astronomer / astro-cli / 39081543172

45%

push

github

Refuse a Remote Execution agent image on astro deploy, and warn when astro remote deploy gets something else (#2226)

* Warn/cancel when a Dockerfile's base image flavor doesn't match the deploy path

astro deploy (hosted) and astro remote deploy (Remote Execution) expect
structurally different images. Add a best-effort check, at both pre-build
(inspects the Dockerfile's FROM image directly, skips silently on
unresolvable ARG-templated FROM lines) and post-build (inspects the actual
built image -- no ambiguity, so this one cancels the deploy rather than
just warning, mirroring the existing ValidRuntimeVersion cancel-on-mismatch
convention) stages.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Narrow the env var check to never expose values, only a boolean

Replace ImageHandler.GetEnvVars() (returned the full "KEY=VALUE" list,
including any values baked into the image) with
HasEnvVarWithPrefix(altImageName, prefix) (bool, error). The raw env
list is now parsed and discarded entirely within a single function in
docker_image.go; nothing outside that function -- not the interface,
not cloud/deploy, not any log line -- ever sees a variable's value or
even the full list of variable names. Callers only ever learn whether
a given name prefix is present.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Fix lint: reduce buildImage cognitive complexity, drop unused param

Extract the pre-build and post-build agent-flavor check call sites
in buildImage/DeployClientImage into small dedicated helper
functions (warnIfPreBuildAgentFlavorMismatch,
cancelIfAgentFlavorImageHosted) -- gocognit flagged buildImage at 31
(> 30) after the checks were inlined there. Also rename
hasEnvVarWithPrefix to isAgentFlavorImage and drop its now-constant
prefix parameter (unparam: every call site passed agentEnvVarPrefix).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Keep only the post-build agent image check, and never block on a failed inspect
... (continued)

52 of 77 new or added lines in 3 files covered. (67.53%)

27437 of 60603 relevant lines covered (45.27%)

9.97 hits per line