ci(oss): write the image tag once, pull it in CI

Ports javascript-sdk#176's resolution of the same review feedback, so the OSS
harness stays diffable across the SDKs. csharp-sdk#171 carries the identical
change.

One tag, one home. The tag was written twice: FORK_PR_FALLBACK_VERSION in the
integration-tests-oss job, and `latest` as the local script's default. A local
run therefore could not reproduce a CI failure, which is most of why the script
exists. Rather than teach one of them to read the other, make the `image:` line
of docker-compose-oss.yaml the only place it is written and let both fall
through to it: the script applies no default of its own and exports
OSS_CONDUCTOR_VERSION only when --version actually supplied one, and the
fork-PR branch of the resolve step now leaves the variable unset instead of
pinning its own copy. Fork CI and a plain local run reach the identical image
by the identical path, with no YAML parsing on either side and one hardcode
removed rather than a mechanism added. The non-fork empty case still fails
loudly, and the workflow_run nuance is untouched -- that trigger runs in the
base repo's context and still gets the org variable even for a fork PR. The
script's "Using ..." and "Pulling ..." lines now come from
`compose config --images conductor-server` instead of reconstructing the tag,
so they stay honest whichever source supplied it.

The compose header already noted that E2E_TEST_OSS_CONDUCTOR_VERSION is set to
`latest` org-wide, so a normal CI run is not really pinned. That stays, with
the addition that this default is now what actually pins fork PRs and local
runs until someone sets the org variable to a real tag.

Pull in CI. The script pulls before `up`, CI did not. On a GitHub-hosted runner
the VM is ephemeral and starts with no cached copy, so `up` pulls anyway and
the step is redundant today — kept regardless, because it costs no extra
network pull (`up` then finds the image locally), it splits "couldn't pull the
image" from "the stack didn't come up" into two distinct red steps, and it is
what stops a mutable tag going stale the day this job moves to a self-hosted
runner with a warm Docker daemon. It also prints the tag in use, which matters
now that a fork PR's tag is not spelled out in the workflow.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: chrishagglund-ship-it

.github/workflows/integration-tests.yml

@@ -8,7 +8,7 @@ on:
   workflow_dispatch:
     inputs:
       oss_conductor_version:
-        description: 'OSS Conductor image tag (falls back to E2E_TEST_OSS_CONDUCTOR_VERSION org var, then to a pinned default on fork PRs)'
+        description: 'OSS Conductor image tag (falls back to the E2E_TEST_OSS_CONDUCTOR_VERSION org var, then to the default in scripts/docker-compose-oss.yaml on fork PRs)'
         required: false
         type: string
 
@@ -99,9 +99,6 @@ jobs:
     env:
       CONDUCTOR_SERVER_URL: http://localhost:8080/api
       CONDUCTOR_SERVER_TYPE: oss
-      # Used only when the org variable is unreachable because the run is a fork
-      # PR -- see the resolve step below.
-      FORK_PR_FALLBACK_VERSION: '3.32.3'
 
