bvandeusenandClaude Opus 5
69ce7afc45
CI & Build / Python lint (push) Successful in 5s
CI & Build / TypeScript typecheck (push) Successful in 11s
CI & Build / Plugin hooks (push) Successful in 11s
CI & Build / integration (push) Successful in 31s
CI & Build / Python tests (push) Successful in 1m3s
CI & Build / Build & push image (push) Successful in 28s
CI set BUILD_VERSION to the CHANNEL — literally "dev", "main", or the tag —
so a running instance answered "which build are you?" with the name of a
branch: {"version":"main"}. The cost was concrete rather than theoretical.
During #3244's live acceptance a deploy was behaving as though it held older
code, and the one endpoint whose job is to settle that could not.
Rule 149's three values, now three fields:
version the NAME, YYYY.MM.DD.HHMM from COMMIT time — "is this the same
code?", so two lanes carrying one commit report one string
build the ORDERING KEY, minutes since 2020-01-01 from BUILD time —
"may this be installed over that?", and the only value anything
may compare
channel its own field. Never a suffix, never a segment of the name
Plus `commit`, so the artifact's claim about itself can be checked against
the :<sha> it was published under (rule 145) — which is exactly the question
that could not be answered tonight.
THE TWO CLOCKS ARE DELIBERATE and look like an inconsistency. The name comes
from the commit so two lanes building one source agree; the key comes from
the build so it cannot go backwards when an older commit is rebuilt. A test
pins both derivations against being "tidied" into one.
ABSENT RATHER THAN EMPTY when unknown. A local build has no ordering key and
no channel; emitting "" or a placeholder would let it claim a position in an
update order it is not part of. A malformed key is dropped rather than passed
through — a reader that cannot order is correct, one that orders on garbage
is not. The key is an int, because a string ordering key is how a comparison
silently becomes lexicographic ("9" > "10").
The payload builder is extracted from the route so it can be tested as a
dict rather than through app startup and a request context.
Tests pin the SHAPE the lanes emit, not the values, including the midnight
leading-zero case rule 149 names specifically — and assert CI never stamps a
branch name as the version again.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
70 lines
2.7 KiB
Docker
70 lines
2.7 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# Stage 1: Build Vue frontend
|
|
FROM node:22-alpine AS build-frontend
|
|
WORKDIR /build
|
|
COPY frontend/package.json frontend/package-lock.json* ./
|
|
RUN npm ci --quiet
|
|
COPY frontend/ .
|
|
RUN npm run build
|
|
|
|
# Stage 2: Python runtime
|
|
# Tracks CI image (ci-python:3.14) so test results stay representative.
|
|
FROM python:3.14-slim AS runtime
|
|
WORKDIR /app
|
|
|
|
# Installed from uv.lock, exactly like CI (issue #2194). This used to be
|
|
# `COPY pyproject.toml .` + `pip install .`, which never even copied the lock:
|
|
# the shipped image resolved its own dependency set, so CI could be green on one
|
|
# set of versions while the published image ran another. On 2026-07-28 that
|
|
# class of drift turned `main` red when mcp 2.0.0 shipped mid-session.
|
|
RUN --mount=type=cache,target=/root/.cache/pip \
|
|
pip install --no-cache-dir uv
|
|
|
|
# Dependencies before source, so the expensive layer is cached on every build
|
|
# that doesn't change the lock.
|
|
COPY pyproject.toml uv.lock ./
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
uv sync --locked --no-dev --no-install-project
|
|
|
|
COPY src/ src/
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
uv sync --locked --no-dev
|
|
|
|
# uv sync installs into a project venv rather than the system interpreter, so
|
|
# alembic and hypercorn in CMD have to be found there.
|
|
ENV PATH="/app/.venv/bin:$PATH"
|
|
|
|
COPY --from=build-frontend /build/dist/ src/scribe/static/
|
|
COPY alembic.ini .
|
|
COPY alembic/ alembic/
|
|
|
|
# Ensure Python finds the source tree (where static files live) before site-packages
|
|
ENV PYTHONPATH=/app/src
|
|
|
|
# THREE VALUES, NEVER FOLDED TOGETHER (rule 149), plus the commit.
|
|
#
|
|
# BUILD_VERSION is the NAME (YYYY.MM.DD.HHMM, from COMMIT time) — the same
|
|
# string on every lane for the same source, so it answers "is this the same
|
|
# code?" rather than "which lane built it?".
|
|
# BUILD_KEY is the ORDERING KEY (minutes since 2020-01-01, from BUILD time) —
|
|
# the only value anything may compare to decide what is newer.
|
|
# BUILD_CHANNEL is its own field. Never a suffix, never a segment of the name.
|
|
# BUILD_COMMIT lets the artifact's self-report be checked against the :<sha>
|
|
# it was published under (rule 145).
|
|
#
|
|
# Each defaults to empty rather than to a placeholder, EXCEPT the name: a
|
|
# local build genuinely has no ordering key or channel, and the endpoint says
|
|
# so by omitting them. Inventing values would make a local image claim a
|
|
# position in an update order it is not part of.
|
|
ARG BUILD_VERSION=dev
|
|
ARG BUILD_KEY=
|
|
ARG BUILD_CHANNEL=
|
|
ARG BUILD_COMMIT=
|
|
ENV APP_VERSION=$BUILD_VERSION
|
|
ENV APP_BUILD_KEY=$BUILD_KEY
|
|
ENV APP_CHANNEL=$BUILD_CHANNEL
|
|
ENV APP_COMMIT=$BUILD_COMMIT
|
|
|
|
EXPOSE 5000
|
|
CMD ["sh", "-c", "alembic upgrade head && hypercorn 'scribe.app:create_app()' --bind 0.0.0.0:5000 --keep-alive 600"]
|