chore: rebuild every template-owned file from the docker baseline

gravityfargo commented

2026-07-31 03:21:21 +00:00

Owner

Template rebuild against ModernLeft/templates at 7cf0466. CI green on the branch head.

Layers applied

shared (common/) — .editorconfig, .gitignore, .prettierignore, .forgejo/renovate.json, CLAUDE.md, LICENSE, and the zero-byte AGENTS.md / README.md
base (docker/) — .dockerignore, .hadolint.yaml, Makefile, and the workflows code-quality.yml, test-build.yml, build-version.yml, publish.yml
release plumbing (common-versioning + common-versioning-docker) — pr-bump-preview.yml, cz.toml
docs publisher — none
build/publish variant — none; the docker baseline trio stands

Placeholders substituted: <image> → athena-archive-ci, <owner> → modernleft. The commented Docker Hub block in publish.yml was dropped rather than left carrying a live <dockerhub-owner> token; this repo publishes only to the Forgejo registry.

The one file not replaced

Dockerfile — kept as the deliverable rather than overwritten by the layer's debian + tini baseline, then brought up to the layer's conventions: long-form apt flags, 4-space continuations, and the baseline's title / vendor labels beside the existing source / description / licenses.

It also picked up three changes beyond the rebuild: the base moved to general-ci:0.6.0, USER became fully numeric, and the UV_PYTHON / uv python install pin was dropped because 0.6.0 already ships exactly 3.14.6 (uv python list shows it installed in the base). The description label lost its "pinned Python" claim to match.

AGENTS.md and README.md were emptied to match the shared layer. Their prior content is recoverable from main.

Attributed breakage and its fix

Run 4109 failed: hadolint DL3066 info: Non-numeric user-id on USER root and USER appuser, exit 1.

Owned by the docker layer's code-quality.yml, via a linter version change. The displaced checks.yml pinned HADOLINT_VERSION: v2.14.0 and curled that binary; code-quality.yml calls the hadolint inside the modernleft-general-ci image, which is hadolint/hadolint:v2.15.0-alpine. Verified: 2.14.0 exits 0 on this Dockerfile, 2.15.0 exits 1.

This is not specific to this repo. The docker layer's own baseline Dockerfile ends in USER app, and its .hadolint.yaml ignores only DL3008/DL3018/DL4006 — so a greenfield docker project scaffolded from the template fails its first CI run the same way. Worth fixing upstream.

Fixed here as USER 0 and USER 1001:1001, matching what general-ci itself does. The uid was read from the base image rather than assumed — it is 1001, not the 1000 a guess would give, because general-ci builds on node and the node user holds 1000. The built image was verified to still report uid=1001(appuser) gid=1001(appuser).

Divergences ruled on

divergence	ruling
`runs-on: docker` → `ubuntu-latest`	baseline stands; `ubuntu-latest` works on this deployment
`actions/cache` on `.buildx-cache` → `type=gha`	baseline stands, both directions measured. Export: `sending cache export ... done` on every run. Restore: run 4125 logged `#8 CACHED` for the apt layer and finished in 22s against 98s cold. The earlier misses were all pushes that changed a layer at or above the apt step
`renovate.json` `dockerfile.enabled` override	config hack; the shared preset extends `config:recommended`, which already enables that manager
`checks.yml` hadolint v2.14.0 pin	not carried forward; version ownership moves to the Renovate-tracked image

Verification

run	workflow	commit	result
4108 / 4109	pr-bump-preview / test-build	`71b1a4d`	test-build failure — DL3066
4113 / 4114	pr-bump-preview / test-build	`c687eed`	success
4115 / 4116	pr-bump-preview / test-build	`9b75f99`	success
4122 / 4123	pr-bump-preview / test-build	`4ace77c`	success
4124 / 4125	pr-bump-preview / test-build	`6941125`	success, with a proven cache hit

Known gap, not fixed here

make lint calls the host hadolint while CI calls the image's, so the two versions can disagree and a green local gate is not proof CI will pass. To lint at the CI version:

docker run --rm --volume $PWD:/repo --workdir /repo hadolint/hadolint:v2.15.0-alpine hadolint Dockerfile

Not merged, and not to be merged by automation — merging is the moment a release becomes possible.