     steps:
       # OSS_CONDUCTOR_VERSION is resolved here rather than in the job `env` so
@@ -110,30 +107,31 @@ jobs:
       #   - Fork PR: GitHub withholds org/repo variables from pull_request runs
       #     on forks exactly as it withholds secrets, so vars.* is always "" for
       #     an outside contributor (observed in csharp-sdk#178). This job needs
-      #     no secrets, only a tag, so pin one and keep running. Note that the
+      #     no secrets, only a tag, so leave the var unset and let the default
+      #     baked into the `image:` line of scripts/docker-compose-oss.yaml
+      #     apply. That is the same tag a plain local run of
+      #     scripts/run-integration-oss.sh gets, and the one place it is
+      #     written -- no second copy to drift out of sync here. Note that the
       #     workflow_run trigger above executes in the base repo's context and
       #     does get the org variable even for a fork PR; the fork branch here
       #     matters for the push/dispatch paths and for any future direct
       #     pull_request trigger.
       #   - Anything else: the org variable is genuinely missing or its
       #     repository access policy no longer covers this repo. Fail loudly
-      #     rather than silently drifting onto the pin.
+      #     rather than silently drifting onto the default.
       - name: Resolve OSS Conductor version
         env:
           REQUESTED_VERSION: ${{ inputs.oss_conductor_version || vars.E2E_TEST_OSS_CONDUCTOR_VERSION }}
           IS_FORK_PR: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) || (github.event_name == 'workflow_run' && github.event.workflow_run.head_repository.full_name != github.repository) }}
         run: |
           if [ -n "$REQUESTED_VERSION" ]; then
-            resolved="$REQUESTED_VERSION"
+            echo "OSS_CONDUCTOR_VERSION=${REQUESTED_VERSION}" >> "$GITHUB_ENV"
           elif [ "$IS_FORK_PR" = "true" ]; then
-            resolved="$FORK_PR_FALLBACK_VERSION"
-            echo "::notice::Fork PR: org variables are withheld, pinning conductoross/conductor:${resolved}"
+            echo "::notice::Fork PR: org variables are withheld, falling back to the default tag in scripts/docker-compose-oss.yaml"
           else
             echo "::error::No Conductor OSS image tag resolved. Set the E2E_TEST_OSS_CONDUCTOR_VERSION organization variable (and ensure its repository access policy includes this repo), or pass the oss_conductor_version input via workflow_dispatch."
             exit 1
           fi
-          echo "OSS_CONDUCTOR_VERSION=${resolved}" >> "$GITHUB_ENV"
-          echo "Using conductoross/conductor:${resolved}"
 
       - name: Checkout
         uses: actions/checkout@v6
@@ -149,6 +147,21 @@ jobs:
           distribution: "zulu"
           java-version: "21"
 
+      # `docker compose up` only pulls an image when it is missing locally. On a
+      # GitHub-hosted runner the VM is ephemeral and starts with no cached copy
+      # of this image, so `up` would pull anyway and this step is redundant
+      # today. It is here deliberately: it costs no extra network pull (`up`
+      # then finds the image locally), it separates "couldn't pull the image"
+      # from "the stack didn't come up" into two distinct red steps, and it is
+      # what keeps a mutable tag from going stale if this job ever moves to a
+      # self-hosted runner with a warm Docker daemon -- the same reason
+      # scripts/run-integration-oss.sh pulls. It also prints the tag actually in
+      # use, which for a fork PR comes from the compose file's default.
+      - name: Pull Conductor OSS image
+        run: |
+          echo "Using $(docker compose -f scripts/docker-compose-oss.yaml config --images | grep -m1 '^conductoross/conductor:')"
+          docker compose -f scripts/docker-compose-oss.yaml pull conductor-server
+
       - name: Start Conductor OSS stack
         run: docker compose -f scripts/docker-compose-oss.yaml up -d
 

scripts/docker-compose-oss.yaml

@@ -2,14 +2,20 @@
 # Shared by scripts/run-integration-oss.sh and the integration-tests-oss job in
 # .github/workflows/integration-tests.yml.
 #
-# OSS_CONDUCTOR_VERSION defaults to `latest` for local runs. CI resolves it from the
-# E2E_TEST_OSS_CONDUCTOR_VERSION org variable (or a workflow_dispatch input); that variable is
-# currently set to `latest` too, so CI tracks whatever `latest` resolves to at run time rather
-# than a fixed version. Set the org variable to a real tag if the job needs to be deterministic.
+# The `image:` default below is the SINGLE place the Conductor OSS image tag is written.
+# Everything that does not override OSS_CONDUCTOR_VERSION lands on it: a plain
+# scripts/run-integration-oss.sh run, and the integration-tests-oss job on a fork PR (where
+# GitHub withholds org variables). Overrides are the script's --version flag and, in CI, the
+# E2E_TEST_OSS_CONDUCTOR_VERSION org variable or a workflow_dispatch input. Bump the tag here
+# and both follow.
+#
+# Note that the org variable is currently set to `latest`, so a normal CI run still tracks
+# whatever `latest` resolves to at run time. Set it to a real tag if the job needs to be
+# deterministic; until then this default is what actually pins fork PRs and local runs.
 
