4 Commits

Include renames

Author	SHA1	Message	Date
austinandClaude Opus 5	5fd5bf940b	A pull request must not touch :latest ... This runner builds on the host's Docker daemon — the same daemon the live container runs on — so retagging :latest IS a deployment. Watchtower compares the running container's image against :latest, sees they differ, and recreates the container from whatever was just built locally. Gating only the push was never enough; the build itself was the deploy. The worse failure is quieter. Reassigning :latest leaves the running container's old image untagged, and once that image is pruned Watchtower can no longer read it to compare against: Failed to retrieve container image info: No such image: sha256:… Unable to update container: no available image info. bennett-portfolio hit exactly that. It sat on a four-day-old build, failing to update 720 times in twenty-four hours, reporting healthy the whole time, and had to be recreated by hand. This repo has the same workflow and the same exposure — it simply has not been unlucky yet. A PR now builds pr-<number>, which nothing watches. Trivy scans whatever was built either way, so a bad Dockerfile or a new CVE still blocks the merge, and the push step is unchanged — still main-only. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>	2026-07-27 09:53:23 -05:00
austinandClaude Opus 4.8	1be8dfd399	CI: gate the merge, not just the image ... Run the workflow on pull_request too, so tests + build + Trivy must pass before main can be merged (branch protection requires this check). Push the image only on a real push to main — never from a PR. Also standardises the workflow across all apps (three had drifted). Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01XXKjx7FNyRVAjU8dgB5KhN	2026-07-23 13:54:02 -05:00
austinandClaude Opus 4.8	d570e3579b	CI: actually run the tests, and let them gate the image ... The image build runs 'mvn -DskipTests' and the workflow was only build -> Trivy -> push, so no app test has ever run in CI — only Trivy gated a merge. The platform contract tests added in 0.1.9 were not running either, which defeated their purpose. They cannot run inside 'docker build' — Testcontainers needs a Docker daemon and a build has none. Maven runs as a sibling container instead, mounting the workspace volume act_runner gave this job (matched on GITHUB_WORKSPACE, since it is mounted at the full repo path rather than at /workspace) and sharing the host network so published test ports resolve as localhost. Verified on itsthevine before rolling out here: 33 tests ran, and a deliberately failing test failed the run at the Test step with the registry digest unchanged — no image published. Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01XXKjx7FNyRVAjU8dgB5KhN	2026-07-23 12:20:41 -05:00
austinandClaude Opus 4.8	8abca06a86	Rebuild on the Bennett platform: Spring Boot + Vite/React ... Same site — glass header, bento grid, hero drift, dark mode — with three things fixed on the way: - Tailwind and lucide came from CDNs on every page load, and the fonts from Google. All are now built in or self-hosted, so the site owes nothing to third parties at runtime. - The hero and bento photographs were hot-linked from Unsplash. They are re-encoded to webp and served from the MinIO bucket with a year-long cache. - The ministries and labs were hard-coded in the markup, so launching a ministry meant editing HTML. They now come from /api/network. The mobile menu button also opens something now; it did nothing before. Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01XXKjx7FNyRVAjU8dgB5KhN	2026-07-23 07:30:01 -05:00