test(e2e): pin Compose shutdown sidecars to Devsy GHCR

[skevetter]

The two Compose shutdown fixtures currently pull alpine:latest from Docker Hub solely to keep a sidecar running with sleep infinity. Pin those two sidecars to the existing public Devsy Alpine base at sha256:fbd195076b0c5d37580debed78de5e4dd238436cd5aa348339a4d48463ff71ae.

This is role-specific reuse of a richer Alpine 3.23 Dev Container image. Anonymous source/candidate pulls and Compose checks on Linux arm64 and amd64 verified root runtime user, working directory /, PID 1 sleep, temporary-file access, and unchanged stop behavior. The app images, commands, mounts, shutdown configuration, test bodies and timeouts are unchanged. No image publication is needed for this slice.

Closes #1451.

Parent migration tracker: #1449 remains open for verified bare runtime mirrors, service-image mirrors and the later inventory guard.

Validation:

• Both existing shutdown regression cases and the reused missing-app secret recovery case pass (3/3) against the reviewed change.
• Framework and Compose unit tests pass; applicable pre-commit, commit-message and pre-push hooks pass. task cli:lint:ci reports zero issues.
• Local CodeRabbit covers both changed files with zero findings; independent source review finds no defect. CodeScene does not support YAML, so no analyzer score is claimed.
• Full unchanged up-docker-compose label: 49 passed, 6 failed in 798.527 seconds. All three changed-fixture cases pass in this full run too; a read-only observer verified both pinned shutdown sidecars running before stop. Failures: two UID-mapping checks reproduced with unchanged main fixtures; three macOS Feature-copy lchown: operation not permitted errors reproduced separately with unchanged fixtures; and the unchanged multistage build after Debian HTTP package-download failures exhausted the configured retries. All six failure identities reproduce against unchanged main 56485803a98ccbf0505b1b42b8ecc12629ccfaf9. The package case also fails on its single bounded rerun with existing retries and sources unchanged. These historical baseline failures were subsequently audited separately from this two-image-reference change.
• Existing personal GPG commit 81653971450e7021b1fc3c1469dcc950b70e5fc6 verifies locally and on GitHub (verified: true, reason: valid).

Current validation and readiness:

• Hosted Compose execution passed 55/55 cases, including both shutdown cases and missing-app secret recovery: https://github.com/devsy-org/devsy/actions/runs/37981110706/job/113998066811.
• All three affected local cases and arm64/amd64 compatibility checks passed. The three Feature cases subsequently passed with corrected isolated cache ownership. The multistage case passed using a temporary official Debian mirror override; original-source connectivity failures remain disclosed.
• The scoped acceptance decision uses actual hosted Compose execution plus the affected compatibility checks. The separate UID expectation correction in fix(test): align Compose UID assertions with Linux-only remapping #1452 is not a prerequisite for these two sidecar substitutions; root-run UID cases do not prove non-root remapping.
• Actual CodeRabbit and Greptile reviews cover published head 8165397 with no actionable findings.
• This PR is ready for review. Final current-base/protected-merge verification and merge remain pending. Parent test: consolidate integration runtime fixtures under Devsy GHCR #1449 remains open.

Summary by CodeRabbit

• Tests
  • Updated the container images used in Docker Compose shutdown test scenarios to use a consistent base image.
  • One test scenario now uses a specific image version to improve repeatability.

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	8165397
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6ac941b02dbba300085711e7

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1b29a6f8-0fff-4668-915f-f5be5f8e6f4e

---

---

---

📥 Commits

Reviewing files that changed from the base of the PR and between 5648580 and 8165397.

---

---

---

📒 Files selected for processing (2)

• e2e/tests/up-docker-compose/testdata/docker-compose-shutdown-action-container/docker-compose.yaml
• e2e/tests/up-docker-compose/testdata/docker-compose-shutdown-action/docker-compose.yaml

---

---

---

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

---

---

---

---

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

Walkthrough

Both Compose shutdown test fixtures replace the sidecar image reference with the digest-pinned Devsy GHCR image.

Changes

Compose shutdown sidecar image

Layer / File(s)	Summary
Update shutdown fixture sidecar images e2e/tests/up-docker-compose/testdata/docker-compose-shutdown-action/docker-compose.yaml, e2e/tests/up-docker-compose/testdata/docker-compose-shutdown-action-container/docker-compose.yaml	Both fixtures use the specified digest-pinned Devsy GHCR image for the sidecar.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other

---

---

---

---

Merge Risk: ⚪ Minimal · up to 81653

The two shutdown test sidecars now use the pinned image; no production behavior changes are indicated. Targeted checks are reported passing, while the broader failures reportedly also occur on the base and do not establish a new blocker, though the stated validation workflow remains unfinished.

Architecture Summary

Architecture risk: 🔵 Low · up to 81653

The change affects 1 system.

Changed systems: e2e

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — e2e (service) was modified; 2 changed files map to changed impact.

Before / after behavior

• observed — Modified behavior in e2e/tests/up-docker-compose/testdata/docker-compose-shutdown-action-container/docker-compose.yaml: The sidecar image changes from alpine:latest to the specified ghcr.io image pinned by digest.
• observed — Modified behavior in e2e/tests/up-docker-compose/testdata/docker-compose-shutdown-action/docker-compose.yaml: The sidecar image changes from alpine:latest to the base Alpine image pinned by SHA-256 digest.

---

---

---

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check		The two scoped Compose fixtures use the required digest-pinned Devsy image, and the reported shutdown and recovery tests pass. The PR also preserves the requested fixture behavior and reports a focuse…	Complete the required full Compose validation gate for #1451. Resolve any failures attributable to this change, then rerun the gate on the final head. Preserve the current-main comparison for unrelated failures and obtain the required non-w…

✅ Passed checks (4 passed)

Check name	Status	Explanation
Out of Scope Changes check		The change summary shows one image-value replacement in each of the two files named by #1451. The summary reports no changes to app images, commands, users, volumes, shutdown settings, assertions, or …
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: pinning the Compose shutdown-test sidecar images to the Devsy GHCR image.

---

Full details: Linked Issues check

Explanation

The two scoped Compose fixtures use the required digest-pinned Devsy image, and the reported shutdown and recovery tests pass. The PR also preserves the requested fixture behavior and reports a focused two-file diff. However, #1451 requires the full Compose validation gate before merge. The reported run remains 49 passed and 6 failed, and the failures are not waived. The unresolved gate is a concrete unmet automated-validation requirement.

Resolution

Complete the required full Compose validation gate for #1451. Resolve any failures attributable to this change, then rerun the gate on the final head. Preserve the current-main comparison for unrelated failures and obtain the required non-waived gate result.

---

• Fix all pre-merge checks with AI

✨ Finishing Touches

✨ Simplify code

• Commit to this branch
• Create a new PR

---

---

---

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	8165397
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6ac941b167d5080008d2ee61

[skevetter]

@coderabbitai full review

@greptileai please review this pull request at current head 8165397. This is a review request only; the PR remains draft pending validation and review completion.

[coderabbitai]

✅ Action performed

Full review finished.

[greptile-apps]

Confidence Score: 5/5

[Low impact] No code issue found that would block merging this change.

Summary

Pins both Compose shutdown sidecars to the same Devsy GHCR Alpine digest. Commands, app images, mounts, and shutdown tests stay unchanged.

• Both shutdown fixtures use the same pinned Alpine sidecar.

_{Reviews (1) · Last reviewed commit: "test(e2e): pin Compose sidecars to Devsy..." · Reviewed by Greptile}

[mergify]

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.