Kristian WindandClaude Opus 5
0dbea0ea4b
Release / Build and publish image (push) Failing after 9m56s
"I have updated and restarted, but I cannot tell whether it worked" is not a question the panel could answer. The version was on the startup line and in the settings page, and nowhere you can reach from outside. /healthz carries it now. That is the one endpoint answering without a session, which makes it the only way to ask the question from a terminal or from the panel itself. The "listening" line repeats it too, because that is the line the Rune's done_regex matches and therefore the one sitting at the bottom of the console after a deploy. The update notice could also never have worked. It reads GitHub's releases/latest, and this repository had only tags — a tag is not a release, and that endpoint answers 404 for a repository without any. The release workflow creates one now, after the image is pushed so a release never announces a version that failed to build. VERDANDE_UPDATE_CHECK is a Rune variable, so it can be switched on without editing the container. Still off by default: it is an outbound request, and that is a choice to make rather than a default to inherit. Rune version 1 -> 2, so the panel offers the update. Note that the check still cannot see anything while the repository is private — releases/latest is 404 anonymously, exactly as the GHCR package was. Making the repo public, or teaching the check to carry a token, is a separate decision. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
67 lines
2.1 KiB
YAML
67 lines
2.1 KiB
YAML
name: Release
|
|
|
|
# Tagging is the release trigger: semver tags only, so a stray tag does not publish.
|
|
on:
|
|
push:
|
|
tags: ["v[0-9]+.[0-9]+.[0-9]+*"]
|
|
|
|
permissions:
|
|
# write rather than read: the job creates the GitHub Release the update notice
|
|
# reads. packages: write is for pushing the image.
|
|
contents: write
|
|
packages: write
|
|
|
|
jobs:
|
|
image:
|
|
name: Build and publish image
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: docker/setup-qemu-action@v3
|
|
- uses: docker/setup-buildx-action@v3
|
|
|
|
- uses: docker/login-action@v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- id: meta
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: ghcr.io/${{ github.repository }}
|
|
# v1.4.2 publishes 1.4.2, 1.4 and 1 — so a Rune pinned to :1 gets
|
|
# patches without ever crossing a major version.
|
|
tags: |
|
|
type=semver,pattern={{version}}
|
|
type=semver,pattern={{major}}.{{minor}}
|
|
type=semver,pattern={{major}}
|
|
type=raw,value=latest
|
|
|
|
# arm64 is not optional: a homelab is as likely to be a Raspberry Pi or an
|
|
# Apple silicon VM as it is to be an x86 box.
|
|
- uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
platforms: linux/amd64,linux/arm64
|
|
push: true
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
build-args: |
|
|
VERSION=${{ github.ref_name }}
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max
|
|
|
|
# A tag is not a release. The in-app update notice reads GitHub's
|
|
# releases/latest, which answers 404 for a repository that only has tags —
|
|
# so without this step the check can never find anything, however correctly
|
|
# it is switched on.
|
|
#
|
|
# Created after the image, so a release never announces a version that
|
|
# failed to build.
|
|
- uses: softprops/action-gh-release@v2
|
|
with:
|
|
generate_release_notes: true
|
|
make_latest: true
|