Bryan Van Deusen
ff6e99eb62
Android / Build, or is the channel already serving this? (push) Successful in 3s
CI & Build / Build now, or wait for Android? (push) Successful in 3s
CI & Build / Python lint (push) Successful in 3s
Desktop (Tauri) / Build, or is the channel already serving this? (push) Successful in 2s
CI & Build / TypeScript typecheck (push) Successful in 6s
CI & Build / Python tests (push) Failing after 15s
CI & Build / integration (push) Successful in 16s
CI & Build / Build & push image (push) Skipped
Desktop (Tauri) / Windows installer (cross-compiled) (push) Successful in 3m10s
Desktop (Tauri) / Tauri desktop (Linux) (push) Successful in 5m19s
Desktop (Tauri) / Update manifest (push) Successful in 10s
Android / Kotlin + Rust (APK) (push) Successful in 8m3s
~104 MB on top of ~85 MB, almost all of it the AppImage. That is what the product being complete costs (rule 23): a self-hoster gets a working app for their machine from the server holding their notes, with no account on a forge that is private. The AppImage is not optional within that — it is the only bundle that can replace itself in place, so a server without one cannot serve in-app updates to anybody. `packaging/fetch-clients.sh` replaces the inline fetch and writes the fixed names and sidecars `client_dist.py` reads. It never fails: a platform with nothing published means the server advertises nothing for it and the UI hides that download, and eight fetches must not become eight ways to redden a green lane. THE VERSION IS FETCHED, NOT DERIVED, and this is the part that would have been wrong the easy way. The obvious shortcut is `version.sh display desktop` in the image job — it has the checkout. But this commit may not be the commit the channel is serving: a push touching only `src/` does not rebuild the desktop, so the channel still holds an older build and a locally-derived version would describe those bytes with this commit's number. `client_dist.py`'s size check could not catch it, because size IS measured from the real file — it would sail through and lie about the version alone. So `write-manifest.sh` now publishes `thoughtsync-desktop.json` beside `latest.json`, from the same two values in the same breath, and only size/sha256 are measured at bake time. Which needed the prune's keep-list, or the sidecar would have been uploaded and deleted again in the same run — a fixed name is self-limiting, which is exactly why that list exists. `version_code` is NOT uniformly an integer, and coercing it was a leftover from the days when Android was the only platform. Android's must stay a JSON number: `ClientRelease` in core declares it `i64` and a string fails to deserialize on every phone in the field. The desktop's is Tauri's semver key `1.0.<minutes>` — the value its updater actually compares — and `int()` would have rejected every desktop sidecar CI writes. The table now says which is which, and tests pin both directions. Also retires the comment above the fetch step, which claimed the APK came from "always the rolling dev release" and mentioned `:<version>` images. M314 step 3 made the channel conditional in the code directly below it, and step 6 removed version-shaped image tags entirely. Verified against the live dev channel before pushing: the Android half resolves and exits 0, the desktop half degrades with a warning because the sidecar does not exist yet, and all five constructed bundle filenames return 200.
56 lines
2.2 KiB
Docker
56 lines
2.2 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# Stage 1: build the Vue frontend (also type-checks via `vue-tsc` in the build script).
|
|
FROM node:22-alpine AS build-frontend
|
|
WORKDIR /build
|
|
COPY frontend/package.json frontend/package-lock.json* ./
|
|
RUN npm ci --quiet
|
|
COPY frontend/ .
|
|
RUN npm run build
|
|
|
|
# Stage 2: Python runtime.
|
|
FROM python:3.12-slim AS runtime
|
|
WORKDIR /app
|
|
|
|
COPY pyproject.toml .
|
|
COPY src/ src/
|
|
RUN --mount=type=cache,target=/root/.cache/pip \
|
|
pip install .
|
|
|
|
# Bake the built SPA into the package's static dir (served by app.py). PYTHONPATH
|
|
# points at /app/src so the runtime imports this source tree (with static/ present),
|
|
# not the pip-installed copy.
|
|
COPY --from=build-frontend /build/dist/ src/thoughtsync/static/
|
|
COPY alembic.ini .
|
|
COPY alembic/ alembic/
|
|
|
|
# The clients this server hands out — the APK and all four desktop bundles. CI
|
|
# fetches the newest published build of each into ./client immediately before this
|
|
# runs (packaging/fetch-clients.sh), so both image tags ship a full set and a
|
|
# `docker compose pull` delivers new ones with no file copying by hand.
|
|
#
|
|
# ~104 MB of this image is that set, almost all of it the AppImage.
|
|
#
|
|
# Fetched by the JOB rather than here on purpose: the releases are private, and a
|
|
# token used inside a build ends up in the build context or a layer.
|
|
#
|
|
# LAST of the COPYs, deliberately: this directory changes on every build, so
|
|
# putting it above the `pip install` layer would invalidate that layer every time.
|
|
#
|
|
# The directory is tracked (client/.keep) so this COPY cannot fail on a tree where
|
|
# that step never ran. An image with no clients — or with some and not others — is
|
|
# a supported state: the server advertises what it has and the web UI hides the
|
|
# rest (client_dist.py).
|
|
COPY client/ src/thoughtsync/client/
|
|
|
|
ENV PYTHONPATH=/app/src
|
|
|
|
ARG BUILD_VERSION=dev
|
|
ENV APP_VERSION=$BUILD_VERSION
|
|
|
|
EXPOSE 5000
|
|
# Wait for the database, run migrations, then serve. The DB wait keeps a briefly
|
|
# slow/unready database from crash-looping the container. Family convention
|
|
# (rule 82): schema is built by real migrations, never metadata.create_all.
|
|
CMD ["sh", "-c", "python -m thoughtsync.dbwait && alembic upgrade head && hypercorn 'thoughtsync.app:create_app()' --bind 0.0.0.0:5000 --keep-alive 600"]
|