bvandeusen
609bc82acc
Build images / sign-extension (push) Successful in 4s
CI / extension-version (push) Successful in 4s
CI / lint (push) Successful in 4s
Build images / build-ml (push) Successful in 7s
Build images / build-agent (push) Successful in 7s
Build images / build-web (push) Successful in 7s
CI / frontend-build (push) Successful in 17s
extension / lint (push) Successful in 20s
CI / backend-lint-and-test (push) Successful in 29s
CI / integration (push) Successful in 3m43s
Before building, each job asks the registry whether this artifact's content is already published. On a hit it skips the build entirely and repoints the channel and date tags at the existing manifest with `imagetools create` — registry-side, no layer transfer, seconds. This is the step that stops a push touching only `agent/` from rebuilding web and ml, and stops a merge to main rebuilding what dev already built. The question is asked with a new `artifacts.sh identity`, not with the date tag: the date tag is day-precise and last-one-wins, so two different builds share it and it cannot answer "is this content published?". The commit sha would move on every push and never hit, which is the redundant rebuild being removed. The revision does both jobs — content-unique, and stable across pushes that did not touch the artifact. Identity is channel-qualified for web and only for web, because web is the only image that takes a build-arg: FC_CHANNEL is baked in and reported by /api/extension/manifest, so its dev and main builds of one revision are genuinely different images. ml and agent take none, which is what lets a merge reuse dev's build rather than rebuilding the agent's CUDA image to produce bytes that already exist. tests/test_artifact_identity.py reads the Dockerfiles and fails if that list drifts from the ARG declarations, in either direction — collapsing the channels ships an instance that reports the wrong one, and splitting them needlessly rebuilds every merge. Failure direction is deliberate: an inspect that errors for any reason reads as a miss and the build runs. Only a real 200 skips one. A tag-push never claims the identity. It rebuilds a revision main already published, and image configs are not bit-reproducible, so re-pushing r-<rev> would point an immutable tag at fresh bytes — rule 145's exact prohibition. It publishes only its own :v... label and otherwise reuses. Base-image freshness, decided rather than left implicit: an artifact whose source stops moving stops picking up base updates under its pinned tag. That is what a pin means, and rule 145 already says the refresh belongs on the moving tag instead. Filed as #3154 rather than folded in here, because the naive version regresses :latest on the next unrelated push. ci.yml's backend lane gains fetch-depth: 0 — the new tests derive real revisions, and on a depth-1 clone that derivation returns the tip sha or fails, so the lane would go green while asserting nothing. The three build jobs' shadow steps are renamed and re-commented: those values stopped being informational at step 3, and a step captioned "nothing reads this" beside steps that do is worse than no caption.
1014 lines
54 KiB
YAML
1014 lines
54 KiB
YAML
name: Build images
|
|
|
|
on:
|
|
push:
|
|
# `:dev` builds were dropped 2026-05-26 to save a docker build per dev
|
|
# push, on the reasoning that "operator tests from `:latest` after
|
|
# merge-to-main". Restored 2026-08-27: that is testing by shipping, and
|
|
# family rules 146/147 now name it directly — `main` IS production, and a
|
|
# channel that can only be refreshed by shipping is not a channel. The
|
|
# pressure to merge in order to try something does not come from
|
|
# carelessness; it comes from `:dev` being unable to carry the build.
|
|
#
|
|
# All three images build on dev, deliberately: a `:dev` web image paired
|
|
# with a stale `:dev` ml or agent is a worse trap than no dev channel at
|
|
# all, since the mismatch only shows up as a runtime failure.
|
|
branches: [main, dev]
|
|
# Tag-push triggers an immutable per-version image build (e.g.
|
|
# `:v26.05.26.5`) — gives a real rollback story alongside the floating
|
|
# `:main` / `:latest`. Layer reuse keeps the registry-storage cost
|
|
# negligible per tag. Doesn't overlap with the push-to-main build (that
|
|
# one publishes `:main` + `:latest`; the tag-push build publishes only
|
|
# `:<tag>`).
|
|
tags: ['v*']
|
|
|
|
# Requires repo secret RELEASE_TOKEN — a Forgejo PAT with scopes:
|
|
# - write:package, read:package (for docker push to git.fabledsword.com)
|
|
# - write:release (for ext-<version> release asset cache)
|
|
# - write:issue (for future issue-management automation)
|
|
# The injected GITHUB_TOKEN cannot be used — it lacks write:package.
|
|
|
|
jobs:
|
|
# Sign-or-fetch-from-cache: signs the extension via AMO if no ext-<version>
|
|
# Forgejo release exists yet, otherwise downloads the cached signed XPI.
|
|
# Result is uploaded as an Actions artifact for build-web to consume.
|
|
#
|
|
# Why this lives in build.yml (not a separate workflow): the image a push
|
|
# publishes MUST carry the XPI. A separate sign workflow racing build.yml
|
|
# leaves that image without one for ~5min (until the commit-back triggers
|
|
# another build). Inline ordering eliminates the race.
|
|
# Cache strategy: Forgejo Release Assets — picked 2026-05-25 over Generic
|
|
# Packages (cleaner API surface) and commit-back-to-side-branch (no extra
|
|
# branch to manage). AMO blocks re-signing the same version (returns 409),
|
|
# so signing is intentionally one-shot per version.
|
|
#
|
|
# BOTH branches sign (milestone 271 step 6, 2026-08-27). Not two signatures:
|
|
# the version is the commit TIME of the newest packaged-extension change, so
|
|
# dev and main derive the SAME number for the same extension source. A dev
|
|
# push that changes the extension signs it; the merge to main then finds the
|
|
# ext-<version> release already there, hits the cache, and bundles the
|
|
# byte-identical XPI into `:latest` with no second AMO call. One signature
|
|
# per extension CHANGE, shared by both channels — that is what makes two
|
|
# channels affordable, and it is why step 4 (derived version) had to land
|
|
# first. Ungating this while the version was still the hand-set 1.0.11 would
|
|
# have hit the existing ext-1.0.11 cache and bundled MAIN's stale XPI into
|
|
# `:dev` — a dev channel confidently serving old code.
|
|
#
|
|
# Tags stay excluded: the tag path deliberately skips signing and polls for
|
|
# the release instead (see build-web's race note, 2026-05-27).
|
|
sign-extension:
|
|
if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev'
|
|
runs-on: python-ci
|
|
container:
