Build and publish the portal image so a deploy needs no checkout - #8
Merged
Conversation
Deploying anywhere but a developer machine meant cloning the repo and building on the target, which put the Go toolchain on the critical path of every production host and left no artifact to roll back to. CI runs go vet and go test on every pull request and on master, then builds the image. Publication to GHCR is gated behind `needs: test`, so a red suite cannot reach the registry; a separate release workflow would have lost that ordering. Pull requests build without pushing — the build is the check, and a fork has no registry credentials anyway. Alongside latest, every commit is tagged sha-<7 chars>, which is what makes a rollback possible at all. docker-compose.prod.yml consumes that image instead of a build context, restarts services unless stopped, and carries a commented Traefik v3 block for TLS. Two settings there are specific to this application: request buffering stays off and the route timeouts are zero, because a submission is one long request — up to 4 GiB uploaded, then validated, then scanned by clamd for up to 15 minutes before the response is written. A buffering proxy would spool the whole archive to its own disk first, and a finite timeout would report failure for a submission that actually succeeded. The upstream clamav and minio tags are left floating with a note rather than pinned, since the right pin is whatever version the deployment has been tested against.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Deploying anywhere but a developer machine meant cloning the repo and building on the target, which put the Go toolchain on the critical path of every production host and left no artifact to roll back to.
CI runs go vet and go test on every pull request and on master, then builds the image. Publication to GHCR is gated behind
needs: test, so a red suite cannot reach the registry; a separate release workflow would have lost that ordering. Pull requests build without pushing — the build is the check, and a fork has no registry credentials anyway. Alongside latest, every commit is tagged sha-<7 chars>, which is what makes a rollback possible at all.docker-compose.prod.yml consumes that image instead of a build context, restarts services unless stopped, and carries a commented Traefik v3 block for TLS. Two settings there are specific to this application: request buffering stays off and the route timeouts are zero, because a submission is one long request — up to 4 GiB uploaded, then validated, then scanned by clamd for up to 15 minutes before the response is written. A buffering proxy would spool the whole archive to its own disk first, and a finite timeout would report failure for a submission that actually succeeded.
The upstream clamav and minio tags are left floating with a note rather than pinned, since the right pin is whatever version the deployment has been tested against.