From 4f8a7f739d639d6f946a12693df0d84aba7eb7ab Mon Sep 17 00:00:00 2001 From: Danny Avila Date: Wed, 28 Oct 2026 06:10:49 -0400 Subject: [PATCH 1/4] =?UTF-8?q?=E2=AC=86=EF=B8=8F=20chore:=20Move=20the=20?= =?UTF-8?q?Workflows=20to=20the=20Current=20Major=20Actions=20and=20Publis?= =?UTF-8?q?h=20Images=20in=20Push=20Order?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both workflows now use the current major of every action they call: actions/checkout v7 (CI was on v6, the publish workflow on v4), docker/setup-qemu-action v4, docker/setup-buildx-action v4, docker/login-action v4, docker/metadata-action v6 and docker/build-push-action v7. Each docker major moves the action to the Node 24 runtime, which GitHub-hosted runners already provide, and drops inputs, outputs and env vars this workflow doesn't use. This covers the five open Dependabot bumps and login-action v4, which Dependabot didn't propose. The publish workflow had no concurrency group, so two pushes to main built at the same time and whichever finished last tagged `latest`. Runs on the same ref now queue behind each other, so `latest` always ends on the newest commit, and a 30 minute job timeout keeps a hung build (one sat in "Build and push" for over an hour after the click-ui upgrade merged, against a usual 6 to 7 minutes) from holding that queue for GitHub's default 6 hours. --- .github/workflows/ci.yml | 6 +++--- .github/workflows/docker-publish.yml | 16 ++++++++++------ 2 files changed, 13 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1d3c9471..2c203cf8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,7 +16,7 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: oven-sh/setup-bun@v2 @@ -30,7 +30,7 @@ jobs: name: Type Check runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: oven-sh/setup-bun@v2 @@ -44,7 +44,7 @@ jobs: name: Unit Tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: oven-sh/setup-bun@v2 diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 42d88f81..bd2a1971 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -15,25 +15,29 @@ on: - 'Dockerfile' - '.github/workflows/docker-publish.yml' +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + jobs: build: runs-on: ubuntu-latest + timeout-minutes: 30 permissions: contents: read packages: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Log in to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} @@ -41,7 +45,7 @@ jobs: - name: Docker metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v6 with: images: ghcr.io/librechat-ai/librechat-admin-panel tags: | @@ -52,7 +56,7 @@ jobs: type=sha,format=long,prefix=,enable={{is_default_branch}} - name: Build and push - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: . file: Dockerfile From 7b72326274d2ff73b4961130af29c1d6fadee158 Mon Sep 17 00:00:00 2001 From: Danny Avila Date: Wed, 28 Oct 2026 06:18:53 -0400 Subject: [PATCH 2/4] =?UTF-8?q?=F0=9F=9A=A6=20fix:=20Keep=20Every=20Pendin?= =?UTF-8?q?g=20Publish=20Run=20and=20Tag=20latest=20Only=20When=20Main's?= =?UTF-8?q?=20Head=20Builds=20the=20Same=20Image?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/docker-publish.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index bd2a1971..7038a9f9 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -17,6 +17,7 @@ on: concurrency: group: ${{ github.workflow }}-${{ github.ref }} + queue: max jobs: build: @@ -43,6 +44,13 @@ jobs: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} + - name: Check whether main's head still builds this image + id: head + run: | + git fetch --quiet --depth=1 origin main + if [ "$GITHUB_REF" = refs/heads/main ] && git diff --quiet "$GITHUB_SHA" FETCH_HEAD -- src server.ts package.json bun.lock Dockerfile .github/workflows/docker-publish.yml; then latest=true; else latest=false; fi + echo "latest=$latest" >> "$GITHUB_OUTPUT" + - name: Docker metadata id: meta uses: docker/metadata-action@v6 @@ -52,7 +60,7 @@ jobs: type=semver,pattern={{version}} type=semver,pattern={{major}}.{{minor}} type=semver,pattern={{major}} - type=raw,value=latest,enable={{is_default_branch}} + type=raw,value=latest,enable=${{ steps.head.outputs.latest }} type=sha,format=long,prefix=,enable={{is_default_branch}} - name: Build and push From 78e572223178115437ed4d94b5b25cb6e56da439 Mon Sep 17 00:00:00 2001 From: Danny Avila Date: Wed, 28 Oct 2026 06:25:49 -0400 Subject: [PATCH 3/4] =?UTF-8?q?=F0=9F=93=A6=20fix:=20Publish=20on=20Any=20?= =?UTF-8?q?Docker=20Build=20Input=20and=20Compare=20the=20Whole=20Build=20?= =?UTF-8?q?Context=20Before=20Tagging=20latest?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/docker-publish.yml | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 7038a9f9..7822d70b 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -7,13 +7,11 @@ on: push: branches: - main - paths: - - 'src/**' - - 'server.ts' - - 'package.json' - - 'bun.lock' - - 'Dockerfile' - - '.github/workflows/docker-publish.yml' + paths-ignore: + - 'e2e/**' + - 'scripts/**' + - '*.md' + - '.env.example' concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -48,7 +46,7 @@ jobs: id: head run: | git fetch --quiet --depth=1 origin main - if [ "$GITHUB_REF" = refs/heads/main ] && git diff --quiet "$GITHUB_SHA" FETCH_HEAD -- src server.ts package.json bun.lock Dockerfile .github/workflows/docker-publish.yml; then latest=true; else latest=false; fi + if [ "$GITHUB_REF" = refs/heads/main ] && git diff --quiet "$GITHUB_SHA" FETCH_HEAD -- . ':(exclude)e2e' ':(exclude)scripts' ':(exclude,glob)*.md' ':(exclude).env.example'; then latest=true; else latest=false; fi echo "latest=$latest" >> "$GITHUB_OUTPUT" - name: Docker metadata From 9ecd46d3d662026f68ca83c5d020078ab666f3ee Mon Sep 17 00:00:00 2001 From: Danny Avila Date: Wed, 28 Oct 2026 06:32:38 -0400 Subject: [PATCH 4/4] =?UTF-8?q?=F0=9F=94=81=20fix:=20Tag=20latest=20Only?= =?UTF-8?q?=20When=20No=20Later=20Main=20Commit=20Changed=20the=20Build=20?= =?UTF-8?q?Context?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/docker-publish.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 7822d70b..f3916fd1 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -28,6 +28,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@v7 + with: + fetch-depth: 0 - name: Set up QEMU uses: docker/setup-qemu-action@v4 @@ -45,8 +47,13 @@ jobs: - name: Check whether main's head still builds this image id: head run: | - git fetch --quiet --depth=1 origin main - if [ "$GITHUB_REF" = refs/heads/main ] && git diff --quiet "$GITHUB_SHA" FETCH_HEAD -- . ':(exclude)e2e' ':(exclude)scripts' ':(exclude,glob)*.md' ':(exclude).env.example'; then latest=true; else latest=false; fi + git fetch --quiet origin main + context=(. ':(exclude)e2e' ':(exclude)scripts' ':(exclude,glob)*.md' ':(exclude).env.example') + latest=false + if [ "$GITHUB_REF" = refs/heads/main ] && git merge-base --is-ancestor "$GITHUB_SHA" FETCH_HEAD; then + changed=$(git log --full-history --format=%H "$GITHUB_SHA..FETCH_HEAD" -- "${context[@]}") || changed=unknown + if [ -z "$changed" ]; then latest=true; fi + fi echo "latest=$latest" >> "$GITHUB_OUTPUT" - name: Docker metadata