fix(ci): gate prod image push to main/tags; close CI coverage gaps #199
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/pms-189-ci-release-pipeline-drift"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Restrict production-image publishing to main and version tags, run the full Rust integration suite in CI, align the CI database to the dev stack, and clean up release/compose pipeline drift.
build-oci-image.yml: drop the "**" branch wildcard from the push trigger and add an
if: github.ref == main || startsWith(github.ref, refs/tags/v)gate on the job, so feature-branch pushes and feature-branch workflow_dispatch runs no longer rebuild and overwrite the :latest (and version) production image.check.yml: replace the hand-maintained
--test Xallowlist (which silently dropped 13 of 22 integration suites) withcargo test --tests, keeping the--test-threads=4PoolTimedOut reliability cap. Align the CI Postgres service topostgres:18.2-alpine3.23to match the dev stack. Remove theSQLX_OFFLINEenv var and its misleading comment: the project uses only dynamicsqlx::query(...)(zero compile-timequery!macros) and ships no.sqlx/cache, so the var was a no-op.claude-fix.yml: switch the
actions/checkoutandactions/setup-noderefs from github.com tocode.forgejo.org, matching every other workflow.create-release.yml: use the shared
${{ vars.RUNS_ON_OPENSUSE_BASE_LATEST }}runner variable instead of a hardcoded runner label.justfile: bump the release version with a targeted
str replaceon theversion = "..."line instead of round-tripping the whole Cargo.toml throughto toml, which stripped all comments and PMS docs on every release. Replace bothsave --forcecalls with a tempfile + externalmv(Cargo.toml) and a plainsave --appendto the empty mktemp body file, per the repo no-force safety policy.compose.dev.yml: pin infisical to
v0.161.0(was the only unpinned:latestimage) and addprofiles: ["infisical"]to valkey so it no longer starts when the infisical profile is not selected.The three WIP "Build on every push" debug commits (
82b3044,3d2b51a,0c9a066) are already absent from main; gating the push job removes the remaining debug build-on-every-push behavior they introduced.#PMS-189
Restrict production-image publishing to main and version tags, run the full Rust integration suite in CI, align the CI database to the dev stack, and clean up release/compose pipeline drift. build-oci-image.yml: drop the "**" branch wildcard from the push trigger and add an `if: github.ref == main || startsWith(github.ref, refs/tags/v)` gate on the job, so feature-branch pushes and feature-branch workflow_dispatch runs no longer rebuild and overwrite the :latest (and version) production image. check.yml: replace the hand-maintained `--test X` allowlist (which silently dropped 13 of 22 integration suites) with `cargo test --tests`, keeping the `--test-threads=4` PoolTimedOut reliability cap. Align the CI Postgres service to `postgres:18.2-alpine3.23` to match the dev stack. Remove the `SQLX_OFFLINE` env var and its misleading comment: the project uses only dynamic `sqlx::query(...)` (zero compile-time `query!` macros) and ships no `.sqlx/` cache, so the var was a no-op. claude-fix.yml: switch the `actions/checkout` and `actions/setup-node` refs from github.com to `code.forgejo.org`, matching every other workflow. create-release.yml: use the shared `${{ vars.RUNS_ON_OPENSUSE_BASE_LATEST }}` runner variable instead of a hardcoded runner label. justfile: bump the release version with a targeted `str replace` on the `version = "..."` line instead of round-tripping the whole Cargo.toml through `to toml`, which stripped all comments and PMS docs on every release. Replace both `save --force` calls with a tempfile + external `mv` (Cargo.toml) and a plain `save --append` to the empty mktemp body file, per the repo no-force safety policy. compose.dev.yml: pin infisical to `v0.161.0` (was the only unpinned `:latest` image) and add `profiles: ["infisical"]` to valkey so it no longer starts when the infisical profile is not selected. The three WIP "Build on every push" debug commits (82b3044,3d2b51a,0c9a066) are already absent from main; gating the push job removes the remaining debug build-on-every-push behavior they introduced. #PMS-189