Repository navigation
ci(release): stop publishing on main and make the deploy path follow releases - #944
chappie-daemon wants to merge 4 commits into
Conversation
The container-publish removal left two acceptance criteria open. The relay host pulls its image through a GitHub webhook, and that stack both pulled tag `main` and ignored every event except a push to the watched branch. With pushes no longer publishing, that path could never see a new image. - release.yml names its tags instead of inheriting metadata-action's defaults: the version and `latest`, which is the tag deploys pull. The defaults already produce these for a vX.Y.Z release, but a default is not a contract, and the deploy path now depends on it. - DEPLOY-RUNBOOK records the two host-side steps the change requires, and says plainly that deployments are manual until both are done. - the spec asserts the `latest` tag, so a silent action change cannot strand a host on its last pulled image.
🦋 Changeset detectedLatest commit: 3db1159 The changes in this PR will be included in the next version bump. This PR includes changesets to release 2 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
🔍 Site preview for this PR (includes all changes on this branch): https://nostream-web-pr-944.cameri.workers.dev/preview/944/ The https://ema.tnsor.network/preview/944/ form serves the same build once this PR merges — the production router that proxies /preview/* ships with it. Updates with every push to this PR; deleted when the PR closes. |
 [Medium impact] The PR appears safe to merge; the outstanding pinned-image example is a non-blocking documentation issue. Findings
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Coverage Report for CI Build 40056789724Warning No base build found for commit Coverage: 75.458%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsRequires a base build to compare against. How to fix this → Coverage Stats
💛 - Coveralls |
|
@Ferryx349 Adding you as reviewer. This code changes how releases are published hence we need to ensure this won't break our sandbox deployment. |
The release gate only matched tags starting with `v`, but changesets has tagged every relay release `nostream@X.Y.Z` since 3.5.0. Every release from that point on was skipped by the job-level `if:`, so the workflow has not published an image since v3.4.1 - and with the publisher now removed from `checks.yml`, nothing does. Three faults, all in the tag path: - the `if:` did not match the changesets tag; - a semver rule derives its input from the git ref and emits nothing for a non-semver tag, and with no version the `latest` rule is skipped as well, so even a matched release would have pushed no tag. Neither `prefix=` nor `value=` can put the prefix back: one is rendered after parsing, the other replaces the whole tag; - the docs told operators to pull a tag the workflow never produced. The tags now come from a `match` rule for the semver form, the ref for the release tag itself, and a literal `latest`. Verified by running this action revision's own `Meta` class over the workflow's extracted `tags:` input, against its pristine source: a relay release yields `3.6.2`, `nostream@3.6.2` and `latest`; a legacy `v3.4.1` yields `3.4.1`, `v3.4.1` and `latest`; a website release is stopped by the job gate. The spec's gate test evaluates the expression instead of substring-matching it, so a typo that still contains `nostream@` now fails rather than passing.
| such as `ghcr.io/cameri/nostream:latest` or pinned release tags (e.g. `ghcr.io/cameri/nostream:nostream@3.6.2`, | ||
| published as-is from the release tag, or the bare `ghcr.io/cameri/nostream:3.6.2`). |
There was a problem hiding this comment.
ghcr.io/cameri/nostream:nostream@3.6.2 is not a valid Docker image reference. @ separates an image name from its digest; it cannot appear inside a tag. Operators copying this example get an invalid-reference error.
Use the bare :3.6.2 tag already produced by the workflow. Correct the same promise in docs/DEPLOYMENT.md and the workflow comments.
Carries avantikonde's commit
2c977e6(authorship preserved) and adds one commit for the acceptance criteria it left open.Closes #881
What the first commit does
Removes the
publish-container-imagejob fromchecks.yml, so a push tomainno longer publishesghcr.io/cameri/nostream. It is a 57-line deletion with zero lines added, no permission change, andrelease.ymluntouched. The deploy docs, compose stacks and website snippet move from:mainto:latest, and the CI test is rewritten to assert the publish job is gone and thatrelease.ymlis the only holder ofpackages: write.What the second commit adds, and why
Two acceptance criteria were still open, both on the deploy side.
The tag is now named, not inherited.
release.ymlhad notags:input, relying ondocker/metadata-action's defaults to producelatest. The defaults do produce it — the v3.4.1 run log showsghcr.io/cameri/nostream:v3.4.1andghcr.io/cameri/nostream:latest— but the deploy path now depends on that behaviour, so it is stated in the workflow and asserted by the spec. A default that changes silently would strand every host on its last pulled image.The deploy path follows releases.
relay.tnsor.networkpulls through a GitHub webhook that accepted onlypushto the watched branch and asked for tagmain. With pushes no longer publishing, that path could never see a new image. The fix lives incontainers/nostream-dev-webhook/in the workspace repo (cameri/phoenix-server) — committed and pushed there, since the webhook stack is not part of this repository.DEPLOY-RUNBOOK.mdrecords the two host-side steps it requires.Verification
checks.ymlrevertedexpected {…} to be undefinedtags:block removedbiome linton the changed specrelease.yml/checks.ymlYAMLpackages: writeonly onbuild-and-push-imageThe webhook verification is worth a line: running the actual mapping through redpanda-connect caught a defect in my first draft — Bloblang has
has_prefix, notstarts_with— which no amount of reading the config would have found. All six branches (push to the watched branch, push elsewhere, relay release, website release, edited release, ping) now produce the expected accept or ignore.Five failures in
test/unit/repositories/user-subscription-repository.spec.tsappear in the full suite. They are pre-existing: the same 5 fail at basee417437on this branch's parent, and this change touches no repository code.Rollout
Merging this stops image publishing on
mainimmediately. Before the next deploy, the host needsNOSTREAM_TAG=latestand the GitHub webhook subscribed to releases. Until both are done, deployments are manual — pull the tag by hand.DEPLOY-RUNBOOK.mdsays so.Credit
Original work: avantikonde — commit
2c977e6, and the diagnosis in #881 of what had to move. Their contribution is unmodified in the first commit.