Repository navigation
⬆️ chore: Move the Workflows to the Current Major Actions, Publish on Any Build Input and Keep latest on Main's Newest Image - #205
Conversation
… Images in Push Order Both workflows now use the current major of every action they call: actions/checkout v7 (CI was on v6, the publish workflow on v4), docker/setup-qemu-action v4, docker/setup-buildx-action v4, docker/login-action v4, docker/metadata-action v6 and docker/build-push-action v7. Each docker major moves the action to the Node 24 runtime, which GitHub-hosted runners already provide, and drops inputs, outputs and env vars this workflow doesn't use. This covers the five open Dependabot bumps and login-action v4, which Dependabot didn't propose. The publish workflow had no concurrency group, so two pushes to main built at the same time and whichever finished last tagged `latest`. Runs on the same ref now queue behind each other, so `latest` always ends on the newest commit, and a 30 minute job timeout keeps a hung build (one sat in "Build and push" for over an hour after the click-ui upgrade merged, against a usual 6 to 7 minutes) from holding that queue for GitHub's default 6 hours.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4f8a7f739d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
… Head Builds the Same Image
danny-avila
changed the title
latest on Main's Newest Image
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7b72326274
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…Context Before Tagging latest
danny-avila
changed the title
latest on Main's Newest Imagelatest on Main's Newest Image
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 78e5722231
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Pull Request Template
Summary
Current major actions. Both workflows now use the current major of every action they call. This covers the five open Dependabot bumps (#127, #130, #133, #134, #136), plus
docker/login-actionv4, which Dependabot didn't propose.actions/checkoutdocker/setup-qemu-actiondocker/setup-buildx-actiondocker/login-actiondocker/metadata-actiondocker/build-push-actionDOCKER_BUILD_NO_SUMMARY,DOCKER_BUILD_EXPORT_RETENTION_DAYSand the legacy export-build tool, none of which are used hereNode 24 needs Actions Runner 2.327.1 or later, which GitHub-hosted
ubuntu-latestrunners already have.oven-sh/setup-bunstays on v2, its current major.lateststays onmain's newest image. The publish workflow had no concurrency group. So when two pushes tomainbuilt at once, whichever build finished last setlatest, even if it was the older commit. One run, for #189's merge, sat in "Build and push" for over an hour (publish runs usually take 6 to 7 minutes) while the run for #194's merge started after it and finished first. Had the older run finished,latestwould have gone back to #189's image.concurrency.group: ${{ github.workflow }}-${{ github.ref }}). Releases run under their tag's ref, so they never wait onmain.queue: maxkeeps every pending run (up to GitHub's 100), not just the newest one. Each commit onmainstill gets its ownshaimage, as before; nothing is cancelled.latestright. A new step, "Check whether main's head still builds this image", fetchesmainand tagslatestonly when the run's commit is an ancestor ofmain's head and no later commit changed the Docker build context. The build context is every tracked file except what.dockerignoredrops:e2e/,scripts/, top-level*.mdand.env.example. The step checks it withgit log --full-history <commit>..<head> -- <context>, using matching:(exclude)pathspecs.latestforward.latestalone. That includes a later commit that reverts the context to this commit's tree. The image would be built from the same files, but itsorg.opencontainers.image.revisionlabel would name the older commit.lateston the image before.COPY . .. If.dockerignorelater changes and the step isn't updated, the step only gets stricter (some extra builds); it never tags the wrong image.git logfails, the step treats it as a change and doesn't taglatest.fetch-depth: 0, about 100 commits)..gitis in.dockerignore, so the build context is unchanged.latest, as with{{is_default_branch}}before.The push trigger now covers the whole build context. It listed
src/**,server.ts,package.json,bun.lock, theDockerfileand this workflow. But the image also depends on.npmrc,patches/andtools/(copied beforebun install), and onpublic/,vite.config.tsandtsconfig.json(used byvite build). A commit that touched only those published nothing. The trigger is nowpaths-ignorewith the same four entries the head check excludes, so a push runs unless it changes only files.dockerignoredrops. GitHub's*doesn't cross/, so'*.md'matches top-level Markdown only, as.dockerignore's*.mddoes. The cost is that a change to, say,ci.ymlor the ESLint config now publishes an image too.latestreaches the newest commit only once the queue drains (about 7 minutes per queued run), not as soon as the last build finishes.timeout-minutes: 30on the build job, about four times a normal run, stops a hung build from holding that queue for GitHub's default 6 hours.The 10 open Dependabot PRs can be closed once this merges. The five npm ones (#128, #129, #131, #132, #135) are already covered on
mainby #189 and #194, which moved those packages past the versions they propose.Change Type
Testing
This PR's CI runs on
actions/checkoutv7: the lint, typecheck, unit test and e2e jobs.Both workflow files parse as YAML, and the parsed
concurrency(queue: max),timeout-minutesand tag values are as intended.The head check, run with its exact script under
bash -eo pipefail(GitHub's default shell) in clones of a local bare remote whosemainwas set to each head. The one-file heads are single commits on top of ♿ fix: Pass Every Axe Scan on the Grants and Access Pages #203. B, C and D are a chain on top of ♿ fix: Pass Every Axe Scan on the Grants and Access Pages #203: B changesvite.config.ts, C reverts it (C's tree equals ♿ fix: Pass Every Axe Scan on the Grants and Access Pages #203's), and D changes onlyREADME.md.GITHUB_REFmain's headrefs/heads/mainlatest=truerefs/heads/mainsrc)latest=falserefs/heads/mainlatest=truerefs/heads/mainsrc)latest=falserefs/tags/v1.0.0latest=falserefs/heads/mainvite.config.tslatest=falserefs/heads/mainpublic/latest=falserefs/heads/mainpatches/latest=falserefs/heads/main.github/workflows/ci.ymllatest=falserefs/heads/mainsrc/notes.md(not top-level)latest=falserefs/heads/mainREADME.mdlatest=truerefs/heads/maine2e/live.tslatest=truerefs/heads/main.env.examplelatest=truerefs/heads/mainlatest=falserefs/heads/mainlatest=falserefs/heads/mainlatest=truerefs/heads/mainlatest=truerefs/heads/mainlatest=falserefs/heads/mainmainlatest=falseThe publish workflow only runs on
main, on releases and by hand, so it first runs on the new docker actions when this merges. I'll watch that run, and confirm it pusheslatestand the commit'sshatag to GHCR.Checklist