Fetch pinned app commits from upstream remote #1

Merged

MHE merged 10 commits from inventory-image-tools-versions into main 2026-11-03 17:46:44 +01:00

Conversation 0 Commits 10 Files changed 3 +360 -5

MHE commented 2026-11-03 12:02:06 +01:00

Owner

Copy link

What changed

In install_app, the pinned-commit fetch now targets the upstream remote instead of origin:

• git fetch --depth 1 origin "${revision}" -> git fetch --depth 1 upstream "${revision}"

The function's doc comment also notes that bench get-app names the clone remote upstream.

Why

bench get-app clones each app and registers its source remote as upstream, not origin. Fetching from origin in the cloned app directory would fail or pull from the wrong remote, so the pinned revision could not be resolved. Fetching from upstream matches the remote bench actually creates, so the checkout-by-commit step works as intended.

Notes

• Only the fetch remote name changes; the pinned commit, checkout, and rev-parse verification are unchanged.
• No behavior change for apps whose pins already exist on the upstream remote.

## What changed In `install_app`, the pinned-commit fetch now targets the `upstream` remote instead of `origin`: - `git fetch --depth 1 origin "${revision}"` -> `git fetch --depth 1 upstream "${revision}"` The function's doc comment also notes that `bench get-app` names the clone remote `upstream`. ## Why `bench get-app` clones each app and registers its source remote as `upstream`, not `origin`. Fetching from `origin` in the cloned app directory would fail or pull from the wrong remote, so the pinned revision could not be resolved. Fetching from `upstream` matches the remote bench actually creates, so the checkout-by-commit step works as intended. ## Notes - Only the fetch remote name changes; the pinned commit, checkout, and `rev-parse` verification are unchanged. - No behavior change for apps whose pins already exist on the `upstream` remote.

MHE added 1 commit 2026-11-03 12:02:06 +01:00

Fetch pinned app revisions from upstream remote de7206d420

MHE added 1 commit 2026-11-03 12:31:23 +01:00

Lower Node heap limit to 2 GiB in run_frappe a51f0c6b77

MHE added 1 commit 2026-11-03 12:57:47 +01:00

Retry app fetches and add HTTP/1.1 git config 7e927b043b

MHE added 1 commit 2026-11-03 13:21:08 +01:00

Limit Rolldown threads and clear caches before Builder build 6a2520f343

MHE added 1 commit 2026-11-03 13:41:47 +01:00

Skip the Cypress test browser during app install. ... ab399efb06

Gameplan unpacks Cypress into the image layer and the build disk runs out of space.

Co-authored-by: Cursor <cursoragent@cursor.com>

MHE added 1 commit 2026-11-03 15:53:37 +01:00

Apply fixed Debian and Python releases and keep upstream Node findings visible. ... 0c06181d64

The image scan was failing on lockfiles shipped by the pinned Frappe apps. Debian and Python packages that already have a fix are upgraded, and those two classes still fail the job.

Co-authored-by: Cursor <cursoragent@cursor.com>

MHE added 1 commit 2026-11-03 16:18:57 +01:00

Read the Trivy report from the path passed into the scan. ... c7afae516e

The evaluator opened stdin as a file, so a finished image still failed the check.

Co-authored-by: Cursor <cursoragent@cursor.com>

MHE added 1 commit 2026-11-03 16:26:11 +01:00

Treat a package as patched when it matches a fixed release. ... 4f44d65ac6

Trivy still lists LiteLLM and the other floors after the upgrade because several fixed versions share one advisory.

Co-authored-by: Cursor <cursoragent@cursor.com>

MHE added 1 commit 2026-11-03 16:43:03 +01:00

Drop the cached wheels the scan still treats as installed. ... 0c962a2d1f

The bench environment is already on the fixed releases. uv and a setuptools downgrade left the old copies in the image.

Co-authored-by: Cursor <cursoragent@cursor.com>

MHE added 1 commit 2026-11-03 17:25:19 +01:00

Upgrade pip so its vendored packages match the fixed releases. ... 0ccfddc166

The image scan was reading pip's CycloneDX file, which listed setuptools 70.3.0 even though that package is not shipped in the wheel.

Co-authored-by: Cursor <cursoragent@cursor.com>

MHE merged commit d53885bced into main 2026-11-03 17:46:44 +01:00

MHE referenced this pull request from a commit 2026-11-03 17:46:45 +01:00

Fetch pinned app commits from upstream remote (#1)

MHE deleted branch inventory-image-tools-versions 2026-11-03 17:47:51 +01:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

openso/erpnext!1

No description provided.