ci: rebuild the production image nightly #81

Merged

claudiomaradonna merged 1 commit from ci/nightly-image-build into master 2026-10-24 21:58:05 +02:00

Conversation 0 Commits 1 Files changed 4 +58 -3

motoko commented 2026-10-24 21:46:29 +02:00

Collaborator

Copy link

Why

The production image is rebuilt only when someone runs make prod_build by hand. Until then the container that Shepherd deploys keeps running whatever base image packages were current at the last build, security fixes included.

What changed

• A Forgejo Actions workflow runs make prod_build on each push to master, every night at 04:30 Europe/Rome, and on demand. It builds only for master, so a manual run from another branch cannot publish latest.
• prod_build pulls the base images on every build, for local builds too.
• docs/deploy.md describes the automated build and what it needs: Actions enabled, a runner with the docker label whose jobs reach a Docker daemon, the variable REGISTRY_USER and the secret REGISTRY_TOKEN, a token limited to write:package.

Verification

• The workflow YAML parses, and make -n prod_build shows --pull.
• Against the Forgejo v15.0.10 source: the schedule's timezone: is read, and a scheduled run's ref is the short branch name, which is why the job is gated on ref_name.
• Not run: the workflow itself, since no runner exists yet, and make build, since the change touches nothing under src/.

Risks and follow-ups

• The first run proves the runner set-up.
• The runner's docker-in-docker is shared between jobs. The risk is accepted because only accounts on this instance can trigger runs, and the workflow has no pull_request trigger.
• Existing text left as it is: the QEMU lines in the docs, which a build on this Dockerfile does not need, and the manual "Deploy on the server" step that Shepherd now covers.

## Why The production image is rebuilt only when someone runs `make prod_build` by hand. Until then the container that Shepherd deploys keeps running whatever base image packages were current at the last build, security fixes included. ## What changed - A Forgejo Actions workflow runs `make prod_build` on each push to `master`, every night at 04:30 Europe/Rome, and on demand. It builds only for `master`, so a manual run from another branch cannot publish `latest`. - `prod_build` pulls the base images on every build, for local builds too. - `docs/deploy.md` describes the automated build and what it needs: Actions enabled, a runner with the `docker` label whose jobs reach a Docker daemon, the variable `REGISTRY_USER` and the secret `REGISTRY_TOKEN`, a token limited to `write:package`. ## Verification - The workflow YAML parses, and `make -n prod_build` shows `--pull`. - Against the Forgejo v15.0.10 source: the schedule's `timezone:` is read, and a scheduled run's ref is the short branch name, which is why the job is gated on `ref_name`. - Not run: the workflow itself, since no runner exists yet, and `make build`, since the change touches nothing under `src/`. ## Risks and follow-ups - The first run proves the runner set-up. - The runner's docker-in-docker is shared between jobs. The risk is accepted because only accounts on this instance can trigger runs, and the workflow has no `pull_request` trigger. - Existing text left as it is: the QEMU lines in the docs, which a build on this Dockerfile does not need, and the manual "Deploy on the server" step that Shepherd now covers.

motoko added 1 commit 2026-10-24 21:46:32 +02:00

ci: rebuild the production image nightly ... 0de32c7085

Forgejo Actions now runs make prod_build on each push to master,
every night at 04:30 Europe/Rome and on demand, so the published
image picks up fixes in its base images without a manual build. The
job runs only for master, so a manual run on another branch cannot
publish it. prod_build pulls the base images on every build, and the
deploy docs describe the runner, variable and secret the workflow
needs.

Claude-Session: https://claude.ai/code/session_01PLShz6T6RVgYf2sawW4zao

claudiomaradonna merged commit 0de32c7085 into master 2026-10-24 21:58:05 +02:00

claudiomaradonna deleted branch ci/nightly-image-build 2026-10-24 21:58:11 +02:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

unitoo/website!81

No description provided.