bvandeusenandClaude Opus 5
17212e9eb4
test-go / test (push) Successful in 1m5s
test-go / integration (push) Successful in 3m30s
release / Build signed APK (releases and dev) (push) Successful in 5m10s
release / Build + push container image (push) Successful in 1m31s
release / Verify release artifacts (tag releases only) (push) Skipped
Three build-hygiene fixes that turned up while explaining the pathspec.
**version.sh derives from what SHIPPED.** It read bare HEAD, so any commit
moved the version — including one touching only CI or a README. Rules 148
and 149 both specify the pathspec form. Now a denylist, and the direction
is the point: as an allowlist the list must be updated by whoever adds a
directory and nothing fails if they don't, so the failure mode is a changed
artifact keeping its old version silently on a green run. Inverted, new
content counts by default.
android/ is deliberately NOT excluded, and that is the subtle part. This
repo ships TWO artifacts from ONE derivation: android/ is in no server
image, but it is the APK's entire source, and excluding it would stop an
Android-only commit from moving the APK's own version — the silent
downgrade the versioning rework exists to prevent. So the list is the
union: exclude only what ships in neither, and accept that an Android
commit also nudges the server's reported version. Over-inclusion across the
two, which is the harmless direction. roundtable/roundtable-android each
keep tighter lists because they are one-artifact repos; don't copy theirs.
**.dockerignore excluded the wrong CI directory.** It named .forgejo/ and
.github/, neither of which this repo has. Gitea Actions reads .gitea/, so
the one directory that exists was the one not excluded. The "Flutter mobile
client" block had also lost its PATTERN when flutter_client/ was deleted,
leaving a comment describing an exclusion that was not happening — android/
never took its place, so 4.1MB of Gradle project entered the context and
busted the `COPY . .` layer on every Android-only change. bin/ excluded too.
**bin/minstrel was tracked** — an 18MB binary last refreshed by a commit
about web test mocks, and re-dirtied by every `make build` since. Untracked
and ignored; the file stays on disk.
Guards are behavioural rather than textual: they build throwaway repos with
pinned commit timestamps and run version.sh against them, so they break when
the derivation changes rather than when the wording does. Falsified — drop
the .gitea exclusion and the CI-only commit moves the version; add an
android exclusion and an Android commit stops moving it; exclude everything
and a source commit refuses.
One honest note on the refusal test: the script already refused an empty
result via the downstream date check, so the new explicit check improves the
diagnostic ("no commit touches the shipped file set — shallow clone?") and
not the safety. The test pins the property, which is defended in depth.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SQ31KQpYbStyK5y58UmPLH
45 lines
1.2 KiB
Plaintext
45 lines
1.2 KiB
Plaintext
# Build artifacts and node_modules — never useful inside the Docker context.
|
|
**/.git
|
|
**/.gitignore
|
|
**/node_modules
|
|
**/.svelte-kit
|
|
**/build
|
|
web/build
|
|
|
|
# The Android client — built by its own job, never from this context. The APK
|
|
# reaches the image through client/, downloaded as a CI artifact, so nothing
|
|
# here reads android/ sources.
|
|
#
|
|
# This block named `flutter_client/` until 2026-09-10 and lost its PATTERN when
|
|
# that tree was deleted, leaving a comment describing an exclusion that was no
|
|
# longer happening. android/ never took its place, so 4.1 MB of Gradle project
|
|
# has been entering the context and busting the `COPY . .` layer on every
|
|
# Android-only change.
|
|
android/
|
|
|
|
# Local `make build` output — an 18 MB binary the image never uses, since the
|
|
# builder stage compiles its own.
|
|
bin/
|
|
|
|
# Docs and IDE noise
|
|
docs/
|
|
**/.idea
|
|
**/.vscode
|
|
**/.DS_Store
|
|
|
|
# Test outputs
|
|
**/coverage
|
|
**/.nyc_output
|
|
|
|
# Local env / secrets — fail closed.
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
|
|
# CI workflow files don't need to ship in the image.
|
|
#
|
|
# This said `.forgejo/` and `.github/` — neither of which this repo has. Gitea
|
|
# Actions reads `.gitea/`, so the one directory that actually exists was the
|
|
# one not excluded, and every workflow edit invalidated the context.
|
|
.gitea/
|