From 792a67d51d8a09fefe578cac2c96bf6d82b723fd Mon Sep 17 00:00:00 2001 From: UNITRONIX <36471318+UNITRONIX@users.noreply.github.com> Date: Thu, 3 Sep 2026 21:30:35 +0200 Subject: [PATCH] fix(ci): publish GHCR :dev on version-bump so image matches tip Branch pushes skipped [version-bump] builds and labeled images from the feature commit (VERSION N), so :dev stayed one patch behind git tip (#401). Build only on version-bump commits; AIO :dev is amd64-only to avoid 6h cancels. Refs #401 Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow) --- .github/workflows/docker-publish.yml | 36 +++++++++++++++++----- CHANGELOG.md | 3 ++ docs/important/betterdesk-update-flow.md | 2 +- docs/important/branching-and-versioning.md | 2 +- 4 files changed, 33 insertions(+), 10 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index f5974760..63ff8282 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -12,8 +12,14 @@ # - git tag v* / GitHub Release (stable): semver, v*, major.minor, latest # - workflow_dispatch: latest + VERSION when tag empty/latest; else custom tag # -# Skip: branch pushes whose head commit message contains [version-bump]. -# Tag pushes and release/dispatch always build (even when the tagged commit is a bump). +# Branch pushes (main/dev): build ONLY on [version-bump] commits so GHCR image +# VERSION matches tip (auto-bump runs after the feature commit; building the +# feature SHA left :dev/:latest one patch behind — #401). Feature commits skip. +# Tag pushes, release, and workflow_dispatch always build. +# +# AIO on dev branch pushes: linux/amd64 only (multi-arch AIO often hit the 6h +# Actions limit). Console/server stay multi-arch; main/tags/release/dispatch +# keep full amd64+arm64 for AIO. # # Triggers: push main/dev (path-filtered), push tag v*, release published, manual # ============================================================================= @@ -68,13 +74,12 @@ jobs: build-server: needs: read-version - # Build on release/dispatch always; on push build tags always; on branch - # push skip [version-bump] commits only. + # Release/dispatch/tags always; branch pushes only on [version-bump] (#401). if: | github.event_name == 'workflow_dispatch' || github.event_name == 'release' || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) || - (github.event_name == 'push' && !contains(github.event.head_commit.message, '[version-bump]')) + (github.event_name == 'push' && contains(github.event.head_commit.message, '[version-bump]')) runs-on: ubuntu-latest permissions: contents: read @@ -162,11 +167,12 @@ jobs: build-console: needs: read-version + # Release/dispatch/tags always; branch pushes only on [version-bump] (#401). if: | github.event_name == 'workflow_dispatch' || github.event_name == 'release' || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) || - (github.event_name == 'push' && !contains(github.event.head_commit.message, '[version-bump]')) + (github.event_name == 'push' && contains(github.event.head_commit.message, '[version-bump]')) runs-on: ubuntu-latest permissions: contents: read @@ -219,12 +225,15 @@ jobs: build-allinone: needs: read-version + # Release/dispatch/tags always; branch pushes only on [version-bump] (#401). if: | github.event_name == 'workflow_dispatch' || github.event_name == 'release' || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) || - (github.event_name == 'push' && !contains(github.event.head_commit.message, '[version-bump]')) + (github.event_name == 'push' && contains(github.event.head_commit.message, '[version-bump]')) runs-on: ubuntu-latest + # Multi-arch AIO on dev has hit the 6h Actions limit (#401); fail sooner if stuck. + timeout-minutes: 240 permissions: contents: read packages: write @@ -242,6 +251,17 @@ jobs: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} + - name: Resolve AIO platforms + id: plats + run: | + # Dev branch pushes: amd64 only (faster :dev republish). Full multi-arch + # on main, tags, release, and workflow_dispatch. + if [ "${{ github.event_name }}" = "push" ] && [ "${{ github.ref }}" = "refs/heads/dev" ]; then + echo "platforms=linux/amd64" >> "$GITHUB_OUTPUT" + else + echo "platforms=linux/amd64,linux/arm64" >> "$GITHUB_OUTPUT" + fi + - name: Extract metadata id: meta uses: docker/metadata-action@v6 @@ -273,7 +293,7 @@ jobs: BETTERDESK_PRODUCT_VERSION=${{ needs.read-version.outputs.version }} cache-from: type=gha cache-to: type=gha,mode=max - platforms: linux/amd64,linux/arm64 + platforms: ${{ steps.plats.outputs.platforms }} update-description: needs: [build-server, build-console, build-allinone] diff --git a/CHANGELOG.md b/CHANGELOG.md index 8d326f5d..dd262e34 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,8 @@ ## [Unreleased] +### Fixed +- **GHCR `:dev` product version lag behind git tip (#401):** `docker-publish.yml` built images from the feature commit (VERSION N) then skipped the following `[version-bump]` commit (N+1), so pulled `:dev` images showed a stale semver. Branch pushes now publish only on `[version-bump]` commits so the baked VERSION matches tip. All-in-one `:dev` builds use `linux/amd64` only (multi-arch AIO was hitting the 6h Actions limit and cancelling); console/server stay multi-arch. + ### Changed - _(none yet)_ diff --git a/docs/important/betterdesk-update-flow.md b/docs/important/betterdesk-update-flow.md index 8fe13c30..8c9e9419 100644 --- a/docs/important/betterdesk-update-flow.md +++ b/docs/important/betterdesk-update-flow.md @@ -97,7 +97,7 @@ When the console runs from `ghcr.io/.../betterdesk-console` (see `docker-compose After pulling new images, recreate containers so the console picks up the embedded commit from the new image tag. -**GHCR tags:** prefer pinning `BETTERDESK_IMAGE_TAG` to a release semver (compose / `install.sh` default). `latest` is the rolling tip of the last successful **stable** image publish (Release / `main`); `dev` tracks development branch builds. See [DOCKER_QUICKSTART.md](../docker/DOCKER_QUICKSTART.md) and [#387](https://github.com/UNITRONIX/BetterDesk/issues/387). +**GHCR tags:** prefer pinning `BETTERDESK_IMAGE_TAG` to a release semver (compose / `install.sh` default). `latest` is the rolling tip of the last successful **stable** image publish (Release / `main`); `dev` tracks development branch builds and is published on each `[version-bump]` commit so the image VERSION matches git tip (#401). See [DOCKER_QUICKSTART.md](../docker/DOCKER_QUICKSTART.md), [#387](https://github.com/UNITRONIX/BetterDesk/issues/387), and [#401](https://github.com/UNITRONIX/BetterDesk/issues/401). ## Update channel (stable / development) diff --git a/docs/important/branching-and-versioning.md b/docs/important/branching-and-versioning.md index 5ee6a7c8..14c66312 100644 --- a/docs/important/branching-and-versioning.md +++ b/docs/important/branching-and-versioning.md @@ -115,7 +115,7 @@ UPDATE_GITHUB_BRANCH=dev # development | `version-bump-main.yml` | PR merged to `main` | Minor bump, tag, GitHub Release | | `version-verify.yml` | Push/PR touching version files | Fail if files disagree | | `release-server.yml` | Tag `v*` | Go server binaries | -| `docker-publish.yml` | Tag, release, push to `main`/`dev` | GHCR images: `latest` on stable release/main; `dev` on `dev` pushes; semver on `v*` / Release | +| `docker-publish.yml` | Tag, release, push to `main`/`dev` | GHCR images: on **branch** pushes, builds only `[version-bump]` commits so image VERSION matches tip (#401); tags/release/dispatch always build. `latest` on stable release/main; `dev` on `dev` bumps; semver on `v*` / Release. AIO `:dev` is amd64-only; multi-arch on main/release/dispatch | ## First stable release note