Archived
austinandClaude Opus 5
cf1254f901
Gating only the push was not enough. This runner builds on the host's Docker daemon — the same daemon the live container runs on — so `docker build -t …:latest` IS a deployment: Watchtower compares the running container's image against :latest, finds they differ, and recreates the container from the locally built image. That is not hypothetical. The PR builds for this branch deployed unmerged code to itsthevine.com several times this evening, and each time Watchtower's next pull of the older registry :latest reverted it, so the site flapped between the two. One of those deploys ran V4 against the production database, which is why the wedding-row correction had to be a new migration rather than an edit to V4. A PR now builds pr-<number>, which nothing watches; Trivy scans whatever was built; the push step is unchanged and still only runs off a PR. Nothing was lost — 40 products, 6 categories and 2 enquiries are all present, and the old image tolerates the newer schema (it warns that the schema is ahead of its migrations and carries on). The other five apps on the platform share this workflow and this daemon, so they have the same hole — including for Renovate's PRs, which build before they automerge. Not touched here; each needs the same three lines and its own green run. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>