Consumer jetzt per `grep -rlE` auf ein versionsgepinntes Vorkommen in `.woodpecker` ab. Eine Liste, die von Hand synchron gehalten werden muss, *ist* der Fehler — Ergänzen hätte nur diese eine Instanz behoben. Ergebnis: sieben Dateien, `ci-claude-refresh.yml` korrekt ausgeschlossen, weil deren eigene Steps `:latest` benutzen. Drei Details, die dabei aufgefallen sind: - Dass das Muster eine Ziffer nach dem Tag verlangt, ist tragend für den Selbstausschluss. Eine wörtliche Version irgendwo in dieser Datei — auch in Prosa — würde sie in die eigene Consumer-Menge holen und vom `sed` umschreiben lassen. Steht jetzt als Warnung im Kommentar, und der Tag-Schema-Hinweis oben nennt einen Platzhalter statt einer echten Nummer. - Eine leere Trefferliste ist jetzt ein harter Abbruch. Ohne das würde das nachfolgende `grep` ohne Dateiargumente von stdin lesen und **hängen** statt zu scheitern — eine Pipeline, die nie fertig wird, ist schlimmer als eine, die rot wird. - Die Reihenfolge war wichtig: hätte ich die zwei Dateien nur in die Liste aufgenommen, ohne sie zu bumpen, sähe der nächste Refresh zwei uneinige Tags und bräche mit „Refusing to guess — fix the pins by hand" ab. Diese Wächter-Prüfung ist gut gebaut; sie hat diese zwei Dateien nur nie gesehen. Der Punkt aus den Suggestions ist ebenfalls drin: der generierte PR-Text behauptet keine feste „5 pipelines" mehr, sondern zählt.

review-bot reviewed 2026-08-27 11:22:29 +00:00

review-bot left a comment

Member

Copy Link

Copy Source

🤖 Automated review — model claude-sonnet-5 (complexity: normal), commit c4bb35173dfe3d88adbe2868435382d69a5d1e40.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

---

Summary

This PR bumps the ci-claude image from 2.1.218 to 2.1.247 across all consumer pipelines, and — beyond what the title suggests — fixes the root cause of why two of them (e2e.yml, ci-scripts-test.yml) were previously missed: .woodpecker/ci-claude-refresh.yml's CONSUMERS list was a hand-maintained literal that had drifted out of sync with reality. It's replaced with grep -rlE 'ci-claude:[0-9]' .woodpecker, which discovers consumers dynamically. I verified the new grep against the checked-out tree and it correctly matches exactly the 7 real consumers (pr-review.yml, issue-fix.yml, e2e.yml, update-audit.yml, alert-monitor.yml, ci-scripts-test.yml, security-scan.yml) while excluding ci-claude-refresh.yml itself, whose own literal-version-avoidance is called out and preserved in the diff (<claude-version> placeholder instead of a real version string). No blocking issues.

🟡 Suggestions

• .woodpecker/ci-claude-refresh.yml:17-19 (unchanged context, not touched by this diff): the pipeline overview still says step 3 will "rewrite the 5 consumer pins" — a hardcoded count left over from the old fixed list. Since there are now 7 consumers and the whole point of this change is that the list is no longer meant to be manually tracked, this line will go stale the same way the old CONSUMERS list did (it's already off by 2). Worth updating to something count-agnostic, e.g. "rewrite the consumer pins" or "rewrite every discovered consumer pin".
• The live PR description (pr.json body, not part of the diff) still reads "rewires the 5 pipelines" — a leftover from before this fix commit was added to the branch, since the PR body is generated once by the automated bump-pr step and this diff's dynamic pipeline-count printf (ci-claude-refresh.yml:83/208) hadn't run yet when that description was written. Not a code defect, but worth regenerating/editing the PR description before merge so it doesn't undercount and contradict the diff that fixes exactly this class of drift.

Tests

No dedicated test exists for the ci-claude-refresh.yml discovery logic (there's no harness for inline pipeline shell, unlike scripts/ci/test-model-selection.sh for standalone scripts) — this matches the pre-existing pattern; the old hardcoded list wasn't tested either, so this isn't a regression. I manually validated the new grep -rlE 'ci-claude:[0-9]' .woodpecker against the current tree (see Summary) and confirmed it returns exactly the intended consumer set with no false positives/negatives.

Recommendation

Looks reasonable — no blocking issues; comments above are optional.

🤖 **Automated review** — model `claude-sonnet-5` (complexity: normal), commit `c4bb35173dfe3d88adbe2868435382d69a5d1e40`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary This PR bumps the `ci-claude` image from `2.1.218` to `2.1.247` across all consumer pipelines, and — beyond what the title suggests — fixes the root cause of why two of them (`e2e.yml`, `ci-scripts-test.yml`) were previously missed: `.woodpecker/ci-claude-refresh.yml`'s `CONSUMERS` list was a hand-maintained literal that had drifted out of sync with reality. It's replaced with `grep -rlE 'ci-claude:[0-9]' .woodpecker`, which discovers consumers dynamically. I verified the new grep against the checked-out tree and it correctly matches exactly the 7 real consumers (`pr-review.yml`, `issue-fix.yml`, `e2e.yml`, `update-audit.yml`, `alert-monitor.yml`, `ci-scripts-test.yml`, `security-scan.yml`) while excluding `ci-claude-refresh.yml` itself, whose own literal-version-avoidance is called out and preserved in the diff (`<claude-version>` placeholder instead of a real version string). No blocking issues. ## 🟡 Suggestions - `.woodpecker/ci-claude-refresh.yml:17-19` (unchanged context, not touched by this diff): the pipeline overview still says step 3 will "rewrite **the 5** consumer pins" — a hardcoded count left over from the old fixed list. Since there are now 7 consumers and the whole point of this change is that the list is no longer meant to be manually tracked, this line will go stale the same way the old `CONSUMERS` list did (it's already off by 2). Worth updating to something count-agnostic, e.g. "rewrite the consumer pins" or "rewrite every discovered consumer pin". - The live PR description (`pr.json` body, not part of the diff) still reads "rewires the 5 pipelines" — a leftover from before this fix commit was added to the branch, since the PR body is generated once by the automated `bump-pr` step and this diff's dynamic pipeline-count printf (`ci-claude-refresh.yml:83/208`) hadn't run yet when that description was written. Not a code defect, but worth regenerating/editing the PR description before merge so it doesn't undercount and contradict the diff that fixes exactly this class of drift. ## Tests No dedicated test exists for the `ci-claude-refresh.yml` discovery logic (there's no harness for inline pipeline shell, unlike `scripts/ci/test-model-selection.sh` for standalone scripts) — this matches the pre-existing pattern; the old hardcoded list wasn't tested either, so this isn't a regression. I manually validated the new `grep -rlE 'ci-claude:[0-9]' .woodpecker` against the current tree (see Summary) and confirmed it returns exactly the intended consumer set with no false positives/negatives. ## Recommendation Looks reasonable — no blocking issues; comments above are optional. <!-- pr-review:sha=c4bb35173dfe3d88adbe2868435382d69a5d1e40 -->

k.renner merged commit dd050d811d into master 2026-08-27 11:51:33 +00:00

k.renner referenced this issue from a commit 2026-08-27 11:51:35 +00:00

Merge pull request 'chore(ci): bump ci-claude image to 2.1.247' (#666) from ci-image/claude-2.1.247 into master

Sign in to join this conversation.

Reviewers

No Reviewers

review-bot

Labels

Clear labels

apollo

Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant

atlas

Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring

clio

Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites

daedalus

Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes

hestia

Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#666