chore: clean up release workflow and document Doppler usage

fix: simplify bake file to avoid locals/function blocks (buildx compat)
The Gitea runner's docker buildx doesn't support HCL locals{} or function{} blocks (added in buildx 0.12+). Replace with plain variables: VERSION and MAJOR_MINOR are pre-computed in a CI step and passed as env vars to bake. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-15 20:14:45 +05:00 · 2026-04-15 19:43:54 +05:00 · 2026-04-15 19:24:57 +05:00 · 2026-04-15 19:22:06 +05:00
4 changed files with 76 additions and 200 deletions
--- a/.gitea/workflows/release.yaml
+++ b/.gitea/workflows/release.yaml
@@ -62,99 +62,7 @@ jobs:
          path: ui/build
          retention-days: 1

-  # ── ui: source map upload ─────────────────────────────────────────────────────
-  # Commented out — re-enable when GlitchTip source map uploads are needed again.
-  #
-  # upload-sourcemaps:
-  #   name: Upload source maps
-  #   runs-on: ubuntu-latest
-  #   needs: [check-ui]
-  #   steps:
-  #     - name: Compute release version (strip leading v)
-  #       id: ver
-  #       run: |
-  #         V="${{ gitea.ref_name }}"
-  #         echo "version=${V#v}" >> "$GITHUB_OUTPUT"
-  #
-  #     - name: Download build artifacts
-  #       uses: actions/download-artifact@v3
-  #       with:
-  #         name: ui-build
-  #         path: build
-  #
-  #     - name: Install sentry-cli
-  #       run: npm install -g @sentry/cli
-  #
-  #     - name: Inject debug IDs into build artifacts
-  #       run: sentry-cli sourcemaps inject ./build
-  #       env:
-  #         SENTRY_URL: https://errors.libnovel.cc/
-  #         SENTRY_AUTH_TOKEN: ${{ secrets.GLITCHTIP_AUTH_TOKEN }}
-  #         SENTRY_ORG: libnovel
-  #         SENTRY_PROJECT: ui
-  #
-  #     - name: Upload injected build (for docker-ui)
-  #       uses: actions/upload-artifact@v3
-  #       with:
-  #         name: ui-build-injected
-  #         path: build
-  #         retention-days: 1
-  #
-  #     - name: Create GlitchTip release
-  #       run: sentry-cli releases new ${{ steps.ver.outputs.version }}
-  #       env:
-  #         SENTRY_URL: https://errors.libnovel.cc/
-  #         SENTRY_AUTH_TOKEN: ${{ secrets.GLITCHTIP_AUTH_TOKEN }}
-  #         SENTRY_ORG: libnovel
-  #         SENTRY_PROJECT: ui
-  #
-  #     - name: Upload source maps to GlitchTip
-  #       run: sentry-cli sourcemaps upload ./build --release ${{ steps.ver.outputs.version }}
-  #       env:
-  #         SENTRY_URL: https://errors.libnovel.cc/
-  #         SENTRY_AUTH_TOKEN: ${{ secrets.GLITCHTIP_AUTH_TOKEN }}
-  #         SENTRY_ORG: libnovel
-  #         SENTRY_PROJECT: ui
-  #
-  #     - name: Finalize GlitchTip release
-  #       run: sentry-cli releases finalize ${{ steps.ver.outputs.version }}
-  #       env:
-  #         SENTRY_URL: https://errors.libnovel.cc/
-  #         SENTRY_AUTH_TOKEN: ${{ secrets.GLITCHTIP_AUTH_TOKEN }}
-  #         SENTRY_ORG: libnovel
-  #         SENTRY_PROJECT: ui
-  #
-  #     - name: Prune old GlitchTip releases (keep latest 10)
-  #       run: |
-  #         set -euo pipefail
-  #         KEEP=10
-  #         OLD=$(curl -sf \
-  #           -H "Authorization: Bearer $SENTRY_AUTH_TOKEN" \
-  #           "$SENTRY_URL/api/0/organizations/$SENTRY_ORG/releases/?project=$SENTRY_PROJECT&per_page=100" \
-  #           | python3 -c "
-  #         import sys, json
-  #         releases = json.load(sys.stdin)
-  #         for r in releases[$KEEP:]:
-  #             print(r['version'])
-  #         " KEEP=$KEEP)
-  #         for ver in $OLD; do
-  #           echo "Deleting old release: $ver"
-  #           sentry-cli releases delete "$ver" || true
-  #         done
-  #       env:
-  #         SENTRY_URL: https://errors.libnovel.cc
-  #         SENTRY_AUTH_TOKEN: ${{ secrets.GLITCHTIP_AUTH_TOKEN }}
-  #         SENTRY_ORG: libnovel
-  #         SENTRY_PROJECT: ui
-
  # ── docker: build + push all images via docker bake ──────────────────────────
-  # docker-bake.hcl defines all five targets. BuildKit builds them with maximum
-  # parallelism: backend/runner/pocketbase share the Go builder stage (compiled
-  # once), while caddy and ui build concurrently alongside the Go targets.
-  #
-  # Metadata (tags + labels) is generated per-image by docker/metadata-action
-  # (bake-target mode), then merged into a single bake call via the bake-action
-  # targets input — one Docker Hub login, one buildx invocation.
  docker:
    name: Docker
    runs-on: ubuntu-latest
@@ -170,7 +78,14 @@ jobs:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}

