5 Commits

Include renames

Author	SHA1	Message	Date
homelab-updaterandClaude Opus 5.5	7131ca9b12	fix(deploy): keep VM103's disk from filling with images and build cache ... Every CI build and deploy left a 1.2 GB image of this app on the VM and the build cache kept growing, until the root disk was full and apt in CI failed. After a good deploy update.sh keeps the running image, the previous one and the three newest; the publish job prunes build cache older than two days. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-30 13:44:30 +02:00
homelab-updaterandClaude Opus 5.5	136f9d2fb0	feat(deploy): deploy a release by hand from Gitea Actions ... A deploy workflow, started only by hand (or through the API) and only from master, pulls the chosen image (release tag, sha or latest) and runs that image's own update.sh against VM103's compose directory through the Docker socket. update.sh now copies the database through the running server first, installs the image's compose.yaml and update.sh with --install, and restores the previous compose file together with the previous image when the new version does not come up. CI also builds release tags v*. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-30 09:30:19 +02:00
homelab-updaterandClaude Opus 5	9518627e3e	fix(runtime): fail closed without bubblewrap; install it in CI and the image ... The function runtime silently ran untrusted code as a plain process when /usr/bin/bwrap was missing. The CI job image (node:24-bookworm) has no bubblewrap, so the stage-6 sandbox tests got 'leak' no matter which capabilities the runner granted. Now execute() returns an error outcome instead, CI installs bubblewrap, and the runtime image ships it (bubblewrap: required by the sandbox, from Debian). Also commits the runner's job-container options (SYS_ADMIN + AppArmor unconfined), already live on VM103, needed for bwrap to create namespaces. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-22 17:02:49 +02:00
homelab-updaterandClaude Opus 5	da40e50630	web: footer shows the running build (branch and CI build number) ... "foundations · build 6", on master only "build 6"; the full sha is the tooltip. CI passes BRANCH and BUILD_NUMBER (github.run_number) as build args next to REVISION; the server reads BUILD_* and serves them at /api/build. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-19 13:14:48 +02:00
homelab-updaterandClaude Sonnet 5	41e41afb67	ci: Gitea Actions workflow, check on every push, image build and push on master/foundations ... Pushes only the refs of the current build (never --all-tags: the VM daemon also holds the local :rollback tag). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-19 01:18:08 +02:00