bvandeusenandClaude Opus 5
aeb8781c4e
test-go / test (push) Successful in 1m43s
test-web / test (push) Successful in 1m13s
test-go / integration (push) Successful in 4m12s
release / Build signed APK (releases and dev) (push) Successful in 5m11s
release / Build + push container image (push) Successful in 38s
release / Verify release artifacts (tag releases only) (push) Skipped
The image tag map was the inverse of family rules 145 and 147 on every count: it published :vYYYY.MM.DD.HHMM that nobody pinned, published :main that rule 147 says should not exist, and published no commit-addressable image at all — so the rollback unit the rule names did not exist in this repo. A bad main push had nothing to roll back to but the previous release tag, which may be many commits back. The whole map is now: dev → :dev main → :latest + :<sha> tag → :latest A release refreshes the channel and mints nothing else. The tag build rebuilds the SAME SOURCE as main's build minutes earlier, differing only in which APK is baked in, so rule 145's immutability clause applies directly: move the channel tag, never re-push a commit-addressable one. :latest has to move here rather than waiting for the next main push, or the channel would carry the previous release's APK indefinitely — a channel that cannot refresh itself (rule 146). Two consequences that are not optional: The verify job asserted the :<version> image existed. With version tags gone that would fail every release for a tag nothing mints. Re-pointed at the :<sha> image rather than deleted — deleting it is the tempting way to make a failing guard go green, and it earns its keep twice now: it still catches an image push that silently did not happen, and it additionally proves the ordering, since a tag cut on a commit whose main build never completed has no rollback target. The server's self-reported version was the literal string "main" or "dev". That was survivable while :vYYYY.MM.DD.HHMM existed to identify a build; with version tags gone it is the ONLY thing that says which build is running, and two dev images months apart were indistinguishable. It now carries the derived name from ci/version.sh on every lane, with the channel as a sibling field (rule 149) rather than folded into the string. Surfaced at /healthz and beside the version in Settings. Guards added for each arm of the policy, and every one was falsified against the specific regression it names before committing. That caught two real bugs in the guards themselves: stepBody cut at the next `- name:`, which returns an EMPTY body for the last step in a job and made the assertions pass vacuously, and its replacement cut at any blank line followed by indentation, which truncated a step mid-run-block. The helper now refuses an empty body outright. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SQ31KQpYbStyK5y58UmPLH
65 lines
2.6 KiB
Docker
65 lines
2.6 KiB
Docker
# syntax=docker/dockerfile:1.6
|
|
|
|
FROM node:22-bookworm-slim AS web
|
|
WORKDIR /web
|
|
COPY web/package.json web/package-lock.json ./
|
|
RUN npm ci
|
|
COPY web/ ./
|
|
RUN npm run build
|
|
|
|
FROM golang:1.25-bookworm AS builder
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY . .
|
|
# Overwrite the committed placeholder with the freshly-built SPA assets.
|
|
COPY --from=web /web/build ./web/build
|
|
ENV CGO_ENABLED=0
|
|
# Version stamping. release.yml passes the DERIVED version name
|
|
# (YYYY.MM.DD.HHMM) and the lane's channel; a local `docker build` falls back
|
|
# to "dev"/"local". Both are surfaced at /healthz.
|
|
#
|
|
# These are two values on purpose (family rule 149): the same commit built on
|
|
# dev and on main reports the same NAME and differs only in CHANNEL. Folding
|
|
# the channel into the version string is what the rule forbids — the version
|
|
# used to BE the channel word here ("main"/"dev"), which meant two dev images
|
|
# eight weeks apart were indistinguishable.
|
|
ARG MINSTREL_VERSION=dev
|
|
ARG MINSTREL_CHANNEL=local
|
|
RUN go build -trimpath \
|
|
-ldflags="-s -w \
|
|
-X 'git.fabledsword.com/bvandeusen/minstrel/internal/server.ServerVersion=${MINSTREL_VERSION}' \
|
|
-X 'git.fabledsword.com/bvandeusen/minstrel/internal/server.ServerChannel=${MINSTREL_CHANNEL}'" \
|
|
-o /out/minstrel ./cmd/minstrel
|
|
|
|
FROM debian:bookworm-slim
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends ca-certificates ffmpeg \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN groupadd --system --gid 1000 minstrel \
|
|
&& useradd --system --uid 1000 --gid minstrel --shell /usr/sbin/nologin minstrel
|
|
|
|
COPY --from=builder /out/minstrel /usr/local/bin/minstrel
|
|
COPY config.example.yaml /etc/smartmusic/config.yaml
|
|
|
|
# Pre-create the data directory owned by the runtime user. Cached artifacts
|
|
# (playlist cover collages, artist art, album-cover fallbacks) all land here.
|
|
# A non-writable path at this location silently breaks every downstream
|
|
# cache, so we create + chown it once at image build. Operators mount a
|
|
# named volume on top to persist across container recreates.
|
|
RUN mkdir -p /app/data /app/client && chown -R minstrel:minstrel /app
|
|
WORKDIR /app
|
|
|
|
# In-app update channel (#397). client/ in the build context holds
|
|
# minstrel.apk + minstrel.apk.version (populated by release.yml on tag
|
|
# pushes; .gitkeep + README otherwise). Endpoints return 404 when the
|
|
# APK files aren't present, so non-tag images degrade gracefully.
|
|
COPY --chown=minstrel:minstrel client/ /app/client/
|
|
|
|
USER minstrel
|
|
EXPOSE 4533
|
|
ENV MINSTREL_STORAGE_DATA_DIR=/app/data
|
|
ENTRYPOINT ["/usr/local/bin/minstrel"]
|
|
CMD ["--config", "/etc/smartmusic/config.yaml"]
|