Copy CHANGELOG.md into the release image builder stage #8
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/release-image-changelog-copy"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Production has been serving
main-1788188084-14d3204since 2026-08-31 — the commit before the changelog page. That is why the path calculator still shows a blocked profile with no over-the-horizon rays, common-volume marker, or explanatory note: those commits (74b79a4e,3bca4272,9ffa7dec) were pushed but never produced an image.Every
build.yamlrun since has failed in the Build and Push step:Microwaveprop.ChangelogandMicrowavepropWeb.RouterreadCHANGELOG.mdfrom a module body, but the builder stage only copiedalgo.mdbeforeRUN mix compile. CI's own verify/test steps tar the whole checkout into the CI image, so they stay green — only the release Dockerfile compiles from a curated subset.Changes:
Dockerfile:COPY CHANGELOG.md CHANGELOG.mdalongsidealgo.md.test/microwaveprop/release_image_test.exs: fails when a compile-time@external_resourceis not copied into the builder stage beforemix compile. Verified red without the Dockerfile line, green with it.CHANGELOG.md: the entry3bca4272never wrote for the blocked-path over-the-horizon view.Verification:
MIX_ENV=prod mix compile --warnings-as-errorspasses locally;make format/deps/credo/xrefpass;make testfails only the 12Wgrib2Testcases that need thewgrib2binary (absent locally, present in the CI/base image). A local image build could not be used as proof — the base images are amd64-only and the BEAM crashes under qemu on arm64.After merge the image build needs to succeed and the deployment rolled onto the new tag before the end user sees any of it.
Microwaveprop.Changelog and the router both read CHANGELOG.md from a module body, but the Dockerfile only copied algo.md before `mix compile`. Every image build since the changelog page landed has died with == Compilation error in file lib/microwaveprop/changelog.ex == ** (File.Error) could not read file "CHANGELOG.md" so production has been pinned to the commit before it and never picked up the changelog page, the path calculator's over-the-horizon view, or the hook hardening. CI cannot see this: the verify and test steps tar the whole checkout into the CI image, while only the release Dockerfile compiles from a curated subset. The new test keeps that subset in sync with the compile-time @external_resource list, and the missing changelog entry for the blocked path view is added.🤖 Skippy PR review
1 finding — none blocking.
test/microwaveprop/release_image_test.exs:36Reviewed
55265bbb1c4d. Commentskippy reviewto re-run.@ -0,0 +33,4 @@"lib/**/*.ex"|> Path.wildcard()|> Enum.flat_map(fn file ->~r/@external_resource\s+"([^"]+)"/🟡 Warning — Guard only sees literal-string @external_resource — 3 of 7 resources escape it
The regex
~r/@external_resource\s+"([^"]+)"/only matches attributes whose value is a quoted literal. Three compile-time resources in this repo are declared indirectly and silently escape the guard:@external_resource @denylist_path(lib/microwaveprop/accounts/password_policy.ex:42),@external_resource @source(lib/microwaveprop/propagation/validation_report.ex:21), and@external_resource path(lib/microwaveprop_web/controllers/agent_skills_controller.ex:29, two files). So deletingCOPY priv/security priv/securityorCOPY priv/agent-skills priv/agent-skillsfrom the Dockerfile — the exact class of regression that froze prod — still passes this test green. Pin the directory COPY lines too (or assert each ofpriv/security,priv/agent-skills,docs/api,docs/algo-reportsappears beforeRUN mix compile), not just the two root files.🤖 Skippy PR review
1 finding — none blocking.
test/microwaveprop/release_image_test.exs:33Resolved 1 earlier finding (indirect @external_resource escape) — fixed in
345be9d; 0 still open.Reviewed
345be9d87eef. Commentskippy reviewto re-run.@ -0,0 +30,4 @@@literal_resource ~r/@external_resource\s+"([^"]+)"/# Non-literal argument: attribute reference, variable, comprehension binding.@indirect_resource ~r/@external_resource\s+(?!")[^#\s]/🔵 Suggestion — Suggestion — regexes scan heredoc prose, not just declarations
The line-based scans strip
#comments but not"""heredocs, so a lib@moduledoc/@docthat documents this pattern trips the detectors: prose like "declare it as@external_resource @path" flags the file as indirect (demanding a bogus pin), and a docstring example@external_resource "priv/x"demands a bogus COPY. The old literal scan had the same heredoc blindness; the new@indirect_resourcedetector widens it. Since you now parse line-by-line anyway, track heredoc state (skip lines between"""delimiters) before running either regex — cheap and makes the tripwire only fire on real declarations.