Wait for both base images in the custom-ca-certs trigger

Timo Furrerrequested to merge
fix-custom-ca-certs-image-needs into main
  • Wait for both base images in the custom-ca-certs trigger

49596992 replaced whole-stage gating with per-matrix-entry needs, so each trigger now waits only for the image variant its own matrix entry names. That is wrong for custom-ca-certs: CustomCACerts also includes the module-release component, which is pinned to the debian image because it installs zip with apt-get (2b1cf319).

The alpine variant therefore started as soon as the alpine image was built and its module-release job failed to pull the debian image, which did not exist yet. On the merge train pipeline for !551 (merged) the alpine image finished at 06:56:16 and module-release failed at 06:58:00, while the debian image was only ready at 07:08:25. The debian variant of the same matrix passed, because it happened to gate on the image it actually needed.

module-release is the only template that pins its base image; every other one defaults to alpine, which is always built first. This trigger is therefore the only place where the declared and the actual image dependency diverge.

Merge request reports