|
|
image: git.fabledsword.com/bvandeusen/ci-python:3.14
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
# Full history is load-bearing, not a convenience: the version this
|
|
# job signs is derived from the commit TIME of the newest packaged
|
|
# extension change. A depth-1 clone sees one commit and derives a
|
|
# wrong, too-low value rather than failing (ci-requirements.md).
|
|
fetch-depth: 0
|
|
|
|
# The version is DERIVED, not read from the repo (milestone 271 step 4,
|
|
# cut over 2026-08-27). `packaging.sh version` returns MAJOR.MINOR from
|
|
# manifest.json plus a patch component that is the commit TIME of the
|
|
# newest change to a PACKAGED extension file, in minutes since
|
|
# 2020-01-01 — family rule 149, never a commit count, which orders by
|
|
# branch rather than by recency.
|
|
#
|
|
# The committed "version" in manifest.json / package.json no longer
|
|
# decides anything: the stamp step below overwrites it in the working
|
|
# tree before web-ext ever reads it. It is deliberately NOT committed
|
|
# back — the commit carrying the bump would itself be a change to the
|
|
# extension and would move the version again. The repo holds the source;
|
|
# the build derives the label.
|
|
- name: Derive extension version
|
|
id: extver
|
|
run: |
|
|
set -eu
|
|
VERSION=$(sh extension/scripts/packaging.sh version)
|
|
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
|
|
echo "Derived extension version: $VERSION"
|
|
|
|
# Firefox refuses a downgrade and AMO never releases a burned version,
|
|
# so a version that moves BACKWARDS is unrecoverable: it strands every
|
|
# install that already took the higher one. Two ways it could happen —
|
|
# a checkout without full history (derives too low), or a rewritten
|
|
# history that drops the newest packaged commit.
|
|
#
|
|
# The test is `derived < highest already signed`, strictly. Equality is
|
|
# the ORDINARY case, not a fault: an unchanged extension derives the same
|
|
# version it did last build, which is exactly what lets the ext-<version>
|
|
# cache hit and holds AMO to one call per extension CHANGE. Only moving
|
|
# backwards is a failure, so this runs on every path — cache hit
|
|
# included — rather than only before a sign.
|
|
# --- shadow mode (milestone 313, step 2) -----------------------------
|
|
# Informational ONLY. Nothing reads this and it must never fail the
|
|
# build — no `set -e`, and every derivation falls back to UNAVAILABLE.
|
|
#
|
|
# What to watch across pushes, because this is what step 3 will trust:
|
|
# * a push touching only agent/ moves the agent and leaves web and ml
|
|
# STILL. If web moves, its path set is too wide.
|
|
# * a push touching only docs moves nothing.
|
|
# * a push touching the extension moves the extension AND web, since
|
|
# web bakes in the XPI. If web does not move, its set is too narrow
|
|
# — the direction that serves stale bytes on a pin.
|
|
# * dev and main derive the same values for the same source.
|
|
- name: Shadow — derived artifact version (informational)
|
|
run: |
|
|
set -u
|
|
A=extension
|
|
T=$(sh scripts/artifacts.sh tag "$A" 2>&1 || echo UNAVAILABLE)
|
|
V=$(sh scripts/artifacts.sh version "$A" 2>&1 || echo UNAVAILABLE)
|
|
R=$(sh scripts/artifacts.sh revision "$A" 2>&1 || echo UNAVAILABLE)
|
|
echo "derived: artifact=$A tag=$T version=$V revision=$R sha=$GITHUB_SHA"
|
|
|
|
- name: Guard — the derived version must never go backwards
|
|
env:
|
|
TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
|
DERIVED: ${{ steps.extver.outputs.version }}
|
|
run: |
|
|
python3 - <<'PY'
|
|
import json, os, sys, urllib.request
|
|
|
|
API = ("https://git.fabledsword.com/api/v1/repos/"
|
|
"bvandeusen/FabledCurator/releases")
|
|
headers = {"Authorization": "token " + os.environ["TOKEN"]}
|
|
|
|
# Paginated rather than first-page-only: ext-* releases share this
|
|
# list with the v* release tags, so one page would start missing them
|
|
# as those accumulate. The bound FAILS rather than silently scanning
|
|
# part of the list and calling the highest it saw the highest there is.
|
|
tags = []
|
|
for page in range(1, 21):
|
|
req = urllib.request.Request(
|
|
f"{API}?limit=50&page={page}", headers=headers)
|
|
with urllib.request.urlopen(req, timeout=30) as resp:
|
|
batch = json.load(resp)
|
|
if not batch:
|
|
break
|
|
tags += [r.get("tag_name", "") for r in batch]
|
|
else:
|
|
sys.exit("guard: >1000 releases — pagination bound reached")
|
|
|
|
def parse(v):
|
|
try:
|
|
return tuple(int(part) for part in v.split("."))
|
|
except ValueError:
|
|
return None
|
|
|
|
derived_s = os.environ["DERIVED"]
|
|
derived = parse(derived_s)
|
|
if derived is None:
|
|
sys.exit(f"guard: derived version {derived_s!r} is not numeric")
|
|
|
|
signed = sorted(
|
|
(v, t) for t in tags if t.startswith("ext-")
|
|
for v in [parse(t[4:])] if v
|
|
)
|
|
if not signed:
|
|
print("guard: no ext-* release yet — nothing to go backwards from")
|
|
raise SystemExit(0)
|
|
|
|
hi, hi_tag = signed[-1]
|
|
print(f"guard: derived={derived_s} highest already signed={hi_tag}")
|
|
if derived < hi:
|
|
sys.exit(
|
|
f"REFUSING TO SIGN: derived {derived_s} is OLDER than the "
|
|
f"already-signed {hi_tag}. Firefox would reject it as a "
|
|
f"downgrade, and AMO will not release the burned version. "
|
|
f"First thing to check: did this job check out with "
|
|
f"fetch-depth: 0?"
|
|
)
|
|
print("guard: ok")
|
|
PY
|
|
|
|
- name: Check Forgejo release-asset cache
|
|
id: cache
|
|
env:
|
|
TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
|
run: |
|
|
set -eu
|
|
VERSION=${{ steps.extver.outputs.version }}
|
|
STATUS=$(curl -s -o release.json -w "%{http_code}" \
|
|
-H "Authorization: token $TOKEN" \
|
|
"https://git.fabledsword.com/api/v1/repos/bvandeusen/FabledCurator/releases/tags/ext-$VERSION" || echo 000)
|
|
echo "Tag lookup HTTP status: $STATUS"
|
|
# JSON parsing via python (ci-python:3.14 has stdlib json; jq is
|
|
# not in the image and adding it per ci-requirements.md is not
|
|
# warranted for a single consumer — operator-flagged 2026-05-26
|
|
# after a sign job failed with `jq: not found`).
|
|
if [ "$STATUS" = "200" ]; then
|
|
ASSET_ID=$(python3 -c "import json; r=json.load(open('release.json')); xpis=[a for a in r.get('assets', []) if a.get('name','').endswith('.xpi')]; print(xpis[0]['id'] if xpis else '')")
|
|
if [ -n "$ASSET_ID" ]; then
|
|
echo "cached=true" >> "$GITHUB_OUTPUT"
|
|
echo "asset_id=$ASSET_ID" >> "$GITHUB_OUTPUT"
|
|
echo "Cached XPI exists at ext-$VERSION (asset id $ASSET_ID); skipping AMO sign"
|
|
else
|
|
echo "cached=false" >> "$GITHUB_OUTPUT"
|
|
echo "Release ext-$VERSION exists but has no .xpi asset; will re-sign + re-upload"
|
|
fi
|
|
else
|
|
echo "cached=false" >> "$GITHUB_OUTPUT"
|
|
echo "No release named ext-$VERSION; will sign via AMO and upload"
