From 3f0153cba5f7bb45b01501de2eb6628474fe9f25 Mon Sep 17 00:00:00 2001 From: Bryan Van Deusen Date: Tue, 26 May 2026 18:26:56 -0400 Subject: [PATCH] ci(workflows): dedupe + versioned image tags MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ci.yml: drop pull_request: trigger — push: branches: [dev, main] already covers it; pull_request was duplicating ci.yml runs on every dev push with an open PR. (No fork PRs in this repo.) build.yml: drop dev from push triggers — operator doesn't use the :dev image. Add tags: ['v*'] trigger + tag-push branch in the Determine-tag logic so cutting a release tag publishes an immutable :v26.05.26.X image (rollback story) without re-publishing :latest. Extend the XPI-download step to fire on tag pushes too so the versioned image carries the signed extension. Net per hotfix cycle: 5 runs → 3 (no tag) / 4 (with tag). Co-Authored-By: Claude Opus 4.7 (1M context) --- .forgejo/workflows/build.yml | 43 +++++++++++++++++++++++++++++++----- .forgejo/workflows/ci.yml | 6 +++-- 2 files changed, 42 insertions(+), 7 deletions(-) diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml index 79b6b85..407dc24 100644 --- a/.forgejo/workflows/build.yml +++ b/.forgejo/workflows/build.yml @@ -2,7 +2,17 @@ name: Build images on: push: - branches: [dev, main] + # `:dev` builds dropped 2026-05-26 — operator tests from `:latest` after + # merge-to-main, not from the dev branch image. Saves one full docker + # build per dev push. + branches: [main] + # Tag-push triggers an immutable per-version image build (e.g. + # `:v26.05.26.5`) — gives a real rollback story alongside the floating + # `:main` / `:latest`. Layer reuse keeps the registry-storage cost + # negligible per tag. Doesn't overlap with the push-to-main build (that + # one publishes `:main` + `:latest`; the tag-push build publishes only + # `:`). + tags: ['v*'] # Requires repo secret RELEASE_TOKEN — a Forgejo PAT with scopes: # - write:package, read:package (for docker push to git.fabledsword.com) @@ -158,8 +168,12 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Download signed XPI from Forgejo release asset (main only) - if: github.ref == 'refs/heads/main' + - name: Download signed XPI from Forgejo release asset (main + tags) + # Fires on main-push AND on tag-push. Tag-push builds re-package the + # same source code as the preceding main-push build but with an + # immutable version tag — they need the XPI too, otherwise the + # versioned image ships without the signed extension. + if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') env: TOKEN: ${{ secrets.RELEASE_TOKEN }} run: | @@ -200,7 +214,20 @@ jobs: - name: Determine tag id: tag run: | - if [ "${GITHUB_REF##*/}" = "main" ]; then + # Three trigger shapes: + # refs/tags/v… → tag-push: publish ONLY the immutable version + # tag (e.g. :v26.05.26.5). Don't touch :latest; + # that already got published by the main-push + # build for the merge commit. + # refs/heads/main → push to main (incl. PR merge commits): + # publish :main + :latest (floating). + # anything else → safety net; shouldn't fire given the `on:` + # config above (dev was dropped). Tag :dev to + # surface the unexpected run in the registry. + if [ "${GITHUB_REF#refs/tags/}" != "${GITHUB_REF}" ]; then + TAG_NAME="${GITHUB_REF#refs/tags/}" + echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:${TAG_NAME}" >> "$GITHUB_OUTPUT" + elif [ "${GITHUB_REF##*/}" = "main" ]; then echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:main,git.fabledsword.com/bvandeusen/fabledcurator:latest" >> "$GITHUB_OUTPUT" else echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:dev" >> "$GITHUB_OUTPUT" @@ -231,7 +258,13 @@ jobs: - name: Determine tag id: tag run: | - if [ "${GITHUB_REF##*/}" = "main" ]; then + # Mirrors build-web's three-shape logic (tag-push / main-push / + # safety-net dev). The -ml image follows the same release cadence + # as the web image. + if [ "${GITHUB_REF#refs/tags/}" != "${GITHUB_REF}" ]; then + TAG_NAME="${GITHUB_REF#refs/tags/}" + echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:${TAG_NAME}" >> "$GITHUB_OUTPUT" + elif [ "${GITHUB_REF##*/}" = "main" ]; then echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:main,git.fabledsword.com/bvandeusen/fabledcurator-ml:latest" >> "$GITHUB_OUTPUT" else echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:dev" >> "$GITHUB_OUTPUT" diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml index 46db216..45b3571 100644 --- a/.forgejo/workflows/ci.yml +++ b/.forgejo/workflows/ci.yml @@ -8,8 +8,10 @@ name: CI on: push: branches: [dev, main] - pull_request: - branches: [main] + # pull_request trigger intentionally absent — with branches: [dev, main] + # above, every PR commit already fires CI via the push event on dev. Adding + # pull_request would duplicate runs on dev→main PRs. FC has no fork PRs + # (single-operator Forgejo repo) so push coverage is complete. jobs: backend-lint-and-test: