Hi, Dirk. Thanks for bringing this up. I really appreciate it.
mercodev was a leftover, and I think we should replace it with `apache`. A tag would be easier since it is rarely updated and is designed only for building images for the project.
Please feel free to open the PR, and I will approve it ASAP. Best, Klesh Wong On 10/27/26 6:21 PM, DoDiDev via dev wrote:
Hi all, I'd like to bring GitHub issue #9209 to the list, since it needs a decision from someone with access to the project's CI secrets: https://github.com/apache/devlake/issues/9209 In short: five CI jobs (unit-test, e2e mysql/postgres, golangci-lint, migration-script-lint) run inside mericodev/lake-builder:latest. That image was last pushed on 2023-06-30 (Go 1.20, libgit2 1.3, Debian bullseye, Python 3.9). The only publishing path, build-builder.yml, is triggered by a builder-* tag (the last one is builder-v0.0.7 from 2022) and pushes to the company namespace "mericodev" with separate credentials. As a result, changes to devops/docker/lake-builder/Dockerfile (#9203, #9208) are never exercised by the upstream CI. The repository already has working Docker Hub credentials: build.yml pushes to apache/devlake on every push to main (last successful run 2026-10-27). The proposal is two small PRs: 1. Let build-builder.yml use the same secrets, run on pushes to main that touch the lake-builder Dockerfile (plus workflow_dispatch), and push a pinned tag to the ASF namespace -- either apache/devlake:lake-builder-<sha> (like the existing :amd64-builder tag) or a new apache/devlake-builder repository. 2. Point the five container: lines to that pinned tag. This picks up #5041 from 2023, which asked for the same thing but was closed by the stale bot. The current Dockerfile builds and passes unit, lint and e2e tests on my fork's CI, see the issue for the run. Two questions for the PMC: - Is this direction acceptable, and do you prefer a tag in apache/devlake or a separate apache/devlake-builder repository? - If you would rather keep the existing path: are the mericodev credentials still valid, so that a builder-v0.0.16 tag would work? Unless there are objections by 2026-11-02, I'll prepare the first PR (publishing only, no change to existing jobs) with the apache/devlake:lake-builder-<sha> variant, so it can be reviewed concretely. Any committer would still need to merge it, and the first push only happens after that. Thanks, Dirk (GitHub: DoDiODev)