|
|
fi
|
|
|
|
# No "download cached XPI in sign-extension" step: build-web
|
|
# fetches directly from the Forgejo ext-<version> release asset
|
|
# (removed 2026-05-26 alongside the actions/upload-artifact
|
|
# removal — sign-extension's job is just to ensure the cache
|
|
# exists on Forgejo; the build-web side reads it independently).
|
|
|
|
# web-ext signs whatever manifest.json says, so the derived value has to
|
|
# reach the tree before signing. package.json is written too: the two are
|
|
# required to agree (ci.yml's guard), and a local `npm run build` reads
|
|
# it. Working tree only — never committed, per the note on the derive
|
|
# step.
|
|
- name: Stamp the derived version into manifest.json + package.json
|
|
env:
|
|
DERIVED: ${{ steps.extver.outputs.version }}
|
|
run: |
|
|
python3 - <<'PY'
|
|
import json, os
|
|
|
|
version = os.environ["DERIVED"]
|
|
for path in ("extension/manifest.json", "extension/package.json"):
|
|
with open(path) as fh:
|
|
doc = json.load(fh)
|
|
doc["version"] = version
|
|
with open(path, "w") as fh:
|
|
json.dump(doc, fh, indent=2)
|
|
fh.write("\n")
|
|
print(f"{path}: version -> {version}")
|
|
PY
|
|
|
|
- name: Sign via AMO (cache miss)
|
|
if: steps.cache.outputs.cached != 'true'
|
|
run: |
|
|
cd extension && npm install --no-save --no-audit --no-fund && npm run sign
|
|
env:
|
|
WEB_EXT_API_KEY: ${{ secrets.MOZILLA_AMO_JWT_KEY }}
|
|
WEB_EXT_API_SECRET: ${{ secrets.MOZILLA_AMO_JWT_SECRET }}
|
|
|
|
- name: Upload signed XPI to ext-<version> release (cache miss)
|
|
if: steps.cache.outputs.cached != 'true'
|
|
env:
|
|
TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
|
run: |
|
|
set -eux
|
|
VERSION=${{ steps.extver.outputs.version }}
|
|
# AMO renames signed XPIs with its internal addon-id-safe-string;
|
|
# canonicalize to fabledcurator-<version>.xpi so the FC server's
|
|
# whitelist (backend/app/frontend.py expects 'fabledcurator-*.xpi')
|
|
# keeps working.
|
|
SIGNED=$(ls extension/web-ext-artifacts/*.xpi | head -1)
|
|
XPI="extension/web-ext-artifacts/fabledcurator-$VERSION.xpi"
|
|
cp "$SIGNED" "$XPI"
|
|
# Find-or-create the ext-<version> release. Track whether WE
|
|
# created it so an upload failure below can roll back (don't
|
|
# leave an empty release tombstone that the next run's
|
|
# cache-check mistakes for a partial-failure state).
|
|
#
|
|
# target_commitish is the signing commit, not a branch name: since
|
|
# step 6 either branch can create this release, and hard-coding
|
|
# `main` would tag a dev-signed XPI against a main commit that may
|
|
# not even contain the extension source it was built from.
|
|
STATUS=$(curl -s -o release.json -w "%{http_code}" \
|
|
-H "Authorization: token $TOKEN" \
|
|
"https://git.fabledsword.com/api/v1/repos/bvandeusen/FabledCurator/releases/tags/ext-$VERSION" || echo 000)
|
|
if [ "$STATUS" = "200" ]; then
|
|
CREATED_BY_US=false
|
|
else
|
|
curl -s -X POST -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
|
|
-d "{\"tag_name\":\"ext-$VERSION\",\"name\":\"Extension $VERSION (signed XPI cache)\",\"body\":\"Internal cache for the signed XPI consumed by build.yml's build-web job. Not a user-facing FC release.\",\"target_commitish\":\"$GITHUB_SHA\"}" \
|
|
-o release.json \
|
|
"https://git.fabledsword.com/api/v1/repos/bvandeusen/FabledCurator/releases"
|
|
CREATED_BY_US=true
|
|
fi
|
|
RELEASE_ID=$(python3 -c "import json; print(json.load(open('release.json'))['id'])")
|
|
test -n "$RELEASE_ID"
|
|
# Rollback-on-failure: if the asset upload fails AND we just
|
|
# created the release in this run, delete it. Prevents an empty
|
|
# ext-<version> release from poisoning the next workflow run
|
|
# (operator-flagged 2026-05-26 — without rollback the next run
|
|
# saw 'release exists, no asset → cache miss → sign' which AMO
|
|
# then rejected with 409 'Version already exists').
|
|
rollback_if_we_created() {
|
|
if [ "$CREATED_BY_US" = "true" ]; then
|
|
echo "Rolling back: deleting just-created release $RELEASE_ID"
|
|
curl -s -X DELETE -H "Authorization: token $TOKEN" \
|
|
"https://git.fabledsword.com/api/v1/repos/bvandeusen/FabledCurator/releases/$RELEASE_ID" || true
|
|
curl -s -X DELETE -H "Authorization: token $TOKEN" \
|
|
"https://git.fabledsword.com/api/v1/repos/bvandeusen/FabledCurator/tags/ext-$VERSION" || true
|
|
fi
|
|
}
|
|
trap 'rollback_if_we_created' EXIT
|
|
HTTP_CODE=$(curl -s -X POST -H "Authorization: token $TOKEN" \
|
|
-F "attachment=@$XPI" \
|
|
-o /dev/null -w "%{http_code}" \
|
|
"https://git.fabledsword.com/api/v1/repos/bvandeusen/FabledCurator/releases/$RELEASE_ID/assets?name=fabledcurator-$VERSION.xpi")
|
|
if [ "$HTTP_CODE" != "201" ] && [ "$HTTP_CODE" != "200" ]; then
|
|
echo "Asset upload failed with HTTP $HTTP_CODE"
|
|
exit 1
|
|
fi
|
|
# Upload succeeded — clear the rollback trap.
|
|
trap - EXIT
|
|
echo "Uploaded fabledcurator-$VERSION.xpi to ext-$VERSION release"
|
|
|
|
# No actions/upload-artifact step: Forgejo Actions (and our
|
|
# act_runner) doesn't support upload-artifact@v4+ (GHES limitation
|
|
# surfaced 2026-05-26). Instead build-web reads the signed XPI
|
|
# straight from the ext-<version> Forgejo release we just uploaded
|
|
# to. Same source of truth; no double-store.
|
|
|
|
build-web:
|
|
needs: [sign-extension]
|
|
# sign-extension runs on main and dev, and is skipped on a tag push (which
|
|
# polls for the release instead). Either is fine to build on; a FAILED sign
|
|
# is not — this condition lets success and skipped through, so a failure
|
|
# skips build-web rather than shipping an image without the XPI.
|
|
if: always() && (needs.sign-extension.result == 'success' || needs.sign-extension.result == 'skipped')
|
|
runs-on: python-ci
|
|
container:
