littlefox/neokom
Watch
1
2
Fork
You've already forked neokom
 1
Code Issues 8 Pull requests Projects Releases 12 Packages Activity Actions

Build the web image in CI on release tags only #202

Merged
littlefox merged 1 commit from issue-201-web-image-release into main 2026-10-20 17:32:47 +00:00
Conversation 0 Commits 1 Files changed 9 +293 -29
littlefox commented 2026-10-20 17:27:24 +00:00
Owner
Copy link

New web-image workflow: on a v* tag it builds the image in the job's own Docker daemon, runs it next to a lyskomd, checks it from outside (tools/web-image-check.py: page, wasm type, security headers, a Protocol A handshake through /relay, a foreign origin refused with 4006) and only then pushes X.Y.Z, git- and latest. Manual runs push only a given test tag. tools/web-image.sh no longer tags latest; release.sh no longer builds the image. D-053; KUBERNETES/DOCKER/DESIGN updated.

Verified: locally (NO_PUSH, all checks pass); in CI by a manual run (#339) that built, checked and pushed ci-test with REGISTRY_TOKEN; latest stayed at the 0.4.0 digest; ci-test deleted afterwards. Also ran the 0.4.0 image locally with Lysator's securityContext (uid 999, read-only root, caps dropped): all checks pass.

Closes #201

🤖 Generated with Claude Code

https://claude.ai/code/session_01XJW2ocwLunyaLiUwCBHEP8

New web-image workflow: on a v* tag it builds the image in the job's own Docker daemon, runs it next to a lyskomd, checks it from outside (tools/web-image-check.py: page, wasm type, security headers, a Protocol A handshake through /relay, a foreign origin refused with 4006) and only then pushes X.Y.Z, git-<commit> and latest. Manual runs push only a given test tag. tools/web-image.sh no longer tags latest; release.sh no longer builds the image. D-053; KUBERNETES/DOCKER/DESIGN updated. Verified: locally (NO_PUSH, all checks pass); in CI by a manual run (#339) that built, checked and pushed ci-test with REGISTRY_TOKEN; latest stayed at the 0.4.0 digest; ci-test deleted afterwards. Also ran the 0.4.0 image locally with Lysator's securityContext (uid 999, read-only root, caps dropped): all checks pass. Closes #201 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01XJW2ocwLunyaLiUwCBHEP8
Build the web image in CI on release tags only
All checks were successful
ci / check (push) Successful in 8m26s
Details
ci / desktop (push) Successful in 14m6s
Details
ci / e2e (push) Successful in 27m6s
Details
9187789de7 
The user: Lysator should be able to autoroll the image, so it may only
change on a release. Until now it was built by hand and every build,
test builds included, moved `latest`. A new web-image workflow builds the
image on a release tag in the job's own Docker daemon, runs it next to a
lyskomd and checks it from outside (page, wasm type, headers, a Protocol
A handshake through /relay, a foreign origin refused), and only then
pushes X.Y.Z, git-<commit> and latest. Hand builds are git-<commit>
only; the release script no longer builds the image.

Refs #201

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XJW2ocwLunyaLiUwCBHEP8
littlefox referenced this pull request from a commit 2026-10-21 18:55:54 +00:00
Release 0.5.0
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
area/ci
Forgejo Actions, runner, tests

  
area/desktop
Desktop build

  
area/packaging
Arch, Debian, Fedora, NixOS packages

  
area/protocol
kom-proto, wire format, charset

  
area/reading
Unread tracking, reading order, review

  
area/ui
Dioxus app, layout, interaction

  
area/web
Web build and relay

  
area/writing
Composing and sending texts

  
kind/bug
Something is broken

  
kind/feature
New functionality

  
kind/infra
Tooling, tests, CI, dev environment

  
kind/request
requests for features or changes from users

  
needs/user
Waiting for a decision or action from littlefox

  
parked
Kept for reference; no work planned until the user says so

  
perf
Run the perf workflow and its budgets on this pull request (#287)

  
security
Security-relevant

  
upstream
A proposal for Protocol A or lyskomd, for the LysKOM development group

No labels
area/ci
area/desktop
area/packaging
area/protocol
area/reading
area/ui
area/web
area/writing
kind/bug
kind/feature
kind/infra
kind/request
needs/user
parked
perf
security
upstream
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
littlefox/neokom!202
No description provided.