Omar SobhandClaude Opus 5
b1bf50160a
Closes the one manual step left in the pipeline. gw-04 has run clawmates-deploy.timer every minute since July, pulling :latest and rolling on drift — the CD half already worked. What was missing was anything that moved :latest, since the old build host (tank) is packed for the move. The runner lives on gw-04 because it is the only reachable x86_64 host and prod images must be linux/amd64: web-01 is aarch64 and the fleet build boxes are offline. Host executor, capacity 1, so builds serialize rather than competing with production traffic. Three details that are not obvious: - `docker push :latest` does NOT move the tag on this registry once the manifest exists under another tag. The PUT-the-manifest step is what actually moves it, and its absence is how a "successful" deploy could leave prod on a stale image. - The final step verifies the image prod is RUNNING, not the one we pushed. A green edge on the old image is the failure this pipeline exists to prevent. - broker is built here too. It had no :latest tag at all, so gw-04's deploy loop logged a pull failure every single cycle since 2026-08-11. Also ignore the local env backups: `.env` was ignored but `.env.bak.*` was not, and those copies hold real credentials. Co-Authored-By: Claude Opus 5 <[email protected]>
32 lines
923 B
Plaintext
32 lines
923 B
Plaintext
/target
|
|
**/node_modules
|
|
frontend/.next
|
|
frontend/out
|
|
frontend/coverage
|
|
frontend/playwright-report
|
|
frontend/test-results
|
|
.env
|
|
.env.local
|
|
*.log
|
|
.DS_Store
|
|
data/
|
|
token.key
|
|
|
|
# Hosted node-agent binaries (built + baked into the frontend image, not committed)
|
|
frontend/public/dl/
|
|
|
|
# Local env backups. `.env` is already ignored above, but a timestamped or
|
|
# suffixed copy of it is not — and these hold real credentials (subscription
|
|
# OAuth token, forge PAT, DB password). Ignore every variant, not just the
|
|
# exact name.
|
|
.env.bak*
|
|
*.env.bak*
|
|
deploy/compose/.env.*
|
|
|
|
# Local-only compose override. NOT for prod or the air-gapped install: it
|
|
# rebinds published ports to loopback, enables the login bypass, and points the
|
|
# runtime at MacBook-specific paths. docker-compose picks this file up
|
|
# automatically, so committing it would silently reconfigure anyone who runs
|
|
# deploy/compose.
|
|
deploy/compose/docker-compose.override.yml
|