-      # ── Prepare ui build artifact ─────────────────────────────────────────────
+      - name: Compute version tags
+        id: ver
+        run: |
+          V="${{ gitea.ref_name }}"
+          VER="${V#v}"
+          echo "version=$VER" >> "$GITHUB_OUTPUT"
+          echo "major_minor=$(echo "$VER" | cut -d. -f1-2)" >> "$GITHUB_OUTPUT"
+
      - name: Download ui build artifacts
        uses: actions/download-artifact@v3
        with:
@@ -182,80 +97,17 @@ jobs:
          grep -v '^build$' ui/.dockerignore > ui/.dockerignore.tmp
          mv ui/.dockerignore.tmp ui/.dockerignore

-      # ── Generate per-image tags + labels (bake-target mode) ───────────────────
-      - name: Docker meta / backend
-        id: meta-backend
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ secrets.DOCKER_USER }}/libnovel-backend
-          bake-target: backend
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest
-
-      - name: Docker meta / runner
-        id: meta-runner
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ secrets.DOCKER_USER }}/libnovel-runner
-          bake-target: runner
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest
-
-      - name: Docker meta / pocketbase
-        id: meta-pocketbase
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ secrets.DOCKER_USER }}/libnovel-pocketbase
-          bake-target: pocketbase
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest
-
-      - name: Docker meta / ui
-        id: meta-ui
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ secrets.DOCKER_USER }}/libnovel-ui
-          bake-target: ui
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest
-
-      - name: Docker meta / caddy
-        id: meta-caddy
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ secrets.DOCKER_USER }}/libnovel-caddy
-          bake-target: caddy
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest
-
-      # ── Build + push all images in parallel ───────────────────────────────────
      - name: Build and push all images
        uses: docker/bake-action@v6
        with:
-          files: |
-            docker-bake.hcl
-            ${{ steps.meta-backend.outputs.bake-file }}
-            ${{ steps.meta-runner.outputs.bake-file }}
-            ${{ steps.meta-pocketbase.outputs.bake-file }}
-            ${{ steps.meta-ui.outputs.bake-file }}
-            ${{ steps.meta-caddy.outputs.bake-file }}
+          files: docker-bake.hcl
          set: |
-            backend.args.VERSION=${{ steps.meta-backend.outputs.version }}
-            backend.args.COMMIT=${{ gitea.sha }}
-            runner.args.VERSION=${{ steps.meta-runner.outputs.version }}
-            runner.args.COMMIT=${{ gitea.sha }}
-            ui.args.BUILD_TIME=${{ gitea.event.head_commit.timestamp }}
            *.output=type=image,push=true
+        env:
+          VERSION: ${{ steps.ver.outputs.version }}
+          MAJOR_MINOR: ${{ steps.ver.outputs.major_minor }}
+          COMMIT: ${{ gitea.sha }}
+          BUILD_TIME: ${{ gitea.event.head_commit.timestamp }}

  # ── deploy: sync docker-compose.yml + restart prod ───────────────────────────
  # Runs after all images are pushed to Docker Hub.
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -2,6 +2,17 @@

 This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

+## Environment / Secrets
+
+All project environment variables are stored in **Doppler**. When you need to access any secret or env var (e.g. API tokens, database URLs, credentials), fetch them via:
+
+```bash
+doppler run -- <command>        # inject all secrets into a command
+doppler secrets get SECRET_NAME # inspect a specific secret
+```
+
+Never use `.env` files. Do not ask the user to provide secrets manually — they are available via Doppler.
+
 ## Commands

