From fa43c2f4e95effdb0c481fe3c6119f9262bfdaa5 Mon Sep 17 00:00:00 2001 From: Bryan Van Deusen Date: Sat, 29 Aug 2026 00:32:27 -0400 Subject: [PATCH] ci: a docs-only merge to main produced no image, so no : for that commit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Rule 145 promises every push to `main` publishes a `:`, so any production commit is addressable without a release ceremony. `ci.yml`'s `paths:` filter quietly broke that: a commit touching only docs never triggered the lane, so that commit had no image and no sha tag. Pre-existing — the filter has always been there — but it is rule 145's guarantee and step 6 is where the tag set is being made to match the rule, so it is this step's to close. Confirmed live on a0c789b: a docs-only push produced two runs, both client lanes skipping correctly, and NO image at all. The server image now always builds. It is the cheap one — ~15 seconds against 6 and 9 minutes for the clients, which is exactly why they skip and it does not — and always building is what keeps `python:3.12-slim` fresh on something that can face the internet. That is also why §4's base-image tension does not bite this project: the artifact it would apply to is the one that never skips. #3146 Co-Authored-By: Claude Opus 5 --- .forgejo/workflows/ci.yml | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml index 54f08ce..a842cb7 100644 --- a/.forgejo/workflows/ci.yml +++ b/.forgejo/workflows/ci.yml @@ -25,18 +25,20 @@ name: CI & Build on: push: + # NO `paths:` FILTER, and unlike the client lanes this one does not skip either — + # the image ALWAYS builds. Two reasons: + # + # * Rule 145 promises that every push to `main` publishes a `:`, so any + # production commit is addressable. A path filter quietly broke that promise + # for a docs-only merge: no trigger, no image, no sha tag for that commit. + # * It is the artifact most exposed to base-image staleness (`python:3.12-slim` + # is a floating tag and this can face the internet), and building every push + # picks those updates up. That is why note 3127 §4's base tension does not + # bite here — the one artifact it would apply to never skips. + # + # Affordable because it is the cheap one: ~15 seconds, against 6 and 9 minutes + # for the clients, which is why THEY skip and this does not. branches: [dev, main] - paths: - - "src/**" - - "frontend/**" - - "tests/**" - - "pyproject.toml" - - "alembic/**" - - "alembic.ini" - - "Dockerfile" - # The version deriver — see the note in desktop.yml. - - "packaging/**" - - ".forgejo/workflows/ci.yml" # Dispatched by the Android lane once it has published a client, so the image # that bakes it in is built AFTER the APK exists rather than racing it. See the # `gate` job below for the other half.