|
|
image: git.fabledsword.com/bvandeusen/ci-python:3.14
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
# Full history: this job RE-DERIVES the extension version rather than
|
|
# being handed it, and a depth-1 clone derives a wrong, too-low value
|
|
# rather than failing — which would 404 the download of a release
|
|
# that exists perfectly well under its real name.
|
|
fetch-depth: 0
|
|
|
|
# --- derived values, one line (milestone 313) ------------------------
|
|
# These stopped being shadow output at step 3: `tag` is published on
|
|
# main and `revision` decides whether the build below runs at all. This
|
|
# step prints all three anyway, because the load-bearing steps each
|
|
# print only the one they use, and on dev the date tag is computed
|
|
# nowhere else. When a build is skipped or a pin looks wrong, this is
|
|
# the line that says what the commit derived.
|
|
#
|
|
# Still diagnostic, so it still must not fail the build — no `set -e`,
|
|
# and every derivation falls back to UNAVAILABLE. A broken echo must
|
|
# never be the reason an image does not ship.
|
|
#
|
|
# What it should say:
|
|
# * a push touching only agent/ moves the agent and leaves web and ml
|
|
# STILL. If web moves, its path set is too wide.
|
|
# * a push touching only docs moves nothing.
|
|
# * a push touching the extension moves the extension AND web, since
|
|
# web bakes in the XPI. If web does not move, its set is too narrow
|
|
# — the direction that serves stale bytes on a pin.
|
|
# * dev and main derive the same values for the same source.
|
|
- name: Report the derived artifact version
|
|
run: |
|
|
set -u
|
|
A=web
|
|
T=$(sh scripts/artifacts.sh tag "$A" 2>&1 || echo UNAVAILABLE)
|
|
V=$(sh scripts/artifacts.sh version "$A" 2>&1 || echo UNAVAILABLE)
|
|
R=$(sh scripts/artifacts.sh revision "$A" 2>&1 || echo UNAVAILABLE)
|
|
echo "derived: artifact=$A tag=$T version=$V revision=$R sha=$GITHUB_SHA"
|
|
|
|
- name: Determine tag
|
|
id: tag
|
|
run: |
|
|
# Three trigger shapes:
|
|
# refs/tags/v… → tag-push: opt-in milestone label (vYY.MM.DD,
|
|
# plus `.N` when the day already carries a tag —
|
|
# family rule 148, amended 2026-08-24 after a
|
|
# same-day tag was retargeted and a release
|
|
# deleted to make room, note 2813).
|
|
# Publish ONLY the immutable version tag;
|
|
# don't touch :latest (the main-push build
|
|
# for the merge commit already did that).
|
|
# refs/heads/main → push to main: publish :main + :latest
|
|
# (floating) AND :c-<short_sha> (immutable
|
|
# per-commit rollback substrate, per family
|
|
# release-posture rule "Tags are milestones,
|
|
# not gates — commit-SHA images are the
|
|
# rollback unit"). Rollback to any commit
|
|
# becomes `docker pull …:c-<sha>` without a
|
|
# release ceremony.
|
|
# refs/heads/dev → push to dev: publish :dev, the rolling test
|
|
# channel (family rule 146). Rolling means it may
|
|
# carry newer contents than the :c-<sha> of the
|
|
# same commit; it never writes :c-<sha> itself,
|
|
# because that is the rollback unit (rule 145).
|
|
# POSIX-safe substring (the runner shell is dash/BusyBox sh, not
|
|
# bash — `${var:0:7}` errors with "Bad substitution"; cut works
|
|
# everywhere). Operator-flagged 2026-06-01 after first :c-<sha>
|
|
# main-push build failed at this step.
|
|
SHORT_SHA=$(printf '%s' "$GITHUB_SHA" | cut -c1-7)
|
|
# The pinnable tag (milestone 313 step 3): YYYY.M.D of the commit
|
|
# THIS artifact's shipped files last changed in. Day precision is
|
|
# deliberate — same-day work is not something worth pinning, so a
|
|
# second main build the same day replaces the first rather than
|
|
# accumulating a tag nobody would roll back to.
|
|
#
|
|
# Derived per artifact, so an image whose files did not change keeps
|
|
# the tag it already had: the agent reads 2026.7.17 today while web
|
|
# reads 2026.8.27 — and the reuse step below turns that into a
|
|
# skipped build rather than a rebuild of bytes that already exist.
|
|
# `channel` is baked into the image as FC_CHANNEL and reported by
|
|
# /api/extension/manifest (milestone 271 step 7). A tag-push counts as
|
|
# `main`: a vYY.MM.DD tag is cut from main, so that image is a
|
|
# main-channel artifact wearing an immutable name.
|
|
if [ "${GITHUB_REF#refs/tags/}" != "${GITHUB_REF}" ]; then
|
|
TAG_NAME="${GITHUB_REF#refs/tags/}"
|
|
echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:${TAG_NAME}" >> "$GITHUB_OUTPUT"
|
|
echo "channel=main" >> "$GITHUB_OUTPUT"
|
|
elif [ "${GITHUB_REF##*/}" = "main" ]; then
|
|
CALVER=$(sh scripts/artifacts.sh tag web)
|
|
# Guarded, and computed only on this path. There is no `set -e` in
|
|
# this step, so a failed derivation would otherwise leave CALVER
|
|
# empty and publish the tag `fabledcurator:` — an invalid
|
|
# name, from a green step. An empty pin must never reach the
|
|
# registry.
|
|
if [ -z "$CALVER" ]; then
|
|
echo "ERROR: could not derive a web version tag" >&2
|
|
exit 1
|
|
fi
|
|
echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:main,git.fabledsword.com/bvandeusen/fabledcurator:latest,git.fabledsword.com/bvandeusen/fabledcurator:c-${SHORT_SHA},git.fabledsword.com/bvandeusen/fabledcurator:${CALVER}" >> "$GITHUB_OUTPUT"
|
|
echo "channel=main" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:dev" >> "$GITHUB_OUTPUT"
|
|
echo "channel=dev" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
# A shell step, not docker/login-action@v3, because the action's shared
|
|
# cache races itself (#3118). act_runner caches a remote action under one
|
|
# /root/.cache/act/<hash> per runner, and build-web, build-ml and
|
|
# build-agent all start in the same second and all want this same action.
|
|
# One job re-clones the directory — which empties and repopulates it —
|
|
# while another is walking it to copy into its container, and the walker
|
|
# lstat()s a file that has just vanished. It failed twice on 2026-08-27,
|
|
# naming a DIFFERENT missing file each time (`eslint.config.mjs`, then
|
|
# `jest.config.ts`), which is what rules out a corrupt cache and points at
|
|
# a race. The loser dies with MODULE_NOT_FOUND on dist/index.js before the
|
|
# action runs at all, so the secret is never even reached.
|
|
#
|
|
# Nothing is lost by dropping it: logging in is one command, the docker
|
|
# CLI is already in the CI image (ci-requirements.md), and the same
|
|
# reasoning as family rule 5 applies — a marketplace action buys nothing
|
|
# when the tool is baked into the image the workflow already selected.
|
|
#
|
|
# Password on stdin, never as an argument: an argument lands in the
|
|
# process table and draws docker's own deprecation warning.
|
|
- name: Login to Forgejo registry
|
|
env:
|
|
TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
|
ACTOR: ${{ github.actor }}
|
|
run: echo "$TOKEN" | docker login git.fabledsword.com -u "$ACTOR" --password-stdin
|
|
|
|
# --- reuse-if-published (milestone 313, step 4) ----------------------
|
|
# The identity tag names this artifact's CONTENT — r-<revision>, the
|
|
# commit its shipped files last changed in, plus the channel for images
|
|
# that bake one in. If the registry already carries it, the bytes this
|
|
# job would produce are already published and the build is pure waste:
|
|
# the channel and date tags get repointed at the existing manifest
|
|
# instead, registry-side, in seconds.
|
|
#
|
|
# This is what stops a push that touched only `agent/` from rebuilding
|
|
# web and ml, and a merge to main from rebuilding what dev already built.
|
|
#
|
|
# The failure direction is deliberate. An inspect that errors for ANY
|
|
# reason — network, auth, a registry hiccup — reads as a miss and the
|
|
# build runs. Only a genuine 200 skips one, so there is no path here
|
|
# that skips a build that was actually needed; the worst case is paying
|
|
# for a build we could have avoided.
|
|
#
|
|
# BASE-IMAGE FRESHNESS, decided rather than left implicit: an artifact
|
|
# whose source stops moving stops picking up base-image updates under
|
|
# its pinned tag. That is what a pin MEANS — a date tag has to keep
|
|
# serving the bytes it served (fabledcurator:2026.7.17 still
|
|
# resolves to July's image), or it is not a pin — and family rule
|
|
# 145 already says where the refresh goes instead: a rebuild with
|
|
# different contents publishes only the MOVING tag, never the immutable
|
|
# one. A scheduled channel-only refresh is tracked separately (#3154);
|
|
# it does not belong in the push path.
|
|
- name: Is this content already published?
