docs(ci): describe the pipeline that actually runs - #5
Merged
Conversation
Verified against the four ci.yml files and against ghcr, after a day spent believing the docs: - 'Release: main branch builds and tag builds' was wrong. Publishing is gated on 'if: startsWith(github.ref, "refs/tags/v")' in every repo -- a merge to main runs lint and tests and produces no image at all. This is the single most common source of confusion and now has its own callout. - The image table advertised ':latest' for backend, frontend and assistant. Nothