🐛 fix(maturity): surface swallowed auth errors and honor per-container threshold by scttbnsn · Pull Request #660 · CodesWhat/drydock

scttbnsn · 2026-08-04T20:52:18Z

Fixes #604.

Two contained defects from the #556 latents:

getImagePublishedAt failures (incl. GHCR/LSCR 401/403) now log at warn instead of debug — the maturity gate's silent fallback from registry publishedAt to updateDetectedAt is no longer invisible.
getRawUpdateMaturityLevel and getContainerMaturityLevel now resolve the container's own updatePolicy.maturityMinAgeDays before the global DD_UI_MATURITY_THRESHOLD_DAYS, matching the gate's isUpdateSuppressed/isMaturityGatePending logic — badge and gate can no longer disagree in one response. Containers without an override keep byte-identical behavior.

Review provenance: workflow-implemented, adversarial verify round (caught 2 stale debug-level assertions in the Docker.containers suites, fixed), independent Codex review: clean. Full app suite green.

Changelog

🐛 Fixed registry publication-date failures to log at warn, including GHCR/LSCR authentication failures.
🔧 Changed maturity classification to resolve updatePolicy.maturityMinAgeDays before DD_UI_MATURITY_THRESHOLD_DAYS.
✨ Added regression tests for per-container maturity thresholds and warning behavior.
🗑️ Removed the obsolete millisecond-based UI threshold helper.

Concerns

Verify that warning-level logging follows the same callable-logger convention in both digest-only and regular image paths.
Check whether maturity-threshold resolution should use a shared utility to avoid duplicate fallback logic.

vercel · 2026-08-04T20:52:24Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
drydock-website	Ready	Preview	Aug 4, 2026 9:51pm
drydockdemo-website	Ready	Preview	Aug 4, 2026 9:51pm

coderabbitai · 2026-08-04T20:52:37Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 750c29ee-995f-46a0-9651-dbfd6bdbf5ff

📥 Commits

Reviewing files that changed from the base of the PR and between 70ca6d9 and f0c853a.

⛔ Files ignored due to path filters (1)

CHANGELOG.md is excluded by !CHANGELOG.md

📒 Files selected for processing (8)

app/api/container/maturity-filter.test.ts
app/api/container/maturity-filter.ts
app/model/container.test.ts
app/model/container.ts
app/watchers/providers/docker/Docker.containers.labels-version-finding.test.ts
app/watchers/providers/docker/Docker.containers.test.ts
app/watchers/providers/docker/image-comparison.test.ts
app/watchers/providers/docker/image-comparison.ts

🚧 Files skipped from review as they are similar to previous changes (8)

app/watchers/providers/docker/Docker.containers.test.ts
app/model/container.test.ts
app/api/container/maturity-filter.test.ts
app/watchers/providers/docker/image-comparison.ts
app/watchers/providers/docker/image-comparison.test.ts
app/api/container/maturity-filter.ts
app/watchers/providers/docker/Docker.containers.labels-version-finding.test.ts
app/model/container.ts

📝 Walkthrough

Walkthrough

Container maturity classification now uses updatePolicy.maturityMinAgeDays when configured and the UI threshold otherwise. Model and API paths include regression coverage for divergent thresholds. Docker publish-date lookup failures now use warning logs for digest-only and regular image checks. Tests cover authentication failures and missing warning loggers.

Possibly related PRs

CodesWhat/drydock#512: Modifies the same maturity-filter and container maturity logic for per-container thresholds.
CodesWhat/drydock#597: Adds related maturity-gate detection and maturityMinAgeDays handling.
CodesWhat/drydock#610: Modifies related container maturity-threshold behavior and tests.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR raises registry publish-date failures to warn and applies per-container maturityMinAgeDays in both maturity paths, satisfying issue `#604`.
Out of Scope Changes check	✅ Passed	All production and test changes directly support issue `#604` by covering warning-level failures and per-container maturity thresholds.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/v1.6-maturity-clock-604

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@app/api/container/maturity-filter.test.ts`:
- Around line 37-60: Update the test around applyContainerMaturityFilter to set
DD_UI_MATURITY_THRESHOLD_DAYS to '7' before exercising the assertions, and
restore its prior environment value in a finally block. Keep the existing
per-container override assertions unchanged.

In `@app/watchers/providers/docker/image-comparison.test.ts`:
- Around line 838-863: Update the test around findNewVersion so its fixture
selects the GHCR and LSCR providers using their actual registry identifiers,
preferably parameterizing the case with test.each while preserving the 401
warning assertions; otherwise rename the test to describe a generic registry
authentication failure.

In `@app/watchers/providers/docker/image-comparison.ts`:
- Line 342: Guard the warning call in the digest-only error path around
getErrorMessage(error), matching the existing logContainer.warn guard used by
the regular path, so missing warn still returns the result without publishedAt.
Add a regression test in the image-comparison tests covering digest-only lookup
failure with no warning logger.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: cc65d749-badb-4400-82f7-70b3cd49d9fa

📥 Commits

Reviewing files that changed from the base of the PR and between 7449633 and 14c08a1.

⛔ Files ignored due to path filters (1)

CHANGELOG.md is excluded by !CHANGELOG.md

📒 Files selected for processing (8)

app/api/container/maturity-filter.test.ts
app/api/container/maturity-filter.ts
app/model/container.test.ts
app/model/container.ts
app/watchers/providers/docker/Docker.containers.labels-version-finding.test.ts
app/watchers/providers/docker/Docker.containers.test.ts
app/watchers/providers/docker/image-comparison.test.ts
app/watchers/providers/docker/image-comparison.ts

vercel · 2026-08-04T21:43:25Z

Deployment failed with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/codeswhat?upgradeToPro=build-rate-limit

…r threshold - Bump getImagePublishedAt failure logging from debug to warn in image-comparison.ts (GHCR/LSCR auth failures were invisible, silently degrading the maturity clock to updateDetectedAt) - getRawUpdateMaturityLevel (container.ts) and getContainerMaturityLevel (maturity-filter.ts) now resolve updatePolicy.maturityMinAgeDays per-container before falling back to the global DD_UI_MATURITY_THRESHOLD_DAYS, matching the actual gate logic in isUpdateSuppressed/isMaturityGatePending Fixes: #604

…tures, digest-path warn guard

coderabbitai · 2026-08-04T22:18:16Z

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

Wholesale-tree sync ahead of the v1.6.0-rc.12 cut: the head commit's tree is `origin/dev/v1.6`'s tree verbatim (`630c64ec`), parented on main's current head (`67f23419`). Squash-merging makes main tree-identical to `dev/v1.6`, satisfying the release-cut drift guard (`git diff --quiet origin/main origin/dev/v1.6`). Brings in since rc.11: #659 security pins, #662/#660/#661/#663 runtime fixes (#636/#604/#605/#637), #664 guard floor, #653–#656 deps, #665 Crowdin, #666 rc.12 prep. After merge: dispatch `release-cut.yml --ref main -f release_tag=v1.6.0-rc.12`.  ## Changelog - 🔒 Updated dependency security pins and security-version tests. - ✨ Added anonymous-authenticated WebSocket log streams with IP-based rate limits. - ✨ Added agent component-registration state tracking. - 🔧 Downgraded selected update blockers during agent registration. - 🔧 Added controller-Docker transport detection. - 🐛 Added HTTP `501` responses for unsupported agent lifecycle actions. - 🐛 Fixed maturity filtering to use per-container thresholds. - 🐛 Changed Docker publish-date lookup failures to warning logs. - 🔧 Updated dependency versions, release metadata, documentation, mocks, and changelog links from `v1.6.0-rc.11` to `v1.6.0-rc.12`. - ✨ Added release highlights for `v1.6.0-rc.12`. ## Concerns - Fix the French `containerLogs.stderr` value if `"sdterr"` is not intentional. - Verify the release date `August 4, 2026`. - Dispatch the release-cut workflow for `main` with `release_tag=v1.6.0-rc.12` after merging.

scttbnsn requested review from ALARGECOMPANY and biggest-littlest as code owners August 4, 2026 20:52

coderabbitai Bot reviewed Aug 4, 2026

View reviewed changes

Comment thread app/api/container/maturity-filter.test.ts Outdated

Comment thread app/watchers/providers/docker/image-comparison.test.ts Outdated

Comment thread app/watchers/providers/docker/image-comparison.ts Outdated

scttbnsn force-pushed the fix/v1.6-maturity-clock-604 branch from 64a0c7a to 7b7c697 Compare August 4, 2026 21:51

vercel Bot deployed to Preview – drydockdemo-website August 4, 2026 21:51 View deployment

scttbnsn added 2 commits August 4, 2026 18:12

✅ test(maturity): address review findings — env pinning, provider fix…

f0c853a

…tures, digest-path warn guard

scttbnsn force-pushed the fix/v1.6-maturity-clock-604 branch from 7b7c697 to f0c853a Compare August 4, 2026 22:18

biggest-littlest approved these changes Aug 4, 2026

View reviewed changes

ALARGECOMPANY approved these changes Aug 4, 2026

View reviewed changes

scttbnsn merged commit b78fd4b into dev/v1.6 Aug 4, 2026
22 of 24 checks passed

scttbnsn deleted the fix/v1.6-maturity-clock-604 branch August 4, 2026 22:40

scttbnsn mentioned this pull request Aug 4, 2026

🚀 release: sync dev/v1.6 → main for v1.6.0-rc.12 #667

Merged

Navigation Menu

Uh oh!

Uh oh!

🐛 fix(maturity): surface swallowed auth errors and honor per-container threshold - #660

🐛 fix(maturity): surface swallowed auth errors and honor per-container threshold#660
scttbnsn merged 2 commits into
dev/v1.6from
fix/v1.6-maturity-clock-604

scttbnsn commented Aug 4, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 4, 2026 •

edited

Loading

Walkthrough

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vercel Bot commented Aug 4, 2026

Uh oh!

coderabbitai Bot commented Aug 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

scttbnsn commented Aug 4, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changelog

Concerns

Uh oh!

vercel Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vercel Bot commented Aug 4, 2026

Uh oh!

coderabbitai Bot commented Aug 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

scttbnsn commented Aug 4, 2026 •

edited by coderabbitai Bot

Loading

vercel Bot commented Aug 4, 2026 •

edited

Loading

coderabbitai Bot commented Aug 4, 2026 •

edited

Loading