chore: rebuild dev env from templates #29

Merged

gravityfargo merged 7 commits from chore/rebuild-dev-env into main

2026-08-02 02:55:20 +00:00

gravityfargo commented

2026-07-31 00:22:24 +00:00

Owner

Summary

Full template rebuild: every template-owned file deleted and re-applied from the templates repo in layer order, then the displaced project-specific behaviour rewired on top.

Layers applied

shared (common/) — .editorconfig, .forgejo/renovate.json, .gitignore, .prettierignore, CLAUDE.md, Makefile target contract
base type docker — .dockerignore, .hadolint.yaml, Makefile, code-quality.yml
variant: docs publisher docs-zensical — publish-docs.yml only
variant: release plumbing — commitizen/pr-bump-preview.yml + commitizen-docker/cz.toml
variant: container build/publish docker-multiarch — build-version.yml + publish.yml, replacing build-push.yml

Baseline drift picked up

code-quality.yml and publish-docs.yml move from runs-on: ubuntu-latest + container.image: general-ci:0.5.0 to the modernleft-general-ci runner label
code-quality.yml gains the if: !startsWith(…, 'bump:') guard
.gitignore replaced with the full shared list; bluesky-pds/ and site/ carried into its # projext specific tail
.prettierignore added (was absent)
Makefile restores export BUILDKIT_SYNTAX and the matching --build-arg

Displaced behaviour reapplied

.dockerignore allowances for entrypoint.sh and pdsadmin — verified by a local make build, which reached both COPY steps
the generate-env Makefile target
Docker Hub publishing, using the template's own env.DOCKERHUB_USERNAME / env.DOCKERHUB_TOKEN form

Upstream tracking rewired to cut releases

This image now versions independently of upstream, so an upstream release cannot cut a tag on its own. New upstream-track.yml runs daily at 06:00 UTC, resolves the newest bluesky-social/pds tag, and on a change commits it to .pds-version as feat: track upstream pds vX.Y.Z. That drives the existing chain: build-version.yml → cz bump → tag → publish.yml → both registries.

Both builds now read .pds-version and pass it as --build-arg PDS_VERSION, so a given commit always builds the same image rather than resolving "newest tag" at build time.

Deliberately not applied

common/LICENSE (AGPL-3.0) — this repo redistributes MIT/Apache-2.0 code from bluesky-social/pds, and Dockerfile:39 declares org.opencontainers.image.licenses="MIT,Apache-2.0"
the docs-zensical scaffold docs/ tree — the project has real documentation
0-byte common/AGENTS.md and common/README.md — treated as no-ops, not deletions

Before merging

Rename the registry credentials — publish.yml uses the baseline system / MODERNLEFT_REGISTRY_TOKEN from Infisical /system, replacing this repo's former gravityfargo / REGISTRY_TOKEN from /bluesky-pds-docker. Confirm the system identity can push under gravityfargo/, and that DOCKERHUB_USERNAME / DOCKERHUB_TOKEN resolve at /system.
Create the 1.0.0 tag manually. The bump preview on this PR measured version 0.0.0 → 0.1.0, so commitizen will not reach 1.0.0 on its own.
upstream-track.yml commits unsigned, unlike bump.yml which signs via the commitizen-bot key.

CI

pr-bump-preview is the only workflow that fires on a PR branch; it passed and posted its preview comment. The build, publish, docs, and bump paths are push/tag triggered and are not exercised until merge.

## Summary Full template rebuild: every template-owned file deleted and re-applied from the templates repo in layer order, then the displaced project-specific behaviour rewired on top. **Layers applied** - shared (`common/`) — `.editorconfig`, `.forgejo/renovate.json`, `.gitignore`, `.prettierignore`, `CLAUDE.md`, Makefile target contract - base type `docker` — `.dockerignore`, `.hadolint.yaml`, `Makefile`, `code-quality.yml` - variant: docs publisher `docs-zensical` — `publish-docs.yml` only - variant: release plumbing — `commitizen/pr-bump-preview.yml` + `commitizen-docker/cz.toml` - variant: container build/publish `docker-multiarch` — `build-version.yml` + `publish.yml`, replacing `build-push.yml` **Baseline drift picked up** - `code-quality.yml` and `publish-docs.yml` move from `runs-on: ubuntu-latest` + `container.image: general-ci:0.5.0` to the `modernleft-general-ci` runner label - `code-quality.yml` gains the `if: !startsWith(…, 'bump:')` guard - `.gitignore` replaced with the full shared list; `bluesky-pds/` and `site/` carried into its `# projext specific` tail - `.prettierignore` added (was absent) - `Makefile` restores `export BUILDKIT_SYNTAX` and the matching `--build-arg` **Displaced behaviour reapplied** - `.dockerignore` allowances for `entrypoint.sh` and `pdsadmin` — verified by a local `make build`, which reached both `COPY` steps - the `generate-env` Makefile target - Docker Hub publishing, using the template's own `env.DOCKERHUB_USERNAME` / `env.DOCKERHUB_TOKEN` form **Upstream tracking rewired to cut releases** This image now versions independently of upstream, so an upstream release cannot cut a tag on its own. New `upstream-track.yml` runs daily at 06:00 UTC, resolves the newest `bluesky-social/pds` tag, and on a change commits it to `.pds-version` as `feat: track upstream pds vX.Y.Z`. That drives the existing chain: `build-version.yml` → cz bump → tag → `publish.yml` → both registries. Both builds now read `.pds-version` and pass it as `--build-arg PDS_VERSION`, so a given commit always builds the same image rather than resolving "newest tag" at build time. **Deliberately not applied** - `common/LICENSE` (AGPL-3.0) — this repo redistributes MIT/Apache-2.0 code from `bluesky-social/pds`, and `Dockerfile:39` declares `org.opencontainers.image.licenses="MIT,Apache-2.0"` - the `docs-zensical` scaffold `docs/` tree — the project has real documentation - 0-byte `common/AGENTS.md` and `common/README.md` — treated as no-ops, not deletions ## Before merging - [ ] Rename the registry credentials — `publish.yml` uses the baseline `system` / `MODERNLEFT_REGISTRY_TOKEN` from Infisical `/system`, replacing this repo's former `gravityfargo` / `REGISTRY_TOKEN` from `/bluesky-pds-docker`. Confirm the `system` identity can push under `gravityfargo/`, and that `DOCKERHUB_USERNAME` / `DOCKERHUB_TOKEN` resolve at `/system`. - [x] Create the `1.0.0` tag manually. The bump preview on this PR measured `version 0.0.0 → 0.1.0`, so commitizen will not reach 1.0.0 on its own. - [ ] `upstream-track.yml` commits unsigned, unlike `bump.yml` which signs via the commitizen-bot key. ## CI `pr-bump-preview` is the only workflow that fires on a PR branch; it passed and posted its preview comment. The build, publish, docs, and bump paths are `push`/`tag` triggered and are not exercised until merge.

gravityfargo added 4 commits

2026-07-31 00:22:24 +00:00

build: clean makefile 5438b8bc06

ci: update 5d8d4fbce0

bump d42a0c0a2d

chore: rebuild dev env from templates (docker + multiarch + commitizen + zensical docs)

PR Bump Preview / Preview version bump (pull_request) Successful in 23s

Details

677242fee9