Fix crane installation and use crane in blue-green deploys (#5202)

1. Fix crane installation - don't try to mv crane to itself
   (tar extracts to cwd which is already /opt/eagle0)
2. Keep crane binary after deploy for blue-green script to use
3. Update blue-green deploy to use crane instead of docker pull
   (fixes OCI/Docker digest mismatch issue)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

.github/workflows/docker_build.yml

@@ -561,45 +561,44 @@ jobs:
           # Use crane to pull images (handles OCI format correctly) then load into Docker
           # This avoids digest mismatch from DO registry's OCI->Docker format conversion
           echo "Installing crane..."
-          CRANE_PATH="/opt/eagle0/crane"
-          rm -f "\$CRANE_PATH"
+          rm -f crane
           curl -sL https://github.com/google/go-containerregistry/releases/download/v0.20.2/go-containerregistry_Linux_x86_64.tar.gz | tar xzf - crane
-          mv crane "\$CRANE_PATH"
-          chmod +x "\$CRANE_PATH"
-          if [ ! -x "\$CRANE_PATH" ]; then
+          chmod +x crane
+          if [ ! -x crane ]; then
             echo "ERROR: Failed to install crane"
-            ls -la "\$CRANE_PATH" || true
+            ls -la crane || true
             exit 1
           fi
-          echo "Crane installed at \$CRANE_PATH"
-          ls -la "\$CRANE_PATH"
+          echo "Crane installed"
+          ls -la crane
 
           # crane uses Docker config for auth
           echo "Pulling Eagle image with crane..."
-          "\$CRANE_PATH" pull "\${EAGLE_IMAGE}" eagle.tar || { echo "ERROR: Failed to pull eagle image"; exit 1; }
+          ./crane pull "\${EAGLE_IMAGE}" eagle.tar || { echo "ERROR: Failed to pull eagle image"; exit 1; }
           echo "Loading Eagle image into Docker..."
           docker load -i eagle.tar
           rm eagle.tar
 
           echo "Pulling Shardok image with crane..."
-          "\$CRANE_PATH" pull "\${SHARDOK_IMAGE}" shardok.tar || { echo "ERROR: Failed to pull shardok image"; exit 1; }
+          ./crane pull "\${SHARDOK_IMAGE}" shardok.tar || { echo "ERROR: Failed to pull shardok image"; exit 1; }
           echo "Loading Shardok image into Docker..."
           docker load -i shardok.tar
           rm shardok.tar
 
           echo "Pulling Admin image with crane..."
-          "\$CRANE_PATH" pull "\${ADMIN_IMAGE}" admin.tar || { echo "ERROR: Failed to pull admin image"; exit 1; }
+          ./crane pull "\${ADMIN_IMAGE}" admin.tar || { echo "ERROR: Failed to pull admin image"; exit 1; }
           echo "Loading Admin image into Docker..."
           docker load -i admin.tar
           rm admin.tar
 
           echo "Pulling JFR Sidecar image with crane..."
-          "\$CRANE_PATH" pull "\${JFR_SIDECAR_IMAGE}" jfr-sidecar.tar || { echo "ERROR: Failed to pull jfr-sidecar image"; exit 1; }
+          ./crane pull "\${JFR_SIDECAR_IMAGE}" jfr-sidecar.tar || { echo "ERROR: Failed to pull jfr-sidecar image"; exit 1; }
           echo "Loading JFR Sidecar image into Docker..."
           docker load -i jfr-sidecar.tar
           rm jfr-sidecar.tar
 
-          rm "\$CRANE_PATH"
+          # Keep crane for blue-green deploys (don't delete it)
+          echo "Crane kept at ./crane for future blue-green deploys"
 
           # Also pull other compose images
           docker pull nginx:alpine || true

scripts/deploy-blue-green.sh

@@ -48,22 +48,40 @@ get_active_instance() {
     fi
 }
 
-# Pull image with retry (handles intermittent registry/digest issues)
+# Pull image with retry using crane (handles OCI/Docker digest mismatch)
 pull_with_retry() {
     local image=$1
     local max_attempts=${2:-3}
     local attempt=1
 
-    while [ $attempt -le $max_attempts ]; do
-        log_info "Pulling image (attempt ${attempt}/${max_attempts})..."
-        if docker pull "${image}"; then
-            log_info "Image pulled successfully"
-            return 0
-        fi
-        log_warn "Pull failed, retrying in 5 seconds..."
-        sleep 5
-        attempt=$((attempt + 1))
-    done
+    # Use crane if available (handles OCI format correctly)
+    if [ -x "${APP_DIR}/crane" ]; then
+        while [ $attempt -le $max_attempts ]; do
+            log_info "Pulling image with crane (attempt ${attempt}/${max_attempts})..."
+            if "${APP_DIR}/crane" pull "${image}" /tmp/image.tar && docker load -i /tmp/image.tar; then
+                rm -f /tmp/image.tar
+                log_info "Image pulled and loaded successfully"
+                return 0
+            fi
+            rm -f /tmp/image.tar
+            log_warn "Pull failed, retrying in 5 seconds..."
+            sleep 5
+            attempt=$((attempt + 1))
+        done
+    else
+        # Fallback to docker pull if crane not available
+        log_warn "crane not found at ${APP_DIR}/crane, falling back to docker pull"
+        while [ $attempt -le $max_attempts ]; do
+            log_info "Pulling image (attempt ${attempt}/${max_attempts})..."
+            if docker pull "${image}"; then
+                log_info "Image pulled successfully"
+                return 0
+            fi
+            log_warn "Pull failed, retrying in 5 seconds..."
+            sleep 5
+            attempt=$((attempt + 1))
+        done
+    fi
     log_error "Failed to pull image after ${max_attempts} attempts"
     return 1
 }