chore(infra): bump prod.tag to 2026.4.5-bf9f699 — flip prod to extended image#323
Merged
Conversation
…ded image Prod was stuck on the "bootstrap" placeholder, so container-stack.ts fell through to the legacy upstream alpine/openclaw:2026.4.5 — which does not have clawhub (or gh, uv, etc.) baked in, and agents on prod hit "clawhub: not in PATH" when installing skills. Flipping to the same tag dev has been running (2026.4.5-bf9f699) so the multi-stage extended image rolls out to prod. After deploy, existing per-user services still launch from the task def revision registered at provision time — they'll need a re-register (resize or delete+recreate) to pick up the new base image. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
4 tasks
prez2307
added a commit
that referenced
this pull request
Apr 20, 2026
…def export bump (#324) PR #323's prod deploy rolled back because isol8-prod-container tried to update its OpenClawTaskDef export (new revision arn) while isol8-prod-service was still importing the old value with no pending template diff of its own. CFN blocks export updates when the consumer has no in-flight change to resequence alongside. isol8-dev didn't hit this today because its container stack had no task-def change in PR #323 (dev.tag unchanged, only prod.tag). Previous dev task-def updates succeeded because service-stack had pending changes in the same deploy, letting CDK/CFN order the export refresh. A trivial DEPLOY_NONCE env var on the backend container forces a service- stack diff this run, which lets CFN reorchestrate the export update. No runtime impact. Revert (or replace with a proper SSM-parameter indirection) once PR #323 lands in prod. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
prez2307
added a commit
that referenced
this pull request
Apr 21, 2026
…K_DEFINITION to .family, drop nonce (#326) PR #323's prod deploy rolled back and every subsequent deploy hits the same CloudFormation lock: isol8-prod-container can't update its OpenClawTaskDef export because isol8-prod-service imports it. The lock is checked against the consumer's live template, so no amount of pending diff on service-stack this run helps (PR #324's DEPLOY_NONCE theory was wrong — confirmed in today's failed deploy). Quick-fix to unblock and set up the extended-image rollout as two PRs: 1. openclaw-version.json: revert prod.tag to "bootstrap" so container- stack has no task-def diff on this deploy. Prod's base image stays at alpine/openclaw:2026.4.5 (upstream) — where it is now, so zero runtime regression. 2. service-stack.ts: swap ECS_TASK_DEFINITION from props.container.openclawTaskDef.taskDefinitionArn to props.container.openclawTaskDef.family. That's an inlined static string ("isol8-prod-openclaw"), not an Fn::ImportValue — the cross- stack coupling disappears. On this deploy: container no-ops, service updates, and the OpenClawTaskDef export becomes unused. 3. Drop DEPLOY_NONCE from PR #324 (unnecessary once the cross-stack coupling is gone). Follow-up PR re-bumps prod.tag to the extended image; with no consumer left on the export, CFN updates the task-def revision freely. Trade-off: .family reintroduces the "latest-in-family" lookup PR #299 moved away from. In practice safe under current code — CLAWHUB_WORKDIR is now on every clone (added in PR #277, inherited by all per-user clones since), and the per-user access point is always overridden by _build_register_kwargs_from_base, so cross-user leakage can't happen. A real fix (SSM-parameter indirection on the ARN) is worth doing later to restore revision-pinning without the cross-stack lock. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
prez2307
added a commit
that referenced
this pull request
Apr 21, 2026
Re-applies PR #323 now that PR #329 decoupled the task-def ARN from a cross-stack Fn::ImportValue via SSM. container-stack can freely register a new task-def revision with the extended OpenClaw image — the SSM param value tracks the new ARN automatically, and no consumer imports the revision-embedded export anymore. After deploy: - New provisions land on the extended image (clawhub baked in). - Existing per-user services still launch from the task-def revisions they were registered against at provision time. Roll them forward via POST /container/updates with owner_id:"all" (banner + Update Now), or force-apply per-owner in a follow-up. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
prod.tagwas"bootstrap", socontainer-stack.ts:318-322fell through to the legacy upstreamalpine/openclaw:2026.4.5— noclawhub/gh/uvbaked in.2026.4.5-bf9f699(same tag dev has been running) so the extended multi-stage image rolls out to prod.CLAWHUB_WORKDIR=/home/node/.openclawwas already set on the base task def; it just couldn't help until the CLI was actually present.Rollout behavior
ECS_TASK_DEFINITIONenv to it.resize_user_containeror delete+recreate service) per user.Test plan
which clawhubreturn a path andecho $CLAWHUB_WORKDIRreturn/home/node/.openclaw.clawhub install <slug>lands at/home/node/.openclaw/skills/<slug>.🤖 Generated with Claude Code