[kixelated]

Problem

The scheduled Smoke job "Upstream Docker interoperability" has failed every night since 2026-11-12 (job 132483728890). Two upstream registry changes each break our wrapper, test/smoke/runner.py:

1. Unpublished image. englishm/moq-interop-runner#180 (merged 2026-11-11) registered ghcr.io/englishm/moq-interop-runner-stitcher-moq-media-client:latest, but the image was never published. The package API answers "Package not found", anonymous GHCR answers 403 while sibling images answer 200, and upstream's build-images.yml has not run since 2026-09-03. Upstream's 2026-11-13 xquic consolidation added two more unpublished images (xquic-client, xquic-relay; its notes say "GHCR publication is deferred until review"). Upstream's own runner skips missing images. Ours pre-pulls every image and aborts the whole job, although test/smoke/AGENTS.md says only our clients against this checkout's relay may fail it.
2. Per-endpoint runs. A docker relay that declares endpoints runs once per transport (docker-quic, docker-webtransport). englishm/moq-interop-runner#187 (merged 2026-11-13) gave quic-zig two endpoints, and our validate_summary rejects anything but one docker run per pair. Fixing 1 surfaced this one.

Approach

• A pull still retries a registry blip. After the last attempt, an unpullable moq-dev client image still fails the job. A third party's image is marked not run: image unavailable instead, its role is dropped from both matrices, it is listed under the report's "Not run" alongside local-only builds, and the job emits a ::warning::. If that empties the optional matrix, the matrix is skipped. A matrix that is empty before dropping missing images still raises, even when some unrelated image is missing.
• Coverage is now checked per (client, relay, mode) run, with one expected mode per declared endpoint or plain docker. A required pair passes only if it ran and every one of its runs passed. The optional warning lists runs.
• No digest pinning: the job follows upstream HEAD on purpose, and pinning would hide new registry entries.

Impact

None: CI harness only, no public API or wire change.

Alternatives

• Wait for upstream to publish the images. That fixes only today's entries, and xquic's are unpublished on purpose.
• Skip our pre-pull and accept upstream's skip rows. That would also hide our own image going missing.

Follow-ups

• Upstream should dispatch build-images.yml for stitcher-moq-media-client. Until then, its pairs show under Not run.

Caused by

• moq-dev/moq#7073 - made third-party pairs optional but left the image pre-pull aborting the job on them.
• moq-dev/moq#6257 - validated exactly one docker run per pair, though upstream already ran one cell per declared docker endpoint.

Validation

• Dispatched Smoke on the final head 7ab2ca9: the Upstream Docker job passes. It warns that the three unpublished images were not run and lists the optional red runs, ('moq-dev-js', 'quic-zig', 'docker-quic') among them.
• Before the endpoint fix, the dispatch on d832def got past the pull and then failed on incomplete runner coverage. Replaying that run's real matrix-1 summary (14 runs, modes docker, docker-quic, and docker-webtransport) through the new validate_summary accepts it; the old code rejected it.
• python3 test/smoke/runner.test.py: 12 tests pass. The new one (a matrix the registry alone leaves empty raises even when an unrelated image is missing) fails against the previous head's guard. They cover an unpublished third-party client or last relay (both fail against main's runner), an unpublished moq-dev image aborting before any matrix runs, and per-endpoint cells gating their pair.
• just check passes. quest review --harness codex: round 1 found the empty-matrix case (fixed), and rounds 2 and 3 found nothing.

Models

Size: S
Implementer: Claude Code, claude-opus-5-5, unknown effort
Implementer: Claude Code, claude-opus-5-5, unknown effort (iterate)

🤖 Generated with Claude Code

Review

Rewritten by quest review after each round.

• Head: 055bf7d

• Base: origin/main at 98ed0f8

• Risk: medium, the base has no RISK.md to name what is always high or customer-facing, so every change is medium

• Classified: medium by default

• Reviewer: Codex, gpt-6.1-sol, medium effort

• Session: 01a1de28-caaa-7401-a627-dbab05961b88, round 1

• Score: 9/10, Source inspection found no actionable defects in image filtering, endpoint-level coverage validation, or required-pair gating, though builds and tests were not run as instructed.

• Rounds: 1; first round 0; findings 0: fixed 0, refuted 0, open 0

• Findings: none

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 23 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 455b016d-c567-43a0-bb0e-8dd3565ca816

Commits

Reviewing files that changed from the base of the PR and between 8088d55 and 055bf7d.

Files selected for processing: 2

• test/smoke/runner.py
• test/smoke/runner.test.py

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[pullfrog]

ℹ️ One rough edge in the empty-matrix guard. Nothing else to flag.

Reviewed changes

I reviewed how the Upstream Docker smoke wrapper now handles unpublished third-party images and per-endpoint relay runs.

• Unpullable third-party images are skipped: after the retries, a missing moq-dev client image still aborts the job. A missing third-party image is marked not run: image unavailable, its role is dropped from both matrices, and the job warns and lists it under the report's "Not run".
• Per-run coverage: expected_runs now produces one (client, relay, mode) per declared relay endpoint, or plain docker, and validate_summary checks that exact set.
• Required gate: a required pair fails if it never ran or if any of its runs is red. The optional warning now lists runs.
• Tests: these cover an unpublished client, an unpublished last relay, a missing own image, and endpoint cells gating their pair.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using claude-opus-5-5 ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes

I reviewed the commit pushed since the prior Pullfrog review.

• Empty-matrix guard narrowed: run keeps the unfiltered plans and skips an empty matrix only when its unfiltered plan has runs. A matrix the registry alone leaves empty still raises no compatible pairs.
• Regression test added: test_matrix_the_registry_leaves_empty_fails_despite_unrelated_missing_image covers an unrelated missing image alongside a registry-empty matrix.

  ^{｜ View workflow run ｜ Using claude-sonnet-5-5 ｜ 𝕏}