 services:
   conductor-server:
-    image: conductoross/conductor:${OSS_CONDUCTOR_VERSION:-latest}
+    image: conductoross/conductor:${OSS_CONDUCTOR_VERSION:-3.32.3}
     environment:
       - CONFIG_PROP=config-postgres.properties
     ports:

scripts/run-integration-oss.sh

@@ -9,15 +9,17 @@
 # the empirically-confirmed gaps).
 #
 # The stack (Conductor OSS + Postgres) is defined in
-# scripts/docker-compose-oss.yaml and is torn down automatically on exit. The
-# image is always pulled before starting, since `latest` (the local default)
-# is a mutable tag and a cached copy would otherwise go stale silently.
+# scripts/docker-compose-oss.yaml and is torn down automatically on exit. That
+# file's `image:` line is also where the default tag lives -- this script
+# applies no default of its own, so a plain run and a fork-PR CI run land on
+# the identical image. The image is always pulled before starting, since a tag
+# can be mutable and a cached copy would otherwise go stale silently.
 #
 # Usage:
 #   scripts/run-integration-oss.sh [--keep-up] [--version <tag>] [--include-gated] [-- gradle args]
 # Examples:
-#   scripts/run-integration-oss.sh
-#   scripts/run-integration-oss.sh --version 3.32.0-rc18
+#   scripts/run-integration-oss.sh                       # default tag from the compose file
+#   scripts/run-integration-oss.sh --version 3.33.0-rc1
 #   scripts/run-integration-oss.sh --keep-up
 #   scripts/run-integration-oss.sh --include-gated       # also run tests normally skipped as Orkes-only
 #   scripts/run-integration-oss.sh -- --tests "*WorkflowClientTests"
@@ -41,7 +43,14 @@ while [[ $# -gt 0 ]]; do
   esac
 done
 
-export OSS_CONDUCTOR_VERSION="${OSS_CONDUCTOR_VERSION:-latest}"
+# No default is applied here on purpose. The default tag is written once, in the
+# `image:` line of scripts/docker-compose-oss.yaml, so leaving OSS_CONDUCTOR_VERSION
+# unset lets compose supply it -- the same path a fork PR takes in CI. Only export
+# it when the caller actually asked for a specific tag, otherwise a value set but
+# not exported in the caller's shell would never reach compose anyway.
+if [[ -n "${OSS_CONDUCTOR_VERSION:-}" ]]; then
+  export OSS_CONDUCTOR_VERSION
+fi
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
@@ -66,13 +75,18 @@ cleanup() {
 }
 trap cleanup EXIT
 
-echo "Using conductoross/conductor:${OSS_CONDUCTOR_VERSION}"
+# Ask compose what it resolved rather than reconstructing the tag here, so this
+# stays correct whether the tag came from --version or from the compose default.
+# `--images` lists every service's image and does not reliably honour a service
+# filter, so select the server's by name rather than by position.
+SERVER_IMAGE="$(compose config --images | grep -m1 '^conductoross/conductor:')"
+echo "Using ${SERVER_IMAGE}"
 
 # `docker compose up` only pulls an image when it is missing locally, so a
-# previously-cached `latest` (or any other mutable tag) would silently be
-# reused instead of getting the current version. Pull unconditionally so the
-# stack always reflects the tag we just printed.
-echo "Pulling conductoross/conductor:${OSS_CONDUCTOR_VERSION} to ensure it's current..."
+# previously-cached mutable tag (a re-pushed rc, or `latest` if that is what was
+# asked for) would silently be reused instead of getting the current version.
+# Pull unconditionally so the stack always reflects the tag we just printed.
+echo "Pulling ${SERVER_IMAGE} to ensure it's current..."
 compose pull conductor-server
 
 echo "Starting Conductor OSS stack..."