This runner builds on the host's Docker daemon — the same daemon the live
container runs on — so retagging :latest IS a deployment. Watchtower compares
the running container's image against :latest, sees they differ, and recreates
the container from whatever was just built locally. Gating only the push was
never enough; the build itself was the deploy.
The worse failure is quieter. Reassigning :latest leaves the running
container's old image untagged, and once that image is pruned Watchtower can no
longer read it to compare against:
Failed to retrieve container image info: No such image: sha256:…
Unable to update container: no available image info.
bennett-portfolio hit exactly that. It sat on a four-day-old build, failing to
update 720 times in twenty-four hours, reporting healthy the whole time, and had
to be recreated by hand. This repo has the same workflow and the same exposure —
it simply has not been unlucky yet.
A PR now builds pr-<number>, which nothing watches. Trivy scans whatever was
built either way, so a bad Dockerfile or a new CVE still blocks the merge, and
the push step is unchanged — still main-only.
Run the workflow on pull_request too, so tests + build + Trivy must pass before main can be
merged (branch protection requires this check). Push the image only on a real push to main —
never from a PR. Also standardises the workflow across all apps (three had drifted).
The image build runs 'mvn -DskipTests' and the workflow was only build -> Trivy -> push, so
no app test has ever run in CI — only Trivy gated a merge. The platform contract tests added
in 0.1.9 were not running either, which defeated their purpose.
They cannot run inside 'docker build' — Testcontainers needs a Docker daemon and a build has
none. Maven runs as a sibling container instead, mounting the workspace volume act_runner
gave this job (matched on GITHUB_WORKSPACE, since it is mounted at the full repo path rather
than at /workspace) and sharing the host network so published test ports resolve as localhost.
Verified on itsthevine before rolling out here: 33 tests ran, and a deliberately failing test
failed the run at the Test step with the registry digest unchanged — no image published.
Testcontainers 2.0 renamed the postgresql/junit-jupiter module artifacts, so the major
bump can't even be resolved — disable it rather than let a bot PR reopen it each run.
- parent/BOM now point at the immutable 0.1.0 release instead of a SNAPSHOT
- declare the Gitea Maven registry so Renovate can discover new platform versions
- renovate.json: group platform bumps into one automerged PR
- CI: drop --no-cache (releases are immutable, so caching is safe again) and add
workflow_dispatch so rebuild-all-apps.sh can force an urgent rebuild
- Admin API: list/edit posts (incl. drafts, raw markdown), moderate comments, subscribers,
author bio/links, and presigned image upload to MinIO (bucket is public-read for covers).
- Admin UI at /admin: post editor with cover-image upload, comment moderation, subscriber list.
- Public security switched to authenticated-paths so static assets (/images, /data) stay public.
Restores the real backend lost with Supabase (posts, authors, comments, subscriptions, admin) in
Postgres, seeds the existing markdown posts, and rebuilds the site as a Vite/React SPA served by
Spring — keeping the original styling (serif + tan accent) and content.
austin