fix(caddy): correct caddy-ratelimit commit SHA pin#304
Merged
Conversation
The xcaddy `--with` directive in caddy.Dockerfile pinned
github.com/mholt/caddy-ratelimit at an INVALID 40-char SHA:
`16aecbb24beddc9095da2716fa8d3a30fa2dc8ea`. The first 7 characters
match the real commit, but the rest of the SHA didn't correspond to
anything in the upstream repository.
The real SHA for that commit ("Add ipv4_prefix and ipv6_prefix options
for subnet-based rate limiting", 2026-05-21) is
`16aecbbcb8ca07dc1c671e263379606ff9493c55`.
Verified via:
$ curl -s "https://api.github.com/repos/mholt/caddy-ratelimit/commits/16aecbb" \
| jq '.sha'
"16aecbbcb8ca07dc1c671e263379606ff9493c55"
Effect of the bad pin on the 2026.5.42 release: `go get` rejected the
invalid revision (`go: github.com/mholt/caddy-ratelimit@...: invalid
version: unknown revision`), the `Docker build and push caddy` job
failed, and the other three docker-build matrix entries got cancelled
mid-flight. The release tag `2026.5.42` was published but NO docker
images were pushed — consumer wrappers pointing at `@2026.5.42` would
fail at image pull because `simplecontainer/github-actions:2026.5.42`
doesn't exist.
This fix-forward restores the build. Why the earlier preview builds
passed despite the wrong SHA: most likely Go module proxy caching on
short-SHA prefix lookups masked the issue intermittently — preview
runs aren't a reliable signal for commit-pin correctness.
No behavior change beyond restoring the build. The intent (pin
caddy-ratelimit to the ipv4_prefix/ipv6_prefix + metrics commit on
main, since the only formal tag v0.1.0 predates those features) is
preserved exactly.
Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
Semgrep Scan ResultsRepository:
Scanned at 2026-05-30 13:50 UTC |
Security Scan ResultsRepository:
Scanned at 2026-05-30 13:50 UTC |
smecsia
approved these changes
May 30, 2026
universe-ops
approved these changes
May 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The xcaddy
--withline incaddy.Dockerfilepinnedgithub.com/mholt/caddy-ratelimitat an invalid 40-char SHA:16aecbb24beddc9095da2716fa8d3a30fa2dc8ea. The first 7 characters match the real commit, but the rest of the SHA was not a real revision in the upstream repository.The correct full SHA for the "Add ipv4_prefix and ipv6_prefix options for subnet-based rate limiting" commit (2026-05-21) is
16aecbbcb8ca07dc1c671e263379606ff9493c55.Verified:
Effect on the 2026.5.42 release
go getrejected the bad revision (go: github.com/mholt/caddy-ratelimit@...: invalid version: unknown revision), theDocker build and push caddymatrix entry failed, and the other three matrix entries (kubectl,github-actions,cloud-helpers-aws) got cancelled mid-flight. The release tag was published but no docker images were pushed for2026.5.42→ any consumer pointing wrappers at@2026.5.42would fail at image pull.Failed run: https://github.com/simple-container-com/api/actions/runs/26684021578
Why earlier preview builds passed
Most likely Go module proxy caching on short-SHA prefix lookups masked the issue intermittently — preview builds aren't a reliable signal for commit-pin correctness because xcaddy + the Go module proxy can sometimes accept a fabricated full SHA that prefix-matches a real one if a cache hit exists. The production-path build (no cache) failed loudly.
Fix
One-line change: replace the fabricated SHA with the real one. No behavior change beyond restoring the build.
Test plan
Docker build and push caddysucceeds in the matrix.2026.5.43or whatever calver lands).docker run --rm simplecontainer/caddy:<new-tag> caddy list-modules | grep http.handlers.rate_limitreturns the module.