From 3b5e2f11cf1d4dfb6b44e7c6c58e89f147691a3b Mon Sep 17 00:00:00 2001 From: Dmitrii Creed Date: Sat, 30 May 2026 17:49:17 +0400 Subject: [PATCH] fix(caddy): correct caddy-ratelimit commit SHA pin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The xcaddy `--with` directive in caddy.Dockerfile pinned github.com/mholt/caddy-ratelimit at an INVALID 40-char SHA: `16aecbb24beddc9095da2716fa8d3a30fa2dc8ea`. The first 7 characters match the real commit, but the rest of the SHA didn't correspond to anything in the upstream repository. The real SHA for that commit ("Add ipv4_prefix and ipv6_prefix options for subnet-based rate limiting", 2026-05-21) is `16aecbbcb8ca07dc1c671e263379606ff9493c55`. Verified via: $ curl -s "https://api.github.com/repos/mholt/caddy-ratelimit/commits/16aecbb" \ | jq '.sha' "16aecbbcb8ca07dc1c671e263379606ff9493c55" Effect of the bad pin on the 2026.5.42 release: `go get` rejected the invalid revision (`go: github.com/mholt/caddy-ratelimit@...: invalid version: unknown revision`), the `Docker build and push caddy` job failed, and the other three docker-build matrix entries got cancelled mid-flight. The release tag `2026.5.42` was published but NO docker images were pushed — consumer wrappers pointing at `@2026.5.42` would fail at image pull because `simplecontainer/github-actions:2026.5.42` doesn't exist. This fix-forward restores the build. Why the earlier preview builds passed despite the wrong SHA: most likely Go module proxy caching on short-SHA prefix lookups masked the issue intermittently — preview runs aren't a reliable signal for commit-pin correctness. No behavior change beyond restoring the build. The intent (pin caddy-ratelimit to the ipv4_prefix/ipv6_prefix + metrics commit on main, since the only formal tag v0.1.0 predates those features) is preserved exactly. Signed-off-by: Dmitrii Creed --- caddy.Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/caddy.Dockerfile b/caddy.Dockerfile index cf50b5f8..8428aef0 100644 --- a/caddy.Dockerfile +++ b/caddy.Dockerfile @@ -63,7 +63,7 @@ RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \ --mount=type=cache,target=/root/.cache,sharing=locked \ xcaddy build "v2.11.3" \ --with github.com/grafana/certmagic-gcs@v0.1.7 \ - --with github.com/mholt/caddy-ratelimit@16aecbb24beddc9095da2716fa8d3a30fa2dc8ea \ + --with github.com/mholt/caddy-ratelimit@16aecbbcb8ca07dc1c671e263379606ff9493c55 \ && caddy version \ && caddy list-modules | grep -qE '^http\.handlers\.rate_limit$' # ^ Final grep is a sanity check that the ratelimit module actually registered