From 2e42972f44354b82b44842b9c6ebf0174cce40a2 Mon Sep 17 00:00:00 2001 From: cproudlock Date: Wed, 2 Sep 2026 14:16:24 -0400 Subject: [PATCH] Map the image channels to how this repo ships, and disarm auto-publish The channel work assumed the branch model it was written against: upstream, main is a release branch and dev-be is the trunk. Neither holds here. main IS our trunk - 212 commits past v0.11.3 - and a release is a tag (ADR-007). dev-be does not exist at all, so the edge half would never have fired and the launchers would have cloned a missing branch. Taken literally it would have published our unreleased trunk to every site as :stable, which is the opposite of what the word promises to someone who has no way to check. Remapped throughout: tag v* -> :stable the thing that was actually released main -> :edge the trunk, DEV badge lit publish-images.yml keys the channel on github.ref_type = tag rather than on a branch name, so the mapping cannot silently drift back. Start-ShopDBDev.ps1, dev-bootstrap.ps1 and build-channel-installer.ps1 resolve stable to the newest v* tag via git ls-remote --sort=-v:refname, warning and falling back to main if a repo has no tags yet. DEV-BUILD-TEST.md follows. The push: trigger is commented out. Automatic publishing waits on someone confirming the GHCR package exists under this owner and deciding who may pull it; workflow_dispatch works meanwhile. Turning it on is one uncomment. All three scripts parse clean under pwsh, and the tag-selection expression was run against this repo rather than eyeballed. Per the standing rule, the runtime paths still want a pass in the win11 VM before anyone leans on them. Scope: product --- .github/workflows/publish-images.yml | 36 ++++++++++++++++++---------- docs/DEV-BUILD-TEST.md | 4 ++-- scripts/Start-ShopDBDev.ps1 | 15 ++++++++++-- scripts/build-channel-installer.ps1 | 8 +++---- scripts/dev-bootstrap.ps1 | 8 +++---- 5 files changed, 47 insertions(+), 24 deletions(-) diff --git a/.github/workflows/publish-images.yml b/.github/workflows/publish-images.yml index 16bea88a..a1d4fb64 100644 --- a/.github/workflows/publish-images.yml +++ b/.github/workflows/publish-images.yml @@ -8,22 +8,31 @@ # A single image pull is one resumable HTTPS stream, far more robust through # the proxy than hundreds of npm requests. # -# Channels map to branches: -# main -> ghcr.io//shopdb-flask:stable (badge off) -# dev-be -> ghcr.io//shopdb-flask:edge (SHOPDB_ENV_LABEL=DEV badge) +# Channels are mapped to how THIS repo actually ships, which is not how the +# branch this came from ships. Upstream, main is a release branch and dev-be is +# the trunk. Here main IS the trunk - it runs hundreds of commits past the last +# release - and releases are tags (ADR-007). Publishing main as :stable would +# put unreleased work behind a word that promises the opposite, to sites that +# have no way to know: # -# Each push to those branches rebuilds and republishes its channel tag, so -# `edge` stays genuinely bleeding edge. The image is also tagged with the short -# commit SHA for traceability and rollback. +# tag v* -> ghcr.io//shopdb-flask:stable (badge off) the release +# main -> ghcr.io//shopdb-flask:edge (DEV badge) the trunk +# +# The image also carries a short-SHA tag for traceability and rollback. +# +# Automatic publishing is OFF until someone confirms the GHCR package exists +# under this owner and decides who may pull it. Re-enable by uncommenting the +# push: block below; workflow_dispatch works meanwhile. name: publish-images on: - push: - branches: - - main - - dev-be - # Allow a manual rebuild/publish of the current branch's channel image. + # push: + # tags: + # - 'v*' + # branches: + # - main + # Manual rebuild/publish of the current ref's channel image. workflow_dispatch: # One in-flight publish per branch; a newer push supersedes an older one. @@ -48,7 +57,10 @@ jobs: run: | owner="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" image="ghcr.io/${owner}/shopdb-flask" - if [ "${{ github.ref_name }}" = "main" ]; then + # A tag is a release, anything else is the trunk. Deliberately not + # keyed on the branch name: a release here is a tag, so keying on + # "main" would label the trunk stable. + if [ "${{ github.ref_type }}" = "tag" ]; then channel="stable" else channel="edge" diff --git a/docs/DEV-BUILD-TEST.md b/docs/DEV-BUILD-TEST.md index ac357d1b..7e8a10f2 100644 --- a/docs/DEV-BUILD-TEST.md +++ b/docs/DEV-BUILD-TEST.md @@ -22,14 +22,14 @@ so it works on a box that has only Docker installed. You will be sent `Start-ShopDBDev.ps1` directly. Save it anywhere (for example your Downloads folder) and open PowerShell in that folder. -## Bleeding edge (dev-be) +## Bleeding edge (main, the trunk) powershell -ExecutionPolicy Bypass -File .