|
|
id: reuse
|
|
env:
|
|
IMAGE: git.fabledsword.com/bvandeusen/fabledcurator
|
|
CHANNEL: ${{ steps.tag.outputs.channel }}
|
|
TAGS: ${{ steps.tag.outputs.tags }}
|
|
IS_TAG_PUSH: ${{ startsWith(github.ref, 'refs/tags/') }}
|
|
run: |
|
|
set -eu
|
|
ID=$(sh scripts/artifacts.sh identity web "$CHANNEL")
|
|
echo "identity=$ID" >> "$GITHUB_OUTPUT"
|
|
|
|
# A tag-push builds a revision that main already published, so it
|
|
# must NOT claim the identity: image configs are not bit-reproducible
|
|
# (embedded timestamps), so re-pushing r-<rev> would point an
|
|
# immutable tag at fresh bytes — rule 145's exact prohibition. It
|
|
# publishes only its own :v… label and otherwise reuses.
|
|
if [ "$IS_TAG_PUSH" = "true" ]; then
|
|
echo "build_tags=$TAGS" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "build_tags=$TAGS,$IMAGE:$ID" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
if docker buildx imagetools inspect "$IMAGE:$ID" >/dev/null 2>&1; then
|
|
echo "hit=true" >> "$GITHUB_OUTPUT"
|
|
echo "reuse: $IMAGE:$ID is already published — skipping the build"
|
|
else
|
|
echo "hit=false" >> "$GITHUB_OUTPUT"
|
|
echo "reuse: $IMAGE:$ID is not published — building"
|
|
fi
|
|
|
|
- name: Download signed XPI from Forgejo release asset
|
|
# Fires on every trigger shape. dev and main each bundle the XPI their
|
|
# own sign-extension just published — that is the whole point of the
|
|
# channel work (milestone 271 step 6): the dev image carries the
|
|
# extension being developed, rather than requiring a merge to try it.
|
|
# Tag-push builds re-package the same source as the preceding main-push
|
|
# build but with an immutable version tag — they need the XPI too,
|
|
# otherwise the versioned image ships without the signed extension.
|
|
#
|
|
# Tag-push vs main-push race (operator-flagged 2026-05-27 after
|
|
# v26.05.27.0 hit it): a release cut fires BOTH workflows almost
|
|
# simultaneously. Main-push runs sign-extension (1-5min AMO round
|
|
# trip) before publishing the ext-<version> release; tag-push
|
|
# skips sign-extension (gated to main) and races straight to
|
|
# this download step. Tag-push lost every time. Fix: poll the
|
|
# ext-<version> release endpoint with a sleep+retry loop (30s
|
|
# for up to 10min total) before giving up. Main-push's signing
|
|
# eventually wins and tag-push picks the release up on a later
|
|
# iteration.
|
|
# Gated on the reuse miss as well: if the image is already published it
|
|
# already contains its XPI, so this would download (and on a tag-push,
|
|
# poll up to 10 minutes for) a file nothing then reads.
|
|
if: steps.reuse.outputs.hit != 'true' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' || startsWith(github.ref, 'refs/tags/'))
|
|
env:
|
|
TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
|
run: |
|
|
set -eux
|
|
# Re-derived, not read from the repo: sign-extension published
|
|
# ext-<derived>, and the committed version has been inert since
|
|
# milestone 271 step 4. Both jobs run `packaging.sh version` over the
|
|
# same commit, so they agree by construction — and if they ever
|
|
# didn't, this download 404s and the build fails loudly instead of
|
|
# shipping a stale XPI.
|
|
VERSION=$(sh extension/scripts/packaging.sh version)
|
|
# Poll for the ext-<version> release. main-push's sign-extension
|
|
# step (AMO round-trip, 1-5min) needs to finish + upload before
|
|
# tag-push can fetch. 30s * 20 = up to 10min wait, then hard-fail.
|
|
for attempt in $(seq 1 20); do
|
|
STATUS=$(curl -s -o release.json -w "%{http_code}" \
|
|
-H "Authorization: token $TOKEN" \
|
|
"https://git.fabledsword.com/api/v1/repos/bvandeusen/FabledCurator/releases/tags/ext-$VERSION" || echo 000)
|
|
if [ "$STATUS" = "200" ]; then
|
|
echo "Found ext-$VERSION release on attempt $attempt"
|
|
break
|
|
fi
|
|
if [ "$attempt" = "20" ]; then
|
|
echo "ERROR: ext-$VERSION release not available after 10min of polling"
|
|
echo "Last HTTP status: $STATUS"
|
|
exit 1
|
|
fi
|
|
echo "Attempt $attempt: ext-$VERSION not yet published (HTTP $STATUS); sleeping 30s"
|
|
sleep 30
|
|
done
|
|
# Extract the .xpi asset's browser_download_url (Forgejo's
|
|
# /releases/assets/<id> endpoint returns ASSET METADATA, not
|
|
# the binary blob — operator-flagged 2026-05-26: my prior
|
|
# code curl'd the metadata endpoint without -f and wrote the
|
|
# resulting 404-page-not-found text into fabledcurator-*.xpi,
|
|
# which Firefox then rejected as "corrupt").
|
|
# browser_download_url is the canonical binary endpoint and
|
|
# is also publicly accessible (no token needed) but we pass
|
|
# the token anyway for symmetry with private-repo support.
|
|
DOWNLOAD_URL=$(python3 -c "import json; r=json.load(open('release.json')); xpis=[a for a in r.get('assets', []) if a.get('name','').endswith('.xpi')]; print(xpis[0]['browser_download_url'])")
|
|
test -n "$DOWNLOAD_URL"
|
|
echo "Downloading XPI from: $DOWNLOAD_URL"
|
|
mkdir -p frontend/public/extension
|
|
DEST="frontend/public/extension/fabledcurator-$VERSION.xpi"
|
|
# -f = fail on HTTP error (prevents silent corruption like the
|
|
# 2026-05-26 incident); -L = follow redirects.
|
|
curl -sfL -H "Authorization: token $TOKEN" -o "$DEST" "$DOWNLOAD_URL"
|
|
# Sanity check: the binary should start with the ZIP magic (PK\x03\x04).
|
|
# If it's anything else, the next docker build will ship a corrupt XPI.
|
|
MAGIC=$(head -c 2 "$DEST" | od -An -c | tr -d ' \n')
|
|
if [ "$MAGIC" != "PK" ]; then
|
|
echo "ERROR: downloaded XPI does not start with ZIP magic 'PK' (got '$MAGIC')"
|
|
echo "File contents preview:"
|
|
head -c 200 "$DEST"
|
|
exit 1
|
|
fi
|
|
cp "$DEST" "frontend/public/extension/fabledcurator-latest.xpi"
|
|
ls -la frontend/public/extension/
|
|
|
|
- name: Build and push web image
|
|
if: steps.reuse.outputs.hit != 'true'
|
|
uses: docker/build-push-action@v5
|
|
with:
|
|
context: .
