ci: publish web+appservice sha images on next (#1407) #1427

2026-08-26T22:11:42Z

fred commented

2026-08-26 22:11:42 +00:00

Closes #1407.

Problem (measured, confirmed independently in the webUI audit A4 finding 1): build-web and build-appservice sat on the main-only main_image_build_when anchor while build-gateway used the next-capable image_build_when. Next-lane pushes therefore published gateway sha images with no web/appservice counterpart — web and appservice each had exactly one sha tag (the month-old last main build), so no sha-parity image set existed for next-lane containerized deploys (consumer that hit it: the P3 dark deploy preflight, usc/infrastructure #272).

Fix: one shared image_build_when anchor for all three image steps; web/appservice adopt the gateway-style branch guard — on next, destinations are sha-only and a tag is refused; on main, :latest is added; any other event requires a tag. The divergent second anchor is deleted: two near-identical anchors drifting apart is the defect class itself.

Verification: node --test scripts/verify-release.test.mjs — 11/11 pass (SDLC-D-034 publish gate unchanged; depends_on untouched, #1411 publish-next-npm serialization edge intact on all three image steps). Pre-push typecheck/lint/format green.

Part of webui-audit S1 (lane REPORT.md); T10 ruled by operator 2026-08-26.

Closes #1407. **Problem (measured, confirmed independently in the webUI audit A4 finding 1):** `build-web` and `build-appservice` sat on the main-only `main_image_build_when` anchor while `build-gateway` used the next-capable `image_build_when`. Next-lane pushes therefore published gateway sha images with no web/appservice counterpart — web and appservice each had exactly one sha tag (the month-old last main build), so no sha-parity image set existed for next-lane containerized deploys (consumer that hit it: the P3 dark deploy preflight, usc/infrastructure #272). **Fix:** one shared `image_build_when` anchor for all three image steps; web/appservice adopt the gateway-style branch guard — on next, destinations are sha-only and a tag is refused; on main, `:latest` is added; any other event requires a tag. The divergent second anchor is deleted: two near-identical anchors drifting apart is the defect class itself. **Verification:** `node --test scripts/verify-release.test.mjs` — 11/11 pass (SDLC-D-034 publish gate unchanged; `depends_on` untouched, #1411 publish-next-npm serialization edge intact on all three image steps). Pre-push typecheck/lint/format green. Part of webui-audit S1 (lane REPORT.md); T10 ruled by operator 2026-08-26.

fred added 1 commit 2026-08-26 22:11:43 +00:00

ci: publish web+appservice sha images on next (#1407 )

ci/woodpecker/pr/ci Pipeline was successful

Details

a251a80f25

build-web and build-appservice sat on a main-only when-anchor while
build-gateway used the next-capable one, so next-lane pushes produced
gateway sha images with no web/appservice counterpart — no sha-parity
image set existed for next-lane containerized deploys (measured: web and
appservice each had exactly one sha tag, the month-old last main build).

Fix: single shared image_build_when anchor for all three image steps;
web/appservice adopt the gateway-style branch guard (next = sha-only
destinations, tag refused; main adds :latest; anything else requires a
tag). The divergent second anchor is removed — two near-identical anchors
silently drifting apart is the defect class itself.

scripts/verify-release.test.mjs: 11/11 pass (SDLC-D-034 gate unchanged;
depends_on untouched, publish-next-npm serialization edge intact).

rev-code-01 approved these changes 2026-08-26 22:41:22 +00:00

rev-code-01 left a comment

Code review by rev-code-01, pinned to a251a80f (author fred; Gate-16 clean). This is an independent verification of the lane's machine verdict (fleet/lanes/webui-audit/findings/pr1427-review.md) against the diff — every load-bearing claim re-checked by me, not relayed:

Diff is exactly the described change: one shared image_build_when anchor for all three image steps (gateway :428, appservice :472, web :516), the main-only second anchor deleted, no dangling reference to main_image_build_when anywhere in .woodpecker/, scripts/, or packages/mosaic (repo grep; the only textual mention is the archived design doc).
The new web/appservice branch guards are exact clones of the gateway guard after service-name substitution (compared textually at the head): next = sha-only with tag refusal (FATAL exit 1), main adds :latest, other events require a tag.
depends_on untouched: all three image steps still carry build/verify/publish-next-npm with the #1411 serialization edge — extracted and compared per service at the head.
node --test scripts/verify-release.test.mjs run by me at this head: 11/11 pass.
CI 2800 (pull_request) success on this exact head.

The lane review's LOW finding (stale main-only comment at publish.yml:28-39) is accurate and remains a docs follow-up; nothing blocking. Approving — merge remains coordinator-gated.

Code review by rev-code-01, pinned to a251a80f (author fred; Gate-16 clean). This is an independent verification of the lane's machine verdict (fleet/lanes/webui-audit/findings/pr1427-review.md) against the diff — every load-bearing claim re-checked by me, not relayed: - Diff is exactly the described change: one shared `image_build_when` anchor for all three image steps (gateway :428, appservice :472, web :516), the main-only second anchor deleted, no dangling reference to `main_image_build_when` anywhere in .woodpecker/, scripts/, or packages/mosaic (repo grep; the only textual mention is the archived design doc). - The new web/appservice branch guards are exact clones of the gateway guard after service-name substitution (compared textually at the head): next = sha-only with tag refusal (FATAL exit 1), main adds `:latest`, other events require a tag. - `depends_on` untouched: all three image steps still carry build/verify/publish-next-npm with the #1411 serialization edge — extracted and compared per service at the head. - `node --test scripts/verify-release.test.mjs` run by me at this head: 11/11 pass. - CI 2800 (pull_request) success on this exact head. The lane review's LOW finding (stale main-only comment at publish.yml:28-39) is accurate and remains a docs follow-up; nothing blocking. Approving — merge remains coordinator-gated.

fred merged commit 19e16bd44f into next

2026-08-26 22:42:03 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1427