\Start-ShopDBDev.ps1 -Channel edge Comes up at https://localhost:5011. Red DEV badge in the sidebar. Pulls the `edge` image. -## Stable (main) +## Stable (newest release tag) powershell -ExecutionPolicy Bypass -File .\Start-ShopDBDev.ps1 -Channel stable diff --git a/scripts/Start-ShopDBDev.ps1 b/scripts/Start-ShopDBDev.ps1 index bd0e8a48..d4deade9 100644 --- a/scripts/Start-ShopDBDev.ps1 +++ b/scripts/Start-ShopDBDev.ps1 @@ -19,7 +19,7 @@ GCM handles those. .PARAMETER Channel - 'stable' (main) or 'edge' (dev-be). Defaults to 'stable'. + 'stable' (the newest release tag) or 'edge' (main, the trunk). Defaults to 'stable'. .PARAMETER TargetDir Where to clone. Defaults to %USERPROFILE%\shopdb-dev, a separate working copy @@ -114,7 +114,18 @@ function Clear-InterruptedRun { # stored GitHub credential for github.com, so clone/fetch authenticate against # the private repo without anything sensitive touching this script or disk. $repoUrl = 'https://github.com/ge-aero/shopdb-flask.git' -$branch = if ($Channel -eq 'edge') { 'dev-be' } else { 'main' } +# Channels follow how this repo ships: a release is a TAG, the trunk is main. +# Upstream this read 'dev-be' for edge, which is that repo's trunk branch and +# does not exist here - the launcher would have cloned a missing branch. +$branch = 'main' +if ($Channel -ne 'edge') { + # Newest release tag, so 'stable' means a thing that was released rather + # than whatever the trunk happens to be today. + $tag = (git ls-remote --tags --refs --sort='-v:refname' $repoUrl 'v*' | + Select-Object -First 1) -replace '.*refs/tags/', '' + if ($tag) { $branch = $tag } + else { Write-Warning "No v* tag found; falling back to main for 'stable'." } +} $target = if ($TargetDir) { $TargetDir } else { Join-Path $env:USERPROFILE 'shopdb-dev' } Write-Host "ShopDB dev launcher" -ForegroundColor White diff --git a/scripts/build-channel-installer.ps1 b/scripts/build-channel-installer.ps1 index 6d85f1be..18fda7c1 100644 --- a/scripts/build-channel-installer.ps1 +++ b/scripts/build-channel-installer.ps1 @@ -6,7 +6,7 @@ Produces ONE self-contained installer package for the requested channel: stable -> built from 'main', no DEV badge (SHOPDB_ENV_LABEL empty). - edge -> built from 'dev-be', red DEV badge (SHOPDB_ENV_LABEL=DEV). + edge -> built from 'main' (the trunk), red DEV badge (SHOPDB_ENV_LABEL=DEV). This is the distributable counterpart to scripts/dev-bootstrap.ps1 (which stands a dev box up FROM the repo). Here the operator has no repo: the script @@ -28,14 +28,14 @@ by branch, image tag, and label - all data, not code. .PARAMETER Channel - 'stable' (main) or 'edge' (dev-be). Required. + 'stable' (the newest release tag) or 'edge' (main, the trunk). Required. .PARAMETER Version Image tag / bundle version. Defaults to a channel-prefixed date stamp so two channels built the same day never collide (e.g. 'stable-2024.06.01'). .PARAMETER Ref - Override the git ref to build. Defaults to 'main' for stable, 'dev-be' for + Override the git ref to build. Defaults to the newest v* tag for stable, 'main' for edge. Lets a release engineer cut an installer from a tag or fix branch. .PARAMETER MysqlImage @@ -85,7 +85,7 @@ $ErrorActionPreference = 'Stop' # channel means. $channels = @{ stable = @{ Ref = 'main'; EnvLabel = '' } - edge = @{ Ref = 'dev-be'; EnvLabel = 'DEV' } + edge = @{ Ref = 'main'; EnvLabel = 'DEV' } } function Assert-LastExit([string]$What) { diff --git a/scripts/dev-bootstrap.ps1 b/scripts/dev-bootstrap.ps1 index 6a95a098..a3c01e3c 100644 --- a/scripts/dev-bootstrap.ps1 +++ b/scripts/dev-bootstrap.ps1 @@ -12,7 +12,7 @@ passed, because the app itself runs entirely in the container. 2. Picks a channel: stable -> pulls the 'stable' image (built from main), no DEV badge. - edge -> pulls the 'edge' image (built from dev-be), red DEV badge. + edge -> pulls the 'edge' image (built from main), red DEV badge. The two channels use different compose project names, host ports, and named volumes, so they run side by side without colliding. 3. Generates a .env for the channel (dev-grade secrets, NOT for production) @@ -25,10 +25,10 @@ installer - see deploy/windows/installer/shopdb-install.ps1 for that. .PARAMETER Channel - 'stable' (main) or 'edge' (dev-be). Defaults to 'stable'. + 'stable' (the newest release tag) or 'edge' (main, the trunk). Defaults to 'stable'. .PARAMETER Ref - Override the git ref to build. Defaults to 'main' for stable, 'dev-be' for + Override the git ref to build. Defaults to the newest v* tag for stable, 'main' for edge. Retained for compatibility; the pull flow selects the image by channel tag, so this now only affects which branch the working tree is prepared on. @@ -74,7 +74,7 @@ $channels = @{ ImageTag = 'stable' } edge = @{ - Ref = 'dev-be' + Ref = 'main' Project = 'shopdb-edge' ApiPort = 5011 MysqlPort = 3316