Vantage/vantage-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: Build the vantagectl image on its release tag, not on every push to main

Browse Source 
vantagectl is a released tool, not a running service. An operator restoring a
database should be able to name the version they ran, and ":latest, rebuilt
whenever main moved" cannot be named after the fact.

The image now builds in vantagectl-release.yml on a vantagectl/v* tag, tagged
with that version as well as latest, with VERSION passed through so the binary
inside reports the tag rather than "dev". server-deploy.yml no longer builds
it and is back to seven images.

The cost is that a shared/ fix reaches the image only at the next release
rather than the next push to main. That is the intended trade and is written
down in CLAUDE.md next to the trigger table.
This commit is contained in:
mrhid6
2026-09-07 15:11:39 +00:00
parent e7384d334a
commit 7b13944c24
4 changed files with 84 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/server-deploy.yml
+10 -12
View File
@@ -71,16 +71,22 @@ jobs:
fi
}
# The four Go images build from the repo root and COPY
# shared/ plus their own directory, so shared/ rebuilds all
# four. proto/ is in server's list as insurance: the
# The three Go images here build from the repo root and
# COPY shared/ plus their own directory, so shared/ rebuilds
# all three. vantagectl also depends on shared/ but is NOT
# built here: it is a released tool, so its image is built and
# version-tagged by vantagectl-release.yml on a vantagectl/v*
# tag. A shared/ change therefore reaches it at the next
# release rather than on the next push to main, which is the
# point — an operator restoring a database should be running a
# version they can name, not whatever main built last night.
# proto/ is in server's list as insurance: the
# generated pb is committed under server/, but a proto change
# that someone regenerates in the same push should not depend
# on that ordering.
flag server '^(server/|shared/|proto/|default_steps/|go\.work)'
flag sitesvc '^(sitesvc/|shared/|go\.work)'
flag admin '^(admin/|shared/|go\.work)'
flag vantagectl '^(vantagectl/|shared/|go\.work)'
# The three Next images and the docs site use their own
# directory as the build context, so nothing outside it can
@@ -160,14 +166,6 @@ jobs:
docker build -t "$IMAGE" -f admin/Dockerfile .
docker push "$IMAGE"
- name: Build and push vantagectl image
if: steps.changed.outputs.vantagectl == 'true'
run: |
IMAGE="${{ vars.DOCKER_HOST }}/${{ github.repository_owner }}/vantage/vantagectl:latest"
# Root context: vantagectl depends on the shared module.
docker build -t "$IMAGE" -f vantagectl/Dockerfile .
docker push "$IMAGE"
- name: Build and push adminsite image
if: steps.changed.outputs.adminsite == 'true'
run: |
.gitea/workflows/vantagectl-release.yml
+51
View File
@@ -58,3 +58,54 @@ jobs:
vantagectl/dist/vantagectl-darwin-arm64
vantagectl/dist/vantagectl-windows-amd64.exe
vantagectl/dist/checksums.txt
# The image is built here rather than in server-deploy.yml on every push to
# main, because vantagectl is a released tool rather than a running service.
# An operator restoring a database should be able to name the version they
# ran; ":latest, rebuilt whenever main moved" cannot be named after the
# fact. It is a separate job from the binaries because it needs a
# docker-capable runner rather than a Go one, and it does not need the
# binaries — the image builds from source in its own stage.
image:
runs-on: ubuntu-docker
container: docker:dind
steps:
- name: Setup
run: apk add --update nodejs npm git
- name: Checkout
uses: actions/checkout@v4
- name: Extract version
id: version
run: |
# v0.1.0 for the binary stamp, 0.1.0 for the image tag: a
# leading v is conventional on a git tag and unconventional on
# a container tag.
VERSION="${GITHUB_REF_NAME#vantagectl/}"
echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
echo "IMAGE_TAG=${VERSION#v}" >> $GITHUB_OUTPUT
- name: Log in to registry
run: |
echo "${{ secrets.RELEASE_TOKEN }}" | \
docker login ${{ vars.DOCKER_HOST }} \
-u "${{ secrets.REGISTRY_USER }}" --password-stdin
- name: Build and push image
env:
VERSION: ${{ steps.version.outputs.VERSION }}
IMAGE_TAG: ${{ steps.version.outputs.IMAGE_TAG }}
run: |
REPO="${{ vars.DOCKER_HOST }}/${{ github.repository_owner }}/vantage/vantagectl"
# Root context: vantagectl depends on the shared module through
# a replace directive, so the build needs shared/ alongside it.
# VERSION is passed through so `vantagectl --version` inside the
# image reports the tag it was built from rather than "dev".
docker build \
--build-arg VERSION="${VERSION}" \
-t "${REPO}:${IMAGE_TAG}" \
-t "${REPO}:latest" \
-f vantagectl/Dockerfile .
docker push "${REPO}:${IMAGE_TAG}"
docker push "${REPO}:latest"