fix: pin the collector to its multi-arch tag

CHANGELOG.md

@@ -16,6 +16,9 @@ Notable changes to this stack. Format follows
 ### Fixed
 
 - `bootstrap.sh` prints each `PING_<JOB>=` line on its own line.
+- The OpenTelemetry Collector runs the multi-arch `0.163.2` image again. The
+  Dependabot bump to `0.163.2-386` pulled the 32-bit x86 build. `just lint` now
+  refuses single-platform image tags.
 
 ### Removed
 

compose.yml

@@ -58,7 +58,7 @@ services:
     logging: *default-logging
 
   otel-collector:
-    image: otel/opentelemetry-collector-contrib:0.163.2-386@sha256:bd0aac7fc525d8016b7bba1e35287b1f3a43c1e2d52e2426e2496d8d45668784
+    image: otel/opentelemetry-collector-contrib:0.163.2@sha256:7f22d2a6748110ffb6a59bc0df448bccbf501cdb667d610ede4c61d3863d5849
     restart: unless-stopped
     depends_on:
       otel-queue-init:

justfile

@@ -100,6 +100,9 @@ lint:
     {{compose_smoke}} config -q
     # The spoke overlays, which otherwise first fail on a project host after vendoring.
     {{spoke_env}} docker compose -f templates/compose.telemetry.yml -f templates/compose.telemetry.gpu.yml config -q
+    # Image tags must name the multi-arch manifest. Dependabot sometimes proposes a
+    # single-platform tag such as `-386`, which an amd64 host still runs, so smoke passes.
+    @! grep -nE 'image: [^ ]+:[^@ ]*-(386|amd64|arm64|armv[5-7]|ppc64le|s390x|riscv64)(@|$)' compose*.yml templates/*.yml || { echo "error: single-platform image tag above; use the plain tag" >&2; exit 1; }
     # The exposure guards, both ways: a fully set .env passes, and each
     # documented default is refused on its own.
     @good="OTLP_AUTH_TOKEN=t GRAFANA_ADMIN_PASSWORD=p GRAFANA_ROOT_URL=https://g.example GRAFANA_COOKIE_SECURE=true GRAFANA_JWT_AUTH=true CF_ACCESS_TEAM_DOMAIN=d CF_ACCESS_AUD=a HEARTBEAT_URL=https://h ALERT_WEBHOOK_URL=https://w"; \