luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci(16-06): split publish build and push into separate steps

Browse Source 
- Separate 'Build and push' into 'Build production image' (build only) and 'Push image' steps
- Creates insertion point between build and push for hygiene assertions (Task 2)
- Preserves --target production, Dockerfile path, both tags, and root context
- WR-04 immutable-tag-first push ordering preserved in push step
This commit is contained in:
Lucas Berger
2026-06-13 08:26:32 -04:00
parent 6e5086ce5e
commit bc00f3e815
1 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/publish.yml
+6 -2
View File
@@ -76,7 +76,7 @@ jobs:
# Build from REPO ROOT (T-08-10): the Dockerfile copies the pnpm workspace manifest + # Build from REPO ROOT (T-08-10): the Dockerfile copies the pnpm workspace manifest +
# lockfile from the root context; building from apps/api/ would fail to find them. # lockfile from the root context; building from apps/api/ would fail to find them.
- name: Build and push - name: Build production image
run: | run: |
set -euo pipefail set -euo pipefail
docker build --target production \ docker build --target production \
@@ -84,11 +84,15 @@ jobs:
-t ${{ steps.tags.outputs.latest }} \ -t ${{ steps.tags.outputs.latest }} \
-t ${{ steps.tags.outputs.sha_tag }} \ -t ${{ steps.tags.outputs.sha_tag }} \
. .
# Push the IMMUTABLE :<milestone>-<sha> tag FIRST. set -euo pipefail stops on # Push the IMMUTABLE :<milestone>-<sha> tag FIRST. set -euo pipefail stops on
# the first failed push, so :latest is only moved after the immutable, # the first failed push, so :latest is only moved after the immutable,
# rollback-traceable tag has landed — a failed second push can never leave # rollback-traceable tag has landed — a failed second push can never leave
# :latest advanced without a corresponding rollback tag (WR-04). # :latest advanced without a corresponding rollback tag (WR-04).
docker push ${{ steps.tags.outputs.sha_tag }} # immutable first - name: Push image
run: |
set -euo pipefail
docker push ${{ steps.tags.outputs.sha_tag }} # immutable first (WR-04)
docker push ${{ steps.tags.outputs.latest }} # move pointer only after immutable lands docker push ${{ steps.tags.outputs.latest }} # move pointer only after immutable lands
# Always drop the stored credential from the runner after push (defence in depth). # Always drop the stored credential from the runner after push (defence in depth).