 ### Docker (via `just` — the primary way to run services)
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -1,43 +1,40 @@
 # docker-bake.hcl — defines all five production images.
 #
-# Used by CI (docker/bake-action) to build and push all images in one call,
-# with shared BuildKit cache and maximum parallelism:
-#   - backend, runner, pocketbase share the Go builder stage (built once)
-#   - caddy and ui build independently in parallel alongside the Go targets
+# Uses only plain variables for broad buildx compatibility (no locals/functions).
+# CI pre-computes VERSION and MAJOR_MINOR from the git tag and passes them as
+# env vars.  Locally, everything gets a :dev tag.
 #
 # Local build (no push):
 #   docker buildx bake
 #
-# CI sets per-target tags and labels via --set overrides in docker/bake-action.
+# CI passes: DOCKER_USER, VERSION, MAJOR_MINOR, COMMIT, BUILD_TIME

-# ── Variables injected by CI via --set ───────────────────────────────────────
-
-variable "DOCKER_USER" { default = "kalekber" }
-
-variable "VERSION"    { default = "dev" }
-variable "COMMIT"     { default = "unknown" }
-variable "BUILD_TIME" { default = "" }
+variable "DOCKER_USER"  { default = "kalekber" }
+variable "VERSION"      { default = "dev" }    # e.g. "4.1.6"  (no leading v)
+variable "MAJOR_MINOR"  { default = "dev" }    # e.g. "4.1"
+variable "COMMIT"       { default = "unknown" }
+variable "BUILD_TIME"   { default = "" }

 # ── Shared defaults ───────────────────────────────────────────────────────────

-# All targets inherit these.  CI overrides tags/labels per-target via --set.
 target "_defaults" {
-  pull   = true
-  output = ["type=image,push=false"]
-}
-
-# Registry cache shared across all targets in a run.
-target "_cache" {
+  pull     = true
+  # CI overrides to push=true via --set *.output=type=image,push=true
+  output   = ["type=image,push=false"]
  cache-to = ["type=inline"]
 }

 # ── Go targets (share the backend/ build context + builder stage) ─────────────

 target "backend" {
-  inherits  = ["_defaults", "_cache"]
-  context   = "backend"
-  target    = "backend"
-  tags      = ["${DOCKER_USER}/libnovel-backend:latest"]
+  inherits   = ["_defaults"]
+  context    = "backend"
+  target     = "backend"
+  tags       = [
+    "${DOCKER_USER}/libnovel-backend:${VERSION}",
+    "${DOCKER_USER}/libnovel-backend:${MAJOR_MINOR}",
+    "${DOCKER_USER}/libnovel-backend:latest",
+  ]
  cache-from = ["type=registry,ref=${DOCKER_USER}/libnovel-backend:latest"]
  args = {
    VERSION = VERSION
@@ -46,10 +43,14 @@ target "backend" {
 }

 target "runner" {
-  inherits  = ["_defaults", "_cache"]
-  context   = "backend"
-  target    = "runner"
-  tags      = ["${DOCKER_USER}/libnovel-runner:latest"]
+  inherits   = ["_defaults"]
+  context    = "backend"
+  target     = "runner"
+  tags       = [
+    "${DOCKER_USER}/libnovel-runner:${VERSION}",
+    "${DOCKER_USER}/libnovel-runner:${MAJOR_MINOR}",
+    "${DOCKER_USER}/libnovel-runner:latest",
+  ]
  cache-from = ["type=registry,ref=${DOCKER_USER}/libnovel-runner:latest"]
  args = {
    VERSION = VERSION
@@ -58,19 +59,27 @@ target "runner" {
 }

 target "pocketbase" {
-  inherits  = ["_defaults", "_cache"]
-  context   = "backend"
-  target    = "pocketbase"
-  tags      = ["${DOCKER_USER}/libnovel-pocketbase:latest"]
+  inherits   = ["_defaults"]
+  context    = "backend"
+  target     = "pocketbase"
+  tags       = [
+    "${DOCKER_USER}/libnovel-pocketbase:${VERSION}",
+    "${DOCKER_USER}/libnovel-pocketbase:${MAJOR_MINOR}",
+    "${DOCKER_USER}/libnovel-pocketbase:latest",
+  ]
  cache-from = ["type=registry,ref=${DOCKER_USER}/libnovel-pocketbase:latest"]
 }

