ci(image): publish the runtime container image #90

Merged

David merged 2 commits from feat/publish-runtime-image into main

2026-08-02 17:31:42 +02:00

Claude-Run commented

2026-08-02 17:24:25 +02:00

Member

Add .forgejo/workflows/build-image.yml, which builds the runtime stage of oci-build/Dockerfile and pushes it to dev.a8n.run/pandoras-box/forgejo-cli, so the fj mcp serve HTTP web service can be deployed by pulling an image instead of building on the host. The publish train is decoupled by trigger exactly as build-binary.yml is: a push to main pushes the rolling latest tag, a v* tag push pushes the immutable vX.Y.Z tag (write-once, guarded by a docker manifest inspect probe that fails if the tag already exists), and a manual workflow_dispatch builds the image and prints every tag and push it would perform without mutating the registry. GIT_SHA (plus FORGEJO_TRAIN / COMMIT_DATE / BUILD_DATE) is passed through, and the build step asserts org.opencontainers.image.revision on the built image before anything is pushed. Single-arch linux/amd64, matching the only Linux binary CI publishes.

Update the docs the change makes false: CLAUDE.md claimed CI does not push an OCI image, the Dockerfile runtime comment said CI never pushes the image, and build-binary.yml said the runtime stage is not built anywhere. README.md and docs/deployment.md now describe the published tags and how to point compose at them; compose.mcp.yml deliberately keeps building from source as the local development path. A new check.yml guard fails if the retired claim reappears in any doc or comment.

#FJ-68

Add .forgejo/workflows/build-image.yml, which builds the `runtime` stage of oci-build/Dockerfile and pushes it to dev.a8n.run/pandoras-box/forgejo-cli, so the `fj mcp serve` HTTP web service can be deployed by pulling an image instead of building on the host. The publish train is decoupled by trigger exactly as build-binary.yml is: a push to main pushes the rolling `latest` tag, a `v*` tag push pushes the immutable `vX.Y.Z` tag (write-once, guarded by a `docker manifest inspect` probe that fails if the tag already exists), and a manual workflow_dispatch builds the image and prints every tag and push it would perform without mutating the registry. GIT_SHA (plus FORGEJO_TRAIN / COMMIT_DATE / BUILD_DATE) is passed through, and the build step asserts org.opencontainers.image.revision on the built image before anything is pushed. Single-arch linux/amd64, matching the only Linux binary CI publishes. Update the docs the change makes false: CLAUDE.md claimed CI does not push an OCI image, the Dockerfile runtime comment said CI never pushes the image, and build-binary.yml said the runtime stage is not built anywhere. README.md and docs/deployment.md now describe the published tags and how to point compose at them; compose.mcp.yml deliberately keeps building from source as the local development path. A new check.yml guard fails if the retired claim reappears in any doc or comment. #FJ-68

Claude-Run added 1 commit

2026-08-02 17:24:25 +02:00

ci(image): publish the runtime container image

Check / fmt + clippy + build + tests (pull_request) Successful in 30s

Details

f3c9a4599b

Add .forgejo/workflows/build-image.yml, which builds the `runtime` stage of oci-build/Dockerfile and pushes it to dev.a8n.run/pandoras-box/forgejo-cli, so the `fj mcp serve` HTTP web service can be deployed by pulling an image instead of building on the host. The publish train is decoupled by trigger exactly as build-binary.yml is: a push to main pushes the rolling `latest` tag, a `v*` tag push pushes the immutable `vX.Y.Z` tag (write-once, guarded by a `docker manifest inspect` probe that fails if the tag already exists), and a manual workflow_dispatch builds the image and prints every tag and push it would perform without mutating the registry. GIT_SHA (plus FORGEJO_TRAIN / COMMIT_DATE / BUILD_DATE) is passed through, and the build step asserts org.opencontainers.image.revision on the built image before anything is pushed. Single-arch linux/amd64, matching the only Linux binary CI publishes.

Update the docs the change makes false: CLAUDE.md claimed CI does not push an OCI image, the Dockerfile runtime comment said CI never pushes the image, and build-binary.yml said the runtime stage is not built anywhere. README.md and docs/deployment.md now describe the published tags and how to point compose at them; compose.mcp.yml deliberately keeps building from source as the local development path. A new check.yml guard fails if the retired claim reappears in any doc or comment.

#FJ-68

David added 1 commit

2026-08-02 17:28:01 +02:00

Merge main into feat/publish-runtime-image

Check / fmt + clippy + build + tests (pull_request) Successful in 1m3s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

373ec3dbc7

Resolves the docs/deployment.md conflict with FJ-69, which reflowed the file to ~120 columns, moved the state volume to /data, and swapped the key recipe to Nushell while this branch was open. The branch's own additions are kept and reflowed to match: the "Deploying from the published image" section (tag table, revision label, the image: swap for compose) and the published-image half of the Upgrades section.

The branch no longer carries the stale `openssl rand -base64 32` recipe or the `/app/data` path that its pre-merge copy of the file still had.

#FJ-68