Build the web image on release only, so Lysator can autoroll :latest #201
Labels
No labels
area/ci
area/desktop
area/packaging
area/protocol
area/reading
area/ui
area/web
area/writing
kind/bug
kind/feature
kind/infra
kind/request
needs/user
parked
perf
security
upstream
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
littlefox/neokom#201
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
User: "we need to alter the way we build the image we deliver to lysator kubernetes. We can only build it on release and not for every push to main as we do now. We want to be able to autoroll the thing."
Today the image is built by hand (tools/web-image.sh, from tools/release.sh and for test builds), and every build moves
latest. Lysator's autoroll rolls the Deployment whenever:latestpoints somewhere new, solatestmust mean "the newest release" and nothing else.Plan (D-053):
web-imagejob, on the runners' per-job Docker daemon), tests it (page, wasm type, headers, a Protocol A handshake through the relay to lyskomd, a wrong origin refused), and only then pushesX.Y.Z,git-<sha>andlatest. Push credentials: theREGISTRY_TOKENsecret (package read/write only).image_tag) builds, tests and pushes only that tag, neverlatest: for trying the job.latestany more (test builds:git-<sha>); tools/release.sh no longer builds the image.:latestwith autoroll is supported, and when it moves.Done in #202 (main green). The web-image workflow builds the image on a v* tag in the job's own Docker daemon, runs it next to a lyskomd, checks it from outside (page, wasm type, security headers, a Protocol A handshake through /relay, a foreign origin refused with 4006), and only then pushes X.Y.Z, git- and latest. tools/web-image.sh pushes git- only; release.sh no longer builds the image. Verified locally (NO_PUSH) and in CI with a manual run (#339) that pushed the test tag ci-test with REGISTRY_TOKEN; latest stayed at the 0.4.0 digest; ci-test deleted. The first real run will be the next release tag.