hongming
a409d9032a
ci-arm64-advisory / fast-checks (pull_request) Waiting to run
Harness Replays / detect-changes (pull_request) Successful in 4s
CI / Python Lint & Test (pull_request) Successful in 9s
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 11s
Handlers Postgres Integration / detect-changes (pull_request) Successful in 9s
E2E API Smoke Test / detect-changes (pull_request) Successful in 10s
Lint forbidden tenant-env keys / Scan workspace_secrets writers for forbidden env keys (pull_request) Successful in 4s
E2E Chat / detect-changes (pull_request) Successful in 10s
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 10s
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 10s
CI / Detect changes (pull_request) Successful in 14s
Lint shellcheck (arm64 pilot) / shellcheck-arm64 (pilot) (pull_request) Successful in 2s
Lint forbidden tenant-env keys / Scan for repo-host token write into tenant workspace surface (pull_request) Successful in 9s
Harness Replays / Harness Replays (pull_request) Successful in 5s
lint-required-workflows-docker-host-pinned / Lint docker-host pin on docker-touching workflows (pull_request) Successful in 6s
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 6s
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 2s
gate-check-v3 / gate-check (pull_request_target) Successful in 12s
E2E Chat / E2E Chat (pull_request) Successful in 3s
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 2s
qa-review / approved (pull_request_target) Failing after 17s
security-review / approved (pull_request_target) Failing after 16s
CI / Platform (Go) (pull_request) Successful in 2s
CI / Shellcheck (E2E scripts) (pull_request) Successful in 4s
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 11s
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 58s
lint-continue-on-error-tracking / lint-continue-on-error-tracking (pull_request) Successful in 1m13s
Lint pre-flip continue-on-error / Verify continue-on-error flips have run-log proof (pull_request) Successful in 1m11s
Lint workflow YAML (Gitea-1.22.6-hostile shapes) / Lint workflow YAML for Gitea-1.22.6-hostile shapes (pull_request) Successful in 1m25s
lint-required-context-exists-in-bp / lint-required-context-exists-in-bp (pull_request) Successful in 1m50s
CI / Canvas (Next.js) (pull_request) Successful in 5m53s
CI / Canvas Deploy Status (pull_request) Has been skipped
CI / all-required (pull_request) Successful in 1s
sop-checklist / review-refire (pull_request_target) Has been skipped
sop-checklist / all-items-acked (pull_request) [info tier:low] acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, l
sop-checklist / na-declarations (pull_request) N/A: (none)
sop-checklist / all-items-acked (pull_request_target) Successful in 3s
sop-tier-check / tier-check (pull_request_target) Successful in 5s
qa-review / approved (pull_request_review) Has been skipped
security-review / approved (pull_request_review) Has been skipped
sop-tier-check / tier-check (pull_request_review) Successful in 6s
audit-force-merge / audit (pull_request_target) Successful in 3s
The canvas /api/buildinfo route existed but only read VERCEL_GIT_COMMIT_SHA,
which the fleet's ECR-image Docker deploy never sets — so the served SHA
always reported "dev" and canvas deploys could not be verified by the
served SHA the way the platform's /buildinfo is.
Bake the merge SHA into the canvas image at build time and surface it:
- canvas/Dockerfile: ARG BUILD_SHA=dev -> ENV BUILD_SHA in the final
runtime stage (server-only, not NEXT_PUBLIC_, so it stays out of the
client bundle). Default "dev" matches workspace-server's sentinel so an
unwired build fails the SHA comparison closed.
- route.ts: BUILD_SHA takes priority, then VERCEL_GIT_COMMIT_SHA, then
"dev". force-dynamic so the route reads BUILD_SHA from the standalone
Node server's runtime env per request (confirmed via next build: the
route renders as Dynamic / server-rendered on demand).
- publish-canvas-image.yml: pass BUILD_SHA=${{ github.sha }} (full 40-char
SHA) so the fleet redeploy verification can match exactly.
- docker-compose.yml: BUILD_SHA build arg (default "dev") for local builds.
- test: assert BUILD_SHA wins over the Vercel var + the dev fallback.
Follow-up (flagged, not in scope): core#2226's canvas deploy could poll
this /api/buildinfo per-tenant to assert the served SHA, the same way the
platform redeploy workflow polls workspace-server's /buildinfo.
Closes #2235
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
42 lines
1.9 KiB
Docker
42 lines
1.9 KiB
Docker
FROM node:22-alpine@sha256:cb15fca92530d7ac113467696cf1001208dac49c3c64355fd1348c11a88ddf8f AS builder
|
|
WORKDIR /app
|
|
COPY package.json package-lock.json* ./
|
|
# `npm ci` (not `install`) for lockfile-exact reproducibility.
|
|
# `--include=optional` ensures the platform-specific @tailwindcss/oxide
|
|
# native binary lands — without it, postcss fails with "Cannot read
|
|
# properties of undefined (reading 'All')" at build time.
|
|
RUN npm ci --include=optional
|
|
COPY . .
|
|
ARG NEXT_PUBLIC_PLATFORM_URL=http://localhost:8080
|
|
ARG NEXT_PUBLIC_WS_URL=ws://localhost:8080/ws
|
|
ARG NEXT_PUBLIC_ADMIN_TOKEN=
|
|
ENV NEXT_PUBLIC_PLATFORM_URL=$NEXT_PUBLIC_PLATFORM_URL
|
|
ENV NEXT_PUBLIC_WS_URL=$NEXT_PUBLIC_WS_URL
|
|
ENV NEXT_PUBLIC_ADMIN_TOKEN=$NEXT_PUBLIC_ADMIN_TOKEN
|
|
RUN npm run build
|
|
|
|
FROM node:22-alpine@sha256:cb15fca92530d7ac113467696cf1001208dac49c3c64355fd1348c11a88ddf8f
|
|
WORKDIR /app
|
|
COPY --from=builder /app/.next/standalone ./
|
|
COPY --from=builder /app/.next/static ./.next/static
|
|
COPY --from=builder /app/public ./public
|
|
|
|
EXPOSE 3000
|
|
ENV PORT=3000
|
|
ENV HOSTNAME="0.0.0.0"
|
|
# Git SHA the image was built from, surfaced at /api/buildinfo so canvas
|
|
# deploys are verifiable by the served SHA the same way workspace-server's
|
|
# /buildinfo is (core#2235). Wired from `${{ github.sha }}` in
|
|
# publish-canvas-image.yml. Server-only (not NEXT_PUBLIC_) — the route
|
|
# handler reads it at runtime on the standalone Node server, so it stays
|
|
# out of the client bundle. Set on the final stage (not the builder) so it
|
|
# lives in the runtime env that force-dynamic reads per request. Default
|
|
# "dev" matches the route + workspace-server sentinel: an unwired build
|
|
# fails the SHA comparison closed instead of looking deployed.
|
|
ARG BUILD_SHA=dev
|
|
ENV BUILD_SHA=$BUILD_SHA
|
|
# Non-root runtime — use addgroup/adduser without fixed GID/UID to avoid conflicts with base image
|
|
RUN addgroup canvas 2>/dev/null || true && adduser -G canvas -s /bin/sh -D canvas 2>/dev/null || true
|
|
USER canvas
|
|
CMD ["node", "server.js"]
|