Template rebuild against `ModernLeft/templates` at `7cf0466`. **CI green on the branch head.** ## Layers applied - **shared** (`common/`) — `.editorconfig`, `.gitignore`, `.prettierignore`, `.forgejo/renovate.json`, `CLAUDE.md`, `LICENSE`, and the zero-byte `AGENTS.md` / `README.md` - **base** (`docker/`) — `.dockerignore`, `.hadolint.yaml`, `Makefile`, and the workflows `code-quality.yml`, `test-build.yml`, `build-version.yml`, `publish.yml` - **release plumbing** (`common-versioning` + `common-versioning-docker`) — `pr-bump-preview.yml`, `cz.toml` - **docs publisher** — none - **build/publish variant** — none; the docker baseline trio stands Placeholders substituted: `<image>` → `athena-archive-ci`, `<owner>` → `modernleft`. The commented Docker Hub block in `publish.yml` was dropped rather than left carrying a live `<dockerhub-owner>` token; this repo publishes only to the Forgejo registry. ## The one file not replaced **`Dockerfile`** — kept as the deliverable rather than overwritten by the layer's debian + tini baseline, then brought up to the layer's conventions: long-form apt flags, 4-space continuations, and the baseline's `title` / `vendor` labels beside the existing `source` / `description` / `licenses`. It also picked up three changes beyond the rebuild: the base moved to `general-ci:0.6.0`, `USER` became fully numeric, and the `UV_PYTHON` / `uv python install` pin was dropped because 0.6.0 already ships exactly 3.14.6 (`uv python list` shows it installed in the base). The `description` label lost its "pinned Python" claim to match. `AGENTS.md` and `README.md` were emptied to match the shared layer. Their prior content is recoverable from `main`. ## Attributed breakage and its fix Run 4109 failed: hadolint `DL3066 info: Non-numeric user-id` on `USER root` and `USER appuser`, exit 1. **Owned by the `docker` layer's `code-quality.yml`**, via a linter version change. The displaced `checks.yml` pinned `HADOLINT_VERSION: v2.14.0` and curled that binary; `code-quality.yml` calls the `hadolint` inside the `modernleft-general-ci` image, which is `hadolint/hadolint:v2.15.0-alpine`. Verified: 2.14.0 exits 0 on this Dockerfile, 2.15.0 exits 1. **This is not specific to this repo.** The `docker` layer's own baseline Dockerfile ends in `USER app`, and its `.hadolint.yaml` ignores only DL3008/DL3018/DL4006 — so a greenfield docker project scaffolded from the template fails its first CI run the same way. Worth fixing upstream. Fixed here as `USER 0` and `USER 1001:1001`, matching what `general-ci` itself does. The uid was read from the base image rather than assumed — it is `1001`, not the 1000 a guess would give, because `general-ci` builds on node and the `node` user holds 1000. The built image was verified to still report `uid=1001(appuser) gid=1001(appuser)`. ## Divergences ruled on | divergence | ruling | | --- | --- | | `runs-on: docker` → `ubuntu-latest` | baseline stands; `ubuntu-latest` works on this deployment | | `actions/cache` on `.buildx-cache` → `type=gha` | **baseline stands, both directions measured.** Export: `sending cache export ... done` on every run. Restore: run 4125 logged `#8 CACHED` for the apt layer and finished in 22s against 98s cold. The earlier misses were all pushes that changed a layer at or above the apt step | | `renovate.json` `dockerfile.enabled` override | config hack; the shared preset extends `config:recommended`, which already enables that manager | | `checks.yml` hadolint v2.14.0 pin | not carried forward; version ownership moves to the Renovate-tracked image | ## Verification | run | workflow | commit | result | | --- | --- | --- | --- | | 4108 / 4109 | pr-bump-preview / test-build | `71b1a4d` | test-build failure — DL3066 | | 4113 / 4114 | pr-bump-preview / test-build | `c687eed` | success | | 4115 / 4116 | pr-bump-preview / test-build | `9b75f99` | success | | 4122 / 4123 | pr-bump-preview / test-build | `4ace77c` | success | | 4124 / 4125 | pr-bump-preview / test-build | `6941125` | success, with a proven cache hit | ## Known gap, not fixed here `make lint` calls the host hadolint while CI calls the image's, so the two versions can disagree and a green local gate is not proof CI will pass. To lint at the CI version: ``` docker run --rm --volume $PWD:/repo --workdir /repo hadolint/hadolint:v2.15.0-alpine hadolint Dockerfile ``` Not merged, and not to be merged by automation — merging is the moment a release becomes possible.

gravityfargo added 2 commits

2026-07-31 03:21:21 +00:00

ci: adopt the docker baseline files and hadolint gate f05f8c568d

chore: rebuild every template-owned file from the docker baseline

PR Bump Preview / Preview version bump (pull_request) Successful in 5s

Details

Test Build / Test build image (pull_request) Successful in 1m33s

Details

Test Build / checks (pull_request) Failing after 5s

Details

Test Build / code-quality (pull_request) Failing after 0s

Details