5 Commits

Include renames

Author	SHA1	Message	Date
openhands	ecd8e5852c	perf(build): keep test suites out of the image and cache CI builds durably ... Three build-time improvements, all measured on this host. The build context no longer ships the test suites. `next build` type-checks the whole project, so `e2e/` and `integration/` in the context made the image build fail on a type error in test code and pulled @playwright/test, vitest, msw, testcontainers and drizzle-kit into the image. The CI runs those suites on the host. Type-check time in the build drops from 2.2s to 1.3s, and a contract test now fails if application code ever imports from those folders. The CI now exports the build cache to a directory outside the runner workspace: /var/cache/epicnext-cms-buildcache for the release and a separate map for branch preflights, so a branch can never feed the release cache. The workspace is wiped after every job and `docker builder prune` runs after every release, so the next build started with an empty cache and downloaded all 493 packages again (measured: reused 0, downloaded 493). With the durable export the frozen dependency layer is reused (measured: reused 493, downloaded 0) even after a full prune. A cache directory that is not writable only produces a warning; the release is never blocked. Investigated the remaining ~30s of Next.js build tracing: excluding the dev-only packages with `outputFileTracingExcludes` made it slower (35s vs 30s), because the traced output was already minimal (5 packages). The cost is Next's own page-config collection and file tracing over 329 routes, not the dependency set, so no configuration was kept.	2026-10-21 19:29:50 +02:00
openhands	fdb7af7ef5	fix(deploy): unblock every rebuild on BuildKit's host-network refusal ... Docker 29.1.3 ships BuildKit v0.26, which refuses to grant a build host networking unless each caller passes --allow=network.host. All three rebuild paths asked for it, and `docker compose build` has no flag to grant it, so a rebuild failed immediately with "additional privileges requested". The live container was never replaced, which is exactly the reported symptom: the site kept serving the previous release after a rebuild. Nothing in the build actually needs host networking. It uses the network only for apk, pnpm and next/font/google — all outbound internet, which the default bridge provides. Verified by building both the full runner image and the migrations stage with --no-cache after dropping the flag. Runtime `network_mode: host` stays: blue/green needs per-release host ports (3002/3003) and nginx reaches each slot over 127.0.0.1. The second gap is how a rebuild could still ship the wrong code. ci-deploy.sh stamped every image with HEAD's revision label, and verify-deployed-release.mjs only re-checks that same label, so a dirty working tree produced an image that claimed to be release $sha while containing uncommitted code. docker-update.sh already refused this; ci-deploy.sh now does too, before any build work.	2026-10-10 13:07:13 +02:00
openhands	faa37e7c58	fix(ci): restore preflight image cleanup marker and remove obsolete publish-container tests ... - Restore build_attempted=1 in ci-preflight.sh so the exit trap removes the temporary image tag - Remove publish-container.test.ts and its harness (publication workflow and script were removed in fff284aa) - Update deploy-workflow-contract and docker-build-contract tests to assert that publication has been removed	2026-09-15 11:29:20 +02:00
openhands	da90b90c97	fix(ci): guard browser context cleanup and export news e2e env before build	2026-09-15 11:21:08 +02:00
Simo	33a760ab6b	ci: verify isolated Docker news journeys before merging to main	2026-09-13 21:05:02 +02:00