|
|
file: Dockerfile
|
|
push: true
|
|
tags: ${{ steps.reuse.outputs.build_tags }}
|
|
# Only the web image carries a channel: it is the one that serves
|
|
# /api/extension/manifest. The ml and agent images have nothing to
|
|
# report it to.
|
|
build-args: |
|
|
FC_CHANNEL=${{ steps.tag.outputs.channel }}
|
|
|
|
# Registry-side manifest copy: no layer transfer, no local daemon, no
|
|
# rebuild. Each -t becomes another reference to the SAME manifest the
|
|
# identity tag holds, so :latest and the date pin are byte-identical to
|
|
# what was published rather than a lookalike rebuild.
|
|
#
|
|
# Runs on EVERY reuse, which is what keeps family rule 146 true: a
|
|
# rolling channel refreshes itself, so skipping a build must never mean
|
|
# leaving :dev or :latest pointing at something older than the commit
|
|
# that was just pushed.
|
|
- name: Repoint the tags at the published image (reuse)
|
|
if: steps.reuse.outputs.hit == 'true'
|
|
env:
|
|
IMAGE: git.fabledsword.com/bvandeusen/fabledcurator
|
|
IDENTITY: ${{ steps.reuse.outputs.identity }}
|
|
TAGS: ${{ steps.tag.outputs.tags }}
|
|
run: |
|
|
set -euf
|
|
# steps.tag emits ONE comma-separated list, because that is the shape
|
|
# docker/build-push-action takes; imagetools wants a -t per ref.
|
|
ARGS=""
|
|
IFS=,
|
|
for t in $TAGS; do ARGS="$ARGS -t $t"; done
|
|
unset IFS
|
|
# shellcheck disable=SC2086
|
|
docker buildx imagetools create $ARGS "$IMAGE:$IDENTITY"
|
|
echo "repointed to $IMAGE:$IDENTITY: $TAGS"
|
|
|
|
build-ml:
|
|
runs-on: python-ci
|
|
container:
|
|
image: git.fabledsword.com/bvandeusen/ci-python:3.14
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
# Full history: this job derives its artifact's version from the
|
|
# commit its shipped files last changed in (milestone 313). A
|
|
# depth-1 clone cannot see that commit — it either derives a wrong,
|
|
# too-low value or finds nothing at all, and neither is a failure
|
|
# the build would otherwise notice.
|
|
fetch-depth: 0
|
|
|
|
# --- derived values, one line (milestone 313) ------------------------
|
|
# These stopped being shadow output at step 3: `tag` is published on
|
|
# main and `revision` decides whether the build below runs at all. This
|
|
# step prints all three anyway, because the load-bearing steps each
|
|
# print only the one they use, and on dev the date tag is computed
|
|
# nowhere else. When a build is skipped or a pin looks wrong, this is
|
|
# the line that says what the commit derived.
|
|
#
|
|
# Still diagnostic, so it still must not fail the build — no `set -e`,
|
|
# and every derivation falls back to UNAVAILABLE. A broken echo must
|
|
# never be the reason an image does not ship.
|
|
#
|
|
# What it should say:
|
|
# * a push touching only agent/ moves the agent and leaves web and ml
|
|
# STILL. If web moves, its path set is too wide.
|
|
# * a push touching only docs moves nothing.
|
|
# * a push touching the extension moves the extension AND web, since
|
|
# web bakes in the XPI. If web does not move, its set is too narrow
|
|
# — the direction that serves stale bytes on a pin.
|
|
# * dev and main derive the same values for the same source.
|
|
- name: Report the derived artifact version
|
|
run: |
|
|
set -u
|
|
A=ml
|
|
T=$(sh scripts/artifacts.sh tag "$A" 2>&1 || echo UNAVAILABLE)
|
|
V=$(sh scripts/artifacts.sh version "$A" 2>&1 || echo UNAVAILABLE)
|
|
R=$(sh scripts/artifacts.sh revision "$A" 2>&1 || echo UNAVAILABLE)
|
|
echo "derived: artifact=$A tag=$T version=$V revision=$R sha=$GITHUB_SHA"
|
|
|
|
- name: Determine tag
|
|
id: tag
|
|
run: |
|
|
# Mirrors build-web's three-shape logic (tag-push / main-push /
|
|
# safety-net dev) including the per-commit :c-<short_sha> tag
|
|
# on main-push per the family release-posture rule. The -ml
|
|
# image follows the same release cadence as the web image.
|
|
# POSIX-safe substring (the runner shell is dash/BusyBox sh, not
|
|
# bash — `${var:0:7}` errors with "Bad substitution"; cut works
|
|
# everywhere). Operator-flagged 2026-06-01 after first :c-<sha>
|
|
# main-push build failed at this step.
|
|
SHORT_SHA=$(printf '%s' "$GITHUB_SHA" | cut -c1-7)
|
|
# The pinnable tag (milestone 313 step 3): YYYY.M.D of the commit
|
|
# THIS artifact's shipped files last changed in. Day precision is
|
|
# deliberate — same-day work is not something worth pinning, so a
|
|
# second main build the same day replaces the first rather than
|
|
# accumulating a tag nobody would roll back to.
|
|
#
|
|
# Derived per artifact, so an image whose files did not change keeps
|
|
# the tag it already had: the agent reads 2026.7.17 today while web
|
|
# reads 2026.8.27 — and the reuse step below turns that into a
|
|
# skipped build rather than a rebuild of bytes that already exist.
|
|
if [ "${GITHUB_REF#refs/tags/}" != "${GITHUB_REF}" ]; then
|
|
TAG_NAME="${GITHUB_REF#refs/tags/}"
|
|
echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:${TAG_NAME}" >> "$GITHUB_OUTPUT"
|
|
echo "channel=main" >> "$GITHUB_OUTPUT"
|
|
elif [ "${GITHUB_REF##*/}" = "main" ]; then
|
|
CALVER=$(sh scripts/artifacts.sh tag ml)
|
|
# Guarded, and computed only on this path. There is no `set -e` in
|
|
# this step, so a failed derivation would otherwise leave CALVER
|
|
# empty and publish the tag `fabledcurator-ml:` — an invalid
|
|
# name, from a green step. An empty pin must never reach the
|
|
# registry.
|
|
if [ -z "$CALVER" ]; then
|
|
echo "ERROR: could not derive a ml version tag" >&2
|
|
exit 1
|
|
fi
|
|
echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:main,git.fabledsword.com/bvandeusen/fabledcurator-ml:latest,git.fabledsword.com/bvandeusen/fabledcurator-ml:c-${SHORT_SHA},git.fabledsword.com/bvandeusen/fabledcurator-ml:${CALVER}" >> "$GITHUB_OUTPUT"
|
|
echo "channel=main" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:dev" >> "$GITHUB_OUTPUT"
|
|
echo "channel=dev" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
# Shell step rather than docker/login-action — see build-web's note on
|
|
# the shared action-cache race (#3118).
|
|
- name: Login to Forgejo registry
|
|
env:
|
|
TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
|
ACTOR: ${{ github.actor }}
|
|
run: echo "$TOKEN" | docker login git.fabledsword.com -u "$ACTOR" --password-stdin
