Improved static caching

.pre-commit-config.yaml

@@ -58,7 +58,7 @@ repos:
 
     # runs the ruff linter and formatter
     - repo: https://github.com/astral-sh/ruff-pre-commit
-      rev: v0.15.13
+      rev: v0.15.14
       hooks:
           # linter
           - id: ruff-check # runs ruff check --force-exclude
@@ -91,7 +91,7 @@ repos:
 
     # linter for markdown files - see .markdownlint.yaml to configure rules
     - repo: https://github.com/rvben/rumdl-pre-commit
-      rev: v0.1.94
+      rev: v0.2.0
       hooks:
           - id: rumdl # Lint only (fails on issues)
           - id: rumdl-fmt # Auto-format and fail if issues remain

gateway/.github/workflows/ci.yml

@@ -47,7 +47,9 @@ jobs:
               uses: actions/checkout@v4
 
             - name: Build the Stack
-              run: docker compose -f compose.local.yaml build django
+              run: |
+                GIT_COMMIT=$(git rev-parse --short HEAD) \
+                docker compose -f compose.local.yaml build django
 
             - name: Build the docs
               run: docker compose -f compose.docs.yaml build docs

gateway/compose.local.yaml

@@ -35,6 +35,8 @@ services:
         build:
             context: .
             dockerfile: ./compose/local/django/Dockerfile
+            args:
+                GIT_COMMIT: ${GIT_COMMIT:-none}
         image: sds-gateway-local-app
         container_name: sds-gateway-local-app
         tty: true # colored logs
@@ -233,6 +235,8 @@ services:
         build:
             context: .
             dockerfile: ./compose/local/django/Dockerfile
+            args:
+                GIT_COMMIT: ${GIT_COMMIT:-none}
         image: sds-gateway-local-app
         container_name: sds-gateway-local-celery-worker
         tty: true
@@ -278,6 +282,8 @@ services:
         build:
             context: .
             dockerfile: ./compose/local/django/Dockerfile
+            args:
+                GIT_COMMIT: ${GIT_COMMIT:-none}
         image: sds-gateway-local-app
         container_name: sds-gateway-local-celery-beat
         tty: true
@@ -323,6 +329,8 @@ services:
         build:
             context: .
             dockerfile: ./compose/local/django/Dockerfile
+            args:
+                GIT_COMMIT: ${GIT_COMMIT:-none}
         image: sds-gateway-local-app
         container_name: sds-gateway-local-celery-flower
         tty: true

gateway/compose/local/django/Dockerfile

@@ -17,6 +17,7 @@ COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
 
 ARG BUILD_ENVIRONMENT=local
 ARG APP_HOME=/app
+ARG GIT_COMMIT=none
 
 ENV BUILD_ENV=${BUILD_ENVIRONMENT}
 ENV PYTHONDONTWRITEBYTECODE=1
@@ -76,4 +77,7 @@ RUN chmod +x /entrypoint /start /worker-start /flower-start /beat-start
 # copy application code to WORKDIR
 COPY . ${APP_HOME}
 
+# Generate version.json with baked-in commit hash (passed as build ARG)
+RUN echo "{\"commit\":\"${GIT_COMMIT}\",\"version\":\"${GIT_COMMIT}\",\"build_date\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"}" > ${APP_HOME}/version.json
+
 ENTRYPOINT ["/entrypoint"]

gateway/compose/production/django/Dockerfile

@@ -17,6 +17,7 @@ COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
 
 ARG BUILD_ENVIRONMENT=production
 ARG APP_HOME=/app
+ARG GIT_COMMIT=none
 
 ENV BUILD_ENV=${BUILD_ENVIRONMENT}
 ENV PYTHONDONTWRITEBYTECODE=1
@@ -77,6 +78,9 @@ RUN chmod +x /entrypoint /start /worker-start /flower-start /beat-start
 COPY --from=client-builder --chown=django:django ${APP_HOME} ${APP_HOME}
 RUN chown -R django:django ${APP_HOME}
 
+# Generate version.json with baked-in commit hash (passed as build ARG)
+RUN echo "{\"commit\":\"${GIT_COMMIT}\",\"version\":\"${GIT_COMMIT}\",\"build_date\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"}" > ${APP_HOME}/version.json
+
 # create temp_zips directory and set permissions
 RUN mkdir -p ${APP_HOME}/sds_gateway/media/temp_zips && \
     chown -R django:django ${APP_HOME}/sds_gateway/media/temp_zips && \

gateway/compose/production/nginx/nginx-default.conf

@@ -10,13 +10,29 @@ server {
     include /etc/nginx/mime.types;
     default_type application/octet-stream;
 
+    # Hashed webpack bundles — short-lived cache even for immutable assets
+    location ~ ^/static/webpack_bundles/(js|css)/ {
+        alias /usr/share/nginx/static/webpack_bundles/$1/;
+        expires 7d;
+        add_header Cache-Control "public, immutable";
+        add_header Access-Control-Allow-Origin *;
+        add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS';
+        add_header Access-Control-Allow-Headers 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
+    }
+
     location /static/ {
         alias /usr/share/nginx/static/;
 
         # Add CORS headers
         add_header Access-Control-Allow-Origin *;
         add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS';
         add_header Access-Control-Allow-Headers 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
+
+        # Short TTL for non-hashed assets (CSS, JS, images, favicons, etc.)
+        # Combined with query-string cache-busting on the Django side, stale assets
+        # are effectively impossible.
+        expires 7d;
+        add_header Cache-Control "public, max-age=604800, must-revalidate";
     }
 
 }

gateway/config/settings/base.py

@@ -169,6 +169,7 @@ def __get_random_token(length: int) -> str:
 ]
 
 LOCAL_APPS: list[str] = [
+    "sds_gateway",  # auto-populates version.json at startup
     "sds_gateway.users",
     "sds_gateway.api_methods",
     "sds_gateway.visualizations",
@@ -293,6 +294,7 @@ def __get_random_token(length: int) -> str:
                 "sds_gateway.context_processors.app_settings",
                 "sds_gateway.context_processors.system_notifications",
                 "sds_gateway.context_processors.branding",
+                "sds_gateway.context_processors.static_cache_busting",
             ],
         },
     },

gateway/justfile

@@ -32,15 +32,17 @@ default:
 [group('setup')]
 build *args:
     @echo "Pulling and building sds-gateway"
-    {{ docker_compose }} pull --ignore-buildable
-    {{ docker_compose }} build {{ args }}
+    ./scripts/update-version-json.sh
+    GIT_COMMIT=$(git rev-parse --short HEAD) {{ docker_compose }} pull --ignore-buildable
+    GIT_COMMIT=$(git rev-parse --short HEAD) {{ docker_compose }} build {{ args }}
 
 # pulls and rebuilds from scratch without cache
 [group('setup')]
 build-full *args:
     @echo "Pulling and building sds-gateway WITHOUT CACHE"
-    {{ docker_compose }} pull --ignore-buildable
-    {{ docker_compose }} build --no-cache {{ args }}
+    ./scripts/update-version-json.sh
+    GIT_COMMIT=$(git rev-parse --short HEAD) {{ docker_compose }} pull --ignore-buildable
+    GIT_COMMIT=$(git rev-parse --short HEAD) {{ docker_compose }} build --no-cache {{ args }}
 
 # removes ephemeral files, like python caches and test coverage reports
 [group('utilities')]