Skip to content

fix(build): default OPENCLAW_BASE_VERSION to latest for standalone builds #1165

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
VirtualVapor502 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

fix(build): default OPENCLAW_BASE_VERSION to latest for standalone builds #1165

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ccbb9cc
fix(build): default OPENCLAW_BASE_VERSION to latest for standalone bu…
Aug 10, 2026
09ea483
Merge branch 'main' into fix/openclaw-base-tag
VirtualVapor502 Aug 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,7 +139,7 @@ build-openclaw-base: ## Build OpenClaw base image
# build targets use the locally-built openclaw-base; push targets use the registry image
# OPENCLAW_BASE_VERSION controls which base image tag manager/worker builds depend on.
# Default: latest (for standalone builds). Override to use a versioned base (e.g. in build-all).
OPENCLAW_BASE_VERSION ?= 20260423-8359cbc
OPENCLAW_BASE_VERSION ?= latest

@oss-maintainer oss-maintainer Sep 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR's justification is factually incorrect as of today: the pinned tag DOES exist in the default registry. Verified live against the registry API: higress-registry.cn-hangzhou.cr.aliyuncs.com/agentteams/openclaw-base:20260423-8359cbc returns HTTP 200 as a multi-arch manifest list (linux/amd64 + linux/arm64, image created 2026-04-23) and is anonymously pullable (tags list: 20260423-8359cbc, -amd64, -arm64, latest, v1.1.2, v1.2.0-beta.1, v1.2.0-v1.2.3). It also exists in the higress/openclaw-base namespace used by hack/local-k8s-up.sh and test-integration.yml:285. So first-time make install-embedded does not fail on the base pull with the pin. The claim likely stems from the registry-namespace migration window noted in test-integration.yml:283-284 ('The pinned base predates the AgentTeams registry namespace... until a release seeds the new repo') — the agentteams repo has since been seeded, so the stated breakage no longer reproduces. Note also that the regional mirrors (us-west-1, ap-southeast-7) reject anonymous pulls for the whole repository for BOTH tags equally (repo-level auth), so latest would not fix a mirror-related failure either. The change itself is mechanically safe (see info notes), but the root cause of the reported breakage was not verified.

@oss-maintainer oss-maintainer Sep 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mechanically safe — verified all consumers of OPENCLAW_BASE_VERSION: it feeds only OPENCLAW_BASE_BUILD_ARG (build-manager Makefile:156, build-worker Makefile:180) and OPENCLAW_BASE_PUSH_ARG (push-manager Makefile:347/360, push-worker Makefile:406/418). push-openclaw-base and build-openclaw-base use OPENCLAW_BASE_TAG/VERSION instead and are unaffected. Every CI path that needs a pinned base overrides it explicitly (build.yml:110,132 with the release version; build-rc.yml:88 with inputs.version; test-integration.yml:280,285), so release builds remain reproducible. The ?= override mechanism is preserved. latest exists in the default registry (multi-arch, rebuilt by build-base.yml on every openclaw-base/** push to main) and currently has the same digest as the v1.2.3 release base (sha256:1392e9be...), so standalone builds match the latest release — arguably better than the stale April pin, which no longer matches what released v1.2.3 images were actually built against.

@oss-maintainer oss-maintainer Sep 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Two follow-ups for maintainers: (1) This silently reverses the documented pinning policy in build-rc.yml:122-125, whose RC summary instructs 'After RC validation, update base image dependency to the stable tag: OPENCLAW_BASE_VERSION ?= -' (the removed pin was exactly such a tag, per changelog/v1.1.0.md 'chore(base): pin openclaw-base image tag to 20260423-8359cbc'). Either update build-rc.yml's guidance or accept that the next RC cycle may re-pin this default. (2) The de-pin is incomplete: 20260423-8359cbc remains hardcoded in worker/Dockerfile:14 and manager/Dockerfile:14 (ARG fallback defaults, only used when building the Dockerfiles directly without the Makefile), hack/local-k8s-up.sh:89/95/109, manager/docker-legacy/Dockerfile.aliyun:15, and test-integration.yml:285 — the latter three point at the higress/ namespace. Not blockers since those paths are self-consistent and the tag exists in both namespaces, but the repo is now inconsistent about which base tag is canonical.

OPENCLAW_BASE_BUILD_ARG = --build-arg OPENCLAW_BASE_IMAGE=$(OPENCLAW_BASE_IMAGE):$(OPENCLAW_BASE_VERSION)
OPENCLAW_BASE_PUSH_ARG = --build-arg OPENCLAW_BASE_IMAGE=$(OPENCLAW_BASE_IMAGE):$(OPENCLAW_BASE_VERSION)

Expand Down