|
|
|
|
# --- reuse-if-published (milestone 313, step 4) ----------------------
|
|
# The identity tag names this artifact's CONTENT — r-<revision>, the
|
|
# commit its shipped files last changed in, plus the channel for images
|
|
# that bake one in. If the registry already carries it, the bytes this
|
|
# job would produce are already published and the build is pure waste:
|
|
# the channel and date tags get repointed at the existing manifest
|
|
# instead, registry-side, in seconds.
|
|
#
|
|
# This is what stops a push that touched only `agent/` from rebuilding
|
|
# web and ml, and a merge to main from rebuilding what dev already built.
|
|
#
|
|
# The failure direction is deliberate. An inspect that errors for ANY
|
|
# reason — network, auth, a registry hiccup — reads as a miss and the
|
|
# build runs. Only a genuine 200 skips one, so there is no path here
|
|
# that skips a build that was actually needed; the worst case is paying
|
|
# for a build we could have avoided.
|
|
#
|
|
# BASE-IMAGE FRESHNESS, decided rather than left implicit: an artifact
|
|
# whose source stops moving stops picking up base-image updates under
|
|
# its pinned tag. That is what a pin MEANS — a date tag has to keep
|
|
# serving the bytes it served (fabledcurator-ml:2026.7.17 still
|
|
# resolves to July's image), or it is not a pin — and family rule
|
|
# 145 already says where the refresh goes instead: a rebuild with
|
|
# different contents publishes only the MOVING tag, never the immutable
|
|
# one. A scheduled channel-only refresh is tracked separately (#3154);
|
|
# it does not belong in the push path.
|
|
- name: Is this content already published?
|
|
id: reuse
|
|
env:
|
|
IMAGE: git.fabledsword.com/bvandeusen/fabledcurator-ml
|
|
CHANNEL: ${{ steps.tag.outputs.channel }}
|
|
TAGS: ${{ steps.tag.outputs.tags }}
|
|
IS_TAG_PUSH: ${{ startsWith(github.ref, 'refs/tags/') }}
|
|
run: |
|
|
set -eu
|
|
ID=$(sh scripts/artifacts.sh identity ml "$CHANNEL")
|
|
echo "identity=$ID" >> "$GITHUB_OUTPUT"
|
|
|
|
# A tag-push builds a revision that main already published, so it
|
|
# must NOT claim the identity: image configs are not bit-reproducible
|
|
# (embedded timestamps), so re-pushing r-<rev> would point an
|
|
# immutable tag at fresh bytes — rule 145's exact prohibition. It
|
|
# publishes only its own :v… label and otherwise reuses.
|
|
if [ "$IS_TAG_PUSH" = "true" ]; then
|
|
echo "build_tags=$TAGS" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "build_tags=$TAGS,$IMAGE:$ID" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
if docker buildx imagetools inspect "$IMAGE:$ID" >/dev/null 2>&1; then
|
|
echo "hit=true" >> "$GITHUB_OUTPUT"
|
|
echo "reuse: $IMAGE:$ID is already published — skipping the build"
|
|
else
|
|
echo "hit=false" >> "$GITHUB_OUTPUT"
|
|
echo "reuse: $IMAGE:$ID is not published — building"
|
|
fi
|
|
|
|
- name: Build and push ml image
|
|
if: steps.reuse.outputs.hit != 'true'
|
|
uses: docker/build-push-action@v5
|
|
with:
|
|
context: .
|
|
file: Dockerfile.ml
|
|
push: true
|
|
tags: ${{ steps.reuse.outputs.build_tags }}
|
|
|
|
# Registry-side manifest copy: no layer transfer, no local daemon, no
|
|
# rebuild. Each -t becomes another reference to the SAME manifest the
|
|
# identity tag holds, so :latest and the date pin are byte-identical to
|
|
# what was published rather than a lookalike rebuild.
|
|
#
|
|
# Runs on EVERY reuse, which is what keeps family rule 146 true: a
|
|
# rolling channel refreshes itself, so skipping a build must never mean
|
|
# leaving :dev or :latest pointing at something older than the commit
|
|
# that was just pushed.
|
|
- name: Repoint the tags at the published image (reuse)
|
|
if: steps.reuse.outputs.hit == 'true'
|
|
env:
|
|
IMAGE: git.fabledsword.com/bvandeusen/fabledcurator-ml
|
|
IDENTITY: ${{ steps.reuse.outputs.identity }}
|
|
TAGS: ${{ steps.tag.outputs.tags }}
|
|
run: |
|
|
set -euf
|
|
# steps.tag emits ONE comma-separated list, because that is the shape
|
|
# docker/build-push-action takes; imagetools wants a -t per ref.
|
|
ARGS=""
|
|
IFS=,
|
|
for t in $TAGS; do ARGS="$ARGS -t $t"; done
|
|
unset IFS
|
|
# shellcheck disable=SC2086
|
|
docker buildx imagetools create $ARGS "$IMAGE:$IDENTITY"
|
|
echo "repointed to $IMAGE:$IDENTITY: $TAGS"
|
|
|
|
# The desktop GPU agent (#114) — published so the operator pulls + runs it on
|
|
# the GPU machine instead of building locally. Independent of web/ml (its own
|
|
# CUDA + onnxruntime-gpu image, context = agent/). Same tag cadence.
|
|
build-agent:
|
|
runs-on: python-ci
|
|
container:
|
|
image: git.fabledsword.com/bvandeusen/ci-python:3.14
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
# Full history: this job derives its artifact's version from the
|
|
# commit its shipped files last changed in (milestone 313). A
|
|
# depth-1 clone cannot see that commit — it either derives a wrong,
|
|
# too-low value or finds nothing at all, and neither is a failure
|
|
# the build would otherwise notice.
|
|
fetch-depth: 0
|
|
|
|
# --- derived values, one line (milestone 313) ------------------------
|
|
# These stopped being shadow output at step 3: `tag` is published on
|
|
# main and `revision` decides whether the build below runs at all. This
|
|
# step prints all three anyway, because the load-bearing steps each
|
|
# print only the one they use, and on dev the date tag is computed
|
|
# nowhere else. When a build is skipped or a pin looks wrong, this is
|
|
# the line that says what the commit derived.
|
|
#
|
|
# Still diagnostic, so it still must not fail the build — no `set -e`,
|
|
# and every derivation falls back to UNAVAILABLE. A broken echo must
|
|
# never be the reason an image does not ship.
|
|
#
|
|
# What it should say:
|
|
# * a push touching only agent/ moves the agent and leaves web and ml
|
|
# STILL. If web moves, its path set is too wide.
|
|
# * a push touching only docs moves nothing.
|
|
# * a push touching the extension moves the extension AND web, since
|
|
# web bakes in the XPI. If web does not move, its set is too narrow
|
|
# — the direction that serves stale bytes on a pin.
|
|
# * dev and main derive the same values for the same source.
|
|
- name: Report the derived artifact version
|
|
run: |
|
|
set -u
|
|
A=agent
|
|
T=$(sh scripts/artifacts.sh tag "$A" 2>&1 || echo UNAVAILABLE)
|
|
V=$(sh scripts/artifacts.sh version "$A" 2>&1 || echo UNAVAILABLE)
|
|
R=$(sh scripts/artifacts.sh revision "$A" 2>&1 || echo UNAVAILABLE)
|
|
echo "derived: artifact=$A tag=$T version=$V revision=$R sha=$GITHUB_SHA"
|
|
|
|
- name: Determine tag
|
|
id: tag
|
|
run: |
|
|
SHORT_SHA=$(printf '%s' "$GITHUB_SHA" | cut -c1-7)
