How to lock an image version?

[Adnn]

With the latest bug in the Ubuntu 22 update (breaking all Clang builds with Cpp 20), I was wondering wether we have to accept that CI is not for Cpp projects and move back to the old ways, or if we can actually lock the runner image version so we get some reproducibility instead of uncontrolled errors?

I tried to raise that specific point in an issue but it was unilaterally closed.

tl;dr; How do we lock a runner to a specific image version?

[ilia-shipitsin]

currently locking specific image version is not offered, thus you cannot lock it.

the closest option would be using containers (you can pin exact tag) https://docs.github.com/en/actions/using-jobs/running-jobs-in-a-container

[vpolikarpov-akvelon]

Hey @Adnn. I would recommend you to examine self-hosted runners.

There is also a manual of how to build an image that would be similar to what GH-hosted runners use: https://github.com/actions/runner-images/blob/main/docs/create-image-and-azure-resources.md. Once you have your own image and your own runners you can handle updates and rollbacks independently.

[cacti77]

@ilia-shipitsin

currently locking specific image version is not offered, thus you cannot lock it.

I would love for us to be able to pin to a particular version of an image. We've had ongoing nightmares with #12470 when 'windows-latest' was recently updated on Windows MS-hosted agents. If we could have pinned our Azure DevOps pipelines to the last-working version of that image then at least we could have kept our pipelines running until the fix was rolled out in 'windows-latest'.

I understand you can pin to specific versions in GitHub Actions but not in Azure DevOps pipelines for some reason - why? Is there somewhere we can request/upvote this feature?

[subir0071]

As of now, there is no way to pin image to specific version. Both in GH and ADO.