From 9213e5a0de85238be051e8a956841c68ed7b1d93 Mon Sep 17 00:00:00 2001 From: lilleman Date: Sun, 2 Aug 2026 15:02:33 +0200 Subject: [PATCH] Make the CI web-image rebuild its own step; note the shared-workspace image-tag race --- AGENTS.md | 6 ++++-- ci.sh | 11 +++++++---- 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 27e305d..83b03c6 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -89,8 +89,10 @@ them. Revisit only if the stated reason stops holding. - **CI docker logins share the runner host's Docker config.** The act_runner is host-mode, so `docker login`/`logout` in the workflows mutate one shared `~/.docker/config.json`: concurrent jobs can race (one job's logout can 401 another's push — recover by re-running), - and tokens sit in that file between login and logout. Accepted for a single-maintainer - cadence; serialize with a workflow `concurrency` group if it ever bites. + and tokens sit in that file between login and logout. Same class: concurrent runs share the + workspace dir, so ci.sh's web-image build races another run's container creation on the + `-web` tag. Accepted for a single-maintainer cadence; serialize with a workflow + `concurrency` group if it ever bites. ## Docker only — no host tooling diff --git a/ci.sh b/ci.sh index dc7e096..d82cc16 100755 --- a/ci.sh +++ b/ci.sh @@ -40,14 +40,17 @@ pkg=$(grep -oE '"@playwright/test": "[0-9.]+"' e2e-tests/package.json | grep -oE [ -n "$img" ] && [ "$img" = "$pkg" ] || { echo "Playwright pin mismatch/unreadable: image v$img vs @playwright/test $pkg"; exit 1; } echo "ok ($img)" -# --build: without it a stale web image from a previous branch supplies node_modules (the -# source is bind-mounted but deps are baked in), so a dep bump gets typechecked/tested +# Explicit rebuild: without it a stale web image from a previous branch supplies node_modules +# (the source is bind-mounted but deps are baked in), so a dep bump gets typechecked/tested # against the OLD packages. Cheap when deps are unchanged (npm ci layer is cache-keyed). +step "Build web image" +docker compose build web + step "Typecheck" -docker compose run --build --rm --no-deps web npm run typecheck +docker compose run --rm --no-deps web npm run typecheck step "Unit tests" -units=$(docker compose run --build --rm --no-deps web npm test 2>&1) || { echo "$units"; exit 1; } +units=$(docker compose run --rm --no-deps web npm test 2>&1) || { echo "$units"; exit 1; } echo "$units" | grep -E '^. (tests|pass|fail) ' || true # Sanity floor: catch a glob that matches too few files (a full empty glob already exits non-zero above). count=$(echo "$units" | grep -oE 'tests [0-9]+' | grep -oE '[0-9]+' | head -1 || true)