rbrooks/Iris-WLED

Watch

Fork 0

CI: publish :main and :sha-* images on every merge to main (#64) #83

Merged

claude-bot merged 1 commit from feat/publish-main-image into main

2026-08-31 04:49:18 +00:00

claude-bot commented

2026-08-31 04:27:18 +00:00

Contributor

Closes the main body of #64. Prerequisite for #65 (deploying the dev server by pulling instead of building on the host).

What it does

After the health smoke test and E2E pass on a push to main, docker-e2e tags and pushes to git.rhoving.com/rbrooks/iris-wled as :main and :sha-<short>.

The image is retagged, not rebuilt. iris:e2e — the exact artifact the E2E just ran against — is what gets pushed, so there is no window in which the published image differs from the tested one. That also means no extra build cost; we removed a redundant build in #79 and are not adding one back.

Access

Gated on github.event_name == 'push' && github.ref == 'refs/heads/main'. Since #56 blocked direct pushes, that means merged PRs and nothing else.

The docker/login-action step sits behind the same guard, so pull-request runs never authenticate to the registry and PR builds are handed no credentials. Auth is the built-in Actions token, matching release.yml — no long-lived PAT.

What this PR cannot prove

The publish steps are skipped on pull_request, so CI passing here does not exercise them. That is inherent to the feature: the first real test is the main run immediately after this merges. I will verify the package actually appears in the registry then, and report back rather than assume.

Registry hygiene — deliberately not in this PR

:sha-* accumulates one tag per merge. The right place to bound that is a Forgejo owner-level package cleanup rule (Settings → Packages → Cleanup Rules, keep N versions), which is instance configuration, not repo code. Hacking a prune loop into the workflow would need package-delete permissions the Actions token may not carry, and a silently-failing cleanup step is worse than none.

That checkbox on #64 stays open with this as the recommendation.

Closes the main body of #64. Prerequisite for #65 (deploying the dev server by pulling instead of building on the host). ## What it does After the health smoke test and E2E pass on a push to `main`, `docker-e2e` tags and pushes to `git.rhoving.com/rbrooks/iris-wled` as `:main` and `:sha-<short>`. **The image is retagged, not rebuilt.** `iris:e2e` — the exact artifact the E2E just ran against — is what gets pushed, so there is no window in which the published image differs from the tested one. That also means no extra build cost; we removed a redundant build in #79 and are not adding one back. ## Access Gated on `github.event_name == 'push' && github.ref == 'refs/heads/main'`. Since #56 blocked direct pushes, that means **merged PRs and nothing else**. The `docker/login-action` step sits behind the *same* guard, so pull-request runs never authenticate to the registry and PR builds are handed no credentials. Auth is the built-in Actions token, matching `release.yml` — no long-lived PAT. ## What this PR cannot prove The publish steps are skipped on `pull_request`, so **CI passing here does not exercise them**. That is inherent to the feature: the first real test is the `main` run immediately after this merges. I will verify the package actually appears in the registry then, and report back rather than assume. ## Registry hygiene — deliberately not in this PR `:sha-*` accumulates one tag per merge. The right place to bound that is a **Forgejo owner-level package cleanup rule** (Settings → Packages → Cleanup Rules, keep N versions), which is instance configuration, not repo code. Hacking a prune loop into the workflow would need package-delete permissions the Actions token may not carry, and a silently-failing cleanup step is worse than none. That checkbox on #64 stays open with this as the recommendation.

claude-bot added 1 commit

2026-08-31 04:27:18 +00:00

CI: publish :main and :sha-<short> on every merge to main (#64 )

CI / Alembic migration check (pull_request) Successful in 1m10s

Details

CI / Python lint & type-check (pull_request) Successful in 1m36s

Details

CI / Frontend lint, test & build (pull_request) Successful in 1m48s

Details

CI / Python tests (pull_request) Successful in 2m32s

Details

CI / Docker build, health smoke & E2E (pull_request) Successful in 3m5s

Details

a0793d160e

After the health smoke test and E2E pass on a push to main, tag and push the
image to git.rhoving.com/rbrooks/iris-wled as :main and :sha-<short>.

The key property is that iris:e2e is RETAGGED, not rebuilt. The artifact that
lands on the registry is bit-for-bit the one the E2E just exercised, so there
is no window in which a published image differs from a tested one.

Gated on github.event_name == 'push' && github.ref == 'refs/heads/main'. Since
#56 blocked direct pushes, that means merged PRs and nothing else. Pull-request
runs never authenticate to the registry -- the login step is behind the same
guard, so PR builds get no credentials.

Auth uses the built-in Actions token via docker/login-action, matching
release.yml; no long-lived PAT.

Registry hygiene (the remaining checkbox on #64) is deliberately not done here:
:sha-* tags accumulate one per merge, and the right place to bound that is a
Forgejo owner-level package cleanup rule, which is instance configuration
rather than repo code. Noted on the issue rather than hacked into the workflow.

Enables #65.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

claude-bot changed title from ~~CI: publish :main and :sha-<short> on every merge to main (#64)~~ to CI: publish :main and :sha-* images on every merge to main (#64)

2026-08-31 04:27:37 +00:00

claude-bot merged commit b252b8f7f1 into main

2026-08-31 04:49:18 +00:00

claude-bot deleted branch feat/publish-main-image

2026-08-31 04:49:20 +00:00

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

rbrooks/Iris-WLED!83

No description provided.

Rows
Columns