The bundle and docker-image build/dedup checks used different cache
keys: the bundle was cached by ref name (`penpot-<gh_ref>.zip`) while
the docker image marker was cached by commit sha
(`markers/images-sha-<sha>`). A tag built from a commit already
promoted under another ref (e.g. `develop`) would rebuild the bundle
unnecessarily, while `build-docker`'s `promote` job silently inherited
the skip from `build` and never created that ref's branch tags
(`backend:<gh_ref>`, `frontend:<gh_ref>`, ...), even though the
underlying sha-tagged images already existed.
- Key the bundle S3 object by commit sha (`penpot-sha-<sha>.zip`)
instead of by ref name, matching the docker marker's semantics.
- Drop the S3 metadata round-trip for `bundle_version` in
build-docker.yml; compute it locally with `git describe`, same as
build-bundle.yml (requires fetch-depth: 0 on that checkout).
- Split `promote` into two mutually-exclusive jobs, `promote` (needs
`build` to succeed) and `retag` (needs only `prepare`, runs when
`prepare.outputs.exists == 'true'`), each moving the `:<gh_ref>`
branch tags to the current sha. This replaces relying on `build`'s
skip/success state with two explicit conditions, so the tags always
get moved regardless of which path built the images.
Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
Move build-docker and build-docker-devenv jobs from penpot-extended-runner
to penpot-standar-runner, point tests-exporter at the canonical
penpot-extended-runner label instead of the stale penpot-runner-02 alias,
and switch build-tag/release notify jobs from ubuntu-24.04 to ubuntu-latest.
Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
Add a `force` input to Bundles Builder, Docker Images Builder and the
admin-console dispatcher to bypass the existing S3/registry skip
checks and overwrite artifacts unconditionally. Propagate it through
_DEVELOP, _STAGING and _TAG (defaulting to false on non-dispatch
triggers, since schedule/push events carry no inputs).
Add a new _ADHOC workflow to build the full image set (bundle + all
docker images + nitrate admin-console) from an arbitrary ref pair,
for one-off builds of feature branches like test-bameda.
Enrich the build/promote step summaries with the built version
(`git describe --tags --always`), a link to the commit and the build
timestamp. Add run-name to all `_`-prefixed workflows so the target
ref (and, where reliable, the commit sha) is visible directly in the
Actions run list.
Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
Replaces the content-hash build key (bundle_version + docker/images tree hash) used to tag and dedupe the backend/frontend/exporter/storybook/mcp image set with sha-<commit>, matching the scheme already used by admin-console, licenses-manager and payments across the org. The check→build→promote pattern with the S3 marker is unchanged; only the key used for the marker, the immutable tag and the local bundle cache filename moves from the composite build key to the git commit sha (the bundle cache now keys on bundle_version alone, which is what it actually caches). devenv is intentionally left out of this pass, it has no versioned tagging today.
Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
Move Dockerfile.frontend, .backend, .exporter, .mcp and .storybook
under docker/images/ from ubuntu:26.04 / nginx-unprivileged / a
manual Node tarball install to Docker Hardened Images (Debian 13,
or Alpine for storybook). storybook and mcp get a true non-dev
runtime; frontend, backend and exporter keep the -dev tag as their
final image, since each needs a shell and/or package manager at
container runtime (nginx templating, fontforge/python3, and a
headless-browser stack, respectively).
The notify steps referenced mattermost/action-mattermost-notify@master, a
mutable branch that runs in CI with access to the MATTERMOST_WEBHOOK_URL
secret. Pinning to the immutable commit of the latest release (v2.1.0,
ae31bb6) keeps the exact reviewed code from executing, per GitHub third-party
action hardening guidance, while staying easy to bump.