|
|
# The pinnable tag (milestone 313 step 3): YYYY.M.D of the commit
|
|
# THIS artifact's shipped files last changed in. Day precision is
|
|
# deliberate — same-day work is not something worth pinning, so a
|
|
# second main build the same day replaces the first rather than
|
|
# accumulating a tag nobody would roll back to.
|
|
#
|
|
# Derived per artifact, so an image whose files did not change keeps
|
|
# the tag it already had: the agent reads 2026.7.17 today while web
|
|
# reads 2026.8.27 — and the reuse step below turns that into a
|
|
# skipped build rather than a rebuild of bytes that already exist.
|
|
if [ "${GITHUB_REF#refs/tags/}" != "${GITHUB_REF}" ]; then
|
|
TAG_NAME="${GITHUB_REF#refs/tags/}"
|
|
echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-agent:${TAG_NAME}" >> "$GITHUB_OUTPUT"
|
|
echo "channel=main" >> "$GITHUB_OUTPUT"
|
|
elif [ "${GITHUB_REF##*/}" = "main" ]; then
|
|
CALVER=$(sh scripts/artifacts.sh tag agent)
|
|
# Guarded, and computed only on this path. There is no `set -e` in
|
|
# this step, so a failed derivation would otherwise leave CALVER
|
|
# empty and publish the tag `fabledcurator-agent:` — an invalid
|
|
# name, from a green step. An empty pin must never reach the
|
|
# registry.
|
|
if [ -z "$CALVER" ]; then
|
|
echo "ERROR: could not derive a agent version tag" >&2
|
|
exit 1
|
|
fi
|
|
echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-agent:main,git.fabledsword.com/bvandeusen/fabledcurator-agent:latest,git.fabledsword.com/bvandeusen/fabledcurator-agent:c-${SHORT_SHA},git.fabledsword.com/bvandeusen/fabledcurator-agent:${CALVER}" >> "$GITHUB_OUTPUT"
|
|
echo "channel=main" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-agent:dev" >> "$GITHUB_OUTPUT"
|
|
echo "channel=dev" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
# Shell step rather than docker/login-action — see build-web's note on
|
|
# the shared action-cache race (#3118).
|
|
- name: Login to Forgejo registry
|
|
env:
|
|
TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
|
ACTOR: ${{ github.actor }}
|
|
run: echo "$TOKEN" | docker login git.fabledsword.com -u "$ACTOR" --password-stdin
|
|
|
|
# --- reuse-if-published (milestone 313, step 4) ----------------------
|
|
# The identity tag names this artifact's CONTENT — r-<revision>, the
|
|
# commit its shipped files last changed in, plus the channel for images
|
|
# that bake one in. If the registry already carries it, the bytes this
|
|
# job would produce are already published and the build is pure waste:
|
|
# the channel and date tags get repointed at the existing manifest
|
|
# instead, registry-side, in seconds.
|
|
#
|
|
# This is what stops a push that touched only `agent/` from rebuilding
|
|
# web and ml, and a merge to main from rebuilding what dev already built.
|
|
#
|
|
# The failure direction is deliberate. An inspect that errors for ANY
|
|
# reason — network, auth, a registry hiccup — reads as a miss and the
|
|
# build runs. Only a genuine 200 skips one, so there is no path here
|
|
# that skips a build that was actually needed; the worst case is paying
|
|
# for a build we could have avoided.
|
|
#
|
|
# BASE-IMAGE FRESHNESS, decided rather than left implicit: an artifact
|
|
# whose source stops moving stops picking up base-image updates under
|
|
# its pinned tag. That is what a pin MEANS — a date tag has to keep
|
|
# serving the bytes it served (fabledcurator-agent:2026.7.17 still
|
|
# resolves to July's image), or it is not a pin — and family rule
|
|
# 145 already says where the refresh goes instead: a rebuild with
|
|
# different contents publishes only the MOVING tag, never the immutable
|
|
# one. A scheduled channel-only refresh is tracked separately (#3154);
|
|
# it does not belong in the push path.
|
|
- name: Is this content already published?
|
|
id: reuse
|
|
env:
|
|
IMAGE: git.fabledsword.com/bvandeusen/fabledcurator-agent
|
|
CHANNEL: ${{ steps.tag.outputs.channel }}
|
|
TAGS: ${{ steps.tag.outputs.tags }}
|
|
IS_TAG_PUSH: ${{ startsWith(github.ref, 'refs/tags/') }}
|
|
run: |
|
|
set -eu
|
|
ID=$(sh scripts/artifacts.sh identity agent "$CHANNEL")
|
|
echo "identity=$ID" >> "$GITHUB_OUTPUT"
|
|
|
|
# A tag-push builds a revision that main already published, so it
|
|
# must NOT claim the identity: image configs are not bit-reproducible
|
|
# (embedded timestamps), so re-pushing r-<rev> would point an
|
|
# immutable tag at fresh bytes — rule 145's exact prohibition. It
|
|
# publishes only its own :v… label and otherwise reuses.
|
|
if [ "$IS_TAG_PUSH" = "true" ]; then
|
|
echo "build_tags=$TAGS" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "build_tags=$TAGS,$IMAGE:$ID" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
if docker buildx imagetools inspect "$IMAGE:$ID" >/dev/null 2>&1; then
|
|
echo "hit=true" >> "$GITHUB_OUTPUT"
|
|
echo "reuse: $IMAGE:$ID is already published — skipping the build"
|
|
else
|
|
echo "hit=false" >> "$GITHUB_OUTPUT"
|
|
echo "reuse: $IMAGE:$ID is not published — building"
|
|
fi
|
|
|
|
- name: Build and push agent image
|
|
if: steps.reuse.outputs.hit != 'true'
|
|
uses: docker/build-push-action@v5
|
|
with:
|
|
context: agent
|
|
file: agent/Dockerfile
|
|
push: true
|
|
tags: ${{ steps.reuse.outputs.build_tags }}
|
|
|
|
# Registry-side manifest copy: no layer transfer, no local daemon, no
|
|
# rebuild. Each -t becomes another reference to the SAME manifest the
|
|
# identity tag holds, so :latest and the date pin are byte-identical to
|
|
# what was published rather than a lookalike rebuild.
|
|
#
|
|
# Runs on EVERY reuse, which is what keeps family rule 146 true: a
|
|
# rolling channel refreshes itself, so skipping a build must never mean
|
|
# leaving :dev or :latest pointing at something older than the commit
|
|
# that was just pushed.
|
|
- name: Repoint the tags at the published image (reuse)
|
|
if: steps.reuse.outputs.hit == 'true'
|
|
env:
|
|
IMAGE: git.fabledsword.com/bvandeusen/fabledcurator-agent
|
|
IDENTITY: ${{ steps.reuse.outputs.identity }}
|
|
TAGS: ${{ steps.tag.outputs.tags }}
|
|
run: |
|
|
set -euf
|
|
# steps.tag emits ONE comma-separated list, because that is the shape
|
|
# docker/build-push-action takes; imagetools wants a -t per ref.
|
|
ARGS=""
|
|
IFS=,
|
|
for t in $TAGS; do ARGS="$ARGS -t $t"; done
|
|
unset IFS
|
|
# shellcheck disable=SC2086
|
|
docker buildx imagetools create $ARGS "$IMAGE:$IDENTITY"
|
|
echo "repointed to $IMAGE:$IDENTITY: $TAGS"
|