 # ── UI (SvelteKit — separate context) ────────────────────────────────────────

 target "ui" {
-  inherits  = ["_defaults", "_cache"]
-  context   = "ui"
-  tags      = ["${DOCKER_USER}/libnovel-ui:latest"]
+  inherits   = ["_defaults"]
+  context    = "ui"
+  tags       = [
+    "${DOCKER_USER}/libnovel-ui:${VERSION}",
+    "${DOCKER_USER}/libnovel-ui:${MAJOR_MINOR}",
+    "${DOCKER_USER}/libnovel-ui:latest",
+  ]
  cache-from = ["type=registry,ref=${DOCKER_USER}/libnovel-ui:latest"]
  args = {
    BUILD_VERSION = VERSION
@@ -83,9 +92,13 @@ target "ui" {
 # ── Caddy (custom plugins — separate context) ─────────────────────────────────

 target "caddy" {
-  inherits  = ["_defaults", "_cache"]
-  context   = "caddy"
-  tags      = ["${DOCKER_USER}/libnovel-caddy:latest"]
+  inherits   = ["_defaults"]
+  context    = "caddy"
+  tags       = [
+    "${DOCKER_USER}/libnovel-caddy:${VERSION}",
+    "${DOCKER_USER}/libnovel-caddy:${MAJOR_MINOR}",
+    "${DOCKER_USER}/libnovel-caddy:latest",
+  ]
  cache-from = ["type=registry,ref=${DOCKER_USER}/libnovel-caddy:latest"]
 }

--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -96,7 +96,7 @@ services:

  # ─── Meilisearch (full-text search) ──────────────────────────────────────────
  meilisearch:
-    image: getmeili/meilisearch:latest
+    image: getmeili/meilisearch:v1.40.0
    restart: unless-stopped
    environment:
      MEILI_MASTER_KEY: "${MEILI_MASTER_KEY}"
Author	SHA1	Message	Date
Admin	2864c4a6c0	chore: clean up release workflow and document Doppler usage Some checks failed Release / Test backend (push) Successful in 54s Details Release / Check ui (push) Successful in 2m0s Details Release / Docker (push) Failing after 2m20s Details Release / Deploy to prod (push) Has been skipped Details Release / Gitea Release (push) Has been skipped Details	2026-04-15 20:14:45 +05:00
Admin	6d0dac256d	fix: simplify bake file to avoid locals/function blocks (buildx compat) Some checks failed Release / Test backend (push) Successful in 59s Details Release / Check ui (push) Successful in 1m56s Details Release / Docker (push) Failing after 2m21s Details Release / Deploy to prod (push) Has been skipped Details Release / Gitea Release (push) Has been skipped Details The Gitea runner's docker buildx doesn't support HCL locals{} or function{} blocks (added in buildx 0.12+). Replace with plain variables: VERSION and MAJOR_MINOR are pre-computed in a CI step and passed as env vars to bake. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-15 19:43:54 +05:00
Admin	8922111471	fix: pin meilisearch to v1.40.0 Some checks failed Release / Test backend (push) Successful in 56s Details Release / Check ui (push) Successful in 2m10s Details Release / Docker (push) Failing after 1m36s Details Release / Deploy to prod (push) Has been skipped Details Release / Gitea Release (push) Has been skipped Details v1.42.1 (pulled by latest) is incompatible with existing data (db version 1.40.0). Pinning to v1.40.0 until a deliberate migration is planned. Upgrade path: https://www.meilisearch.com/docs/learn/update_and_migration/updating Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-15 19:24:57 +05:00
Admin	74e7c8e8d1	chore: move tag logic into bake file, drop all metadata-action steps Some checks failed Release / Test backend (push) Successful in 59s Details Release / Check ui (push) Successful in 1m55s Details Release / Docker (push) Failing after 1m27s Details Release / Deploy to prod (push) Has been skipped Details Release / Gitea Release (push) Has been skipped Details docker-bake.hcl now owns semver tag generation via HCL locals + a reusable img_tags() function: GIT_TAG="v4.1.5" → :4.1.5, :4.1, :latest on all images. The Docker job shrinks from 13 steps to 6 — no docker/metadata-action needed. CI simply passes GIT_TAG, COMMIT, BUILD_TIME as env vars to bake-action. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-15 19:22:06 +05:00