reference-cache: mirrored source is a tagless shallow clone, so a pinned release cannot be read #15

New issue

Open

opened 2026-08-20 00:19:54 +00:00 by gravityfargo · 0 comments

gravityfargo commented 2026-08-20 00:19:54 +00:00

Owner

Copy link

reference-cache mirrors upstream source with a shallow clone that carries no tags, so the cache can only ever answer "what does upstream main look like right now" — not "what shipped in the version we actually run".

Reproduction

git -C $XDG_DATA_HOME/reference-cache/authentik/source rev-parse --is-shallow-repository
# true
git -C $XDG_DATA_HOME/reference-cache/authentik/source tag --list 'version/2026.5*'
# (empty)

Why it matters

The fleet runs authentik 2026.5.3, and diffing live flow exports against the blueprints of that release is the routine task. The cache holds main, which has already drifted — flow-default-authenticator-webauthn-setup.yaml in the cache has a prevent_duplicate_devices: false field that does not exist in 2026.5.3.

The workaround is a manual fetch:

git -C $XDG_DATA_HOME/reference-cache/authentik/source fetch --depth 1 origin tag version/2026.5.3
git -C $XDG_DATA_HOME/reference-cache/authentik/source show version/2026.5.3:blueprints/default/<file>

That works, and the fleet repo's authentik/flows/README.md now documents it — but every consumer has to know to do it, and nothing records which version a given cache entry is supposed to be read at.

Options

1. Fetch tags when mirroring (--depth 1 per tag keeps it cheap), so a release is always reachable.
2. Let System/Reference Cache.md record a pinned ref per tool and have the refresh honour it.
3. Have the skill surface the workaround when a caller asks for a version the cache cannot resolve.

Any of the three closes it; (1) plus (2) together is the useful pair, since the manifest already exists as the place a pin would naturally live.

Context

Surfaced while removing 29 vendored authentik blueprints from the fleet repo, which existed precisely because the cache could not serve the pinned version.

`reference-cache` mirrors upstream source with a shallow clone that carries no tags, so the cache can only ever answer "what does upstream `main` look like right now" — not "what shipped in the version we actually run". ## Reproduction ``` git -C $XDG_DATA_HOME/reference-cache/authentik/source rev-parse --is-shallow-repository # true git -C $XDG_DATA_HOME/reference-cache/authentik/source tag --list 'version/2026.5*' # (empty) ``` ## Why it matters The fleet runs authentik 2026.5.3, and diffing live flow exports against the blueprints *of that release* is the routine task. The cache holds `main`, which has already drifted — `flow-default-authenticator-webauthn-setup.yaml` in the cache has a `prevent_duplicate_devices: false` field that does not exist in 2026.5.3. The workaround is a manual fetch: ``` git -C $XDG_DATA_HOME/reference-cache/authentik/source fetch --depth 1 origin tag version/2026.5.3 git -C $XDG_DATA_HOME/reference-cache/authentik/source show version/2026.5.3:blueprints/default/<file> ``` That works, and the fleet repo's `authentik/flows/README.md` now documents it — but every consumer has to know to do it, and nothing records which version a given cache entry is supposed to be read at. ## Options 1. Fetch tags when mirroring (`--depth 1` per tag keeps it cheap), so a release is always reachable. 2. Let `System/Reference Cache.md` record a pinned ref per tool and have the refresh honour it. 3. Have the skill surface the workaround when a caller asks for a version the cache cannot resolve. Any of the three closes it; (1) plus (2) together is the useful pair, since the manifest already exists as the place a pin would naturally live. ## Context Surfaced while removing 29 vendored authentik blueprints from the fleet repo, which existed precisely because the cache could not serve the pinned version.

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

No results found.

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

gravityfargo/local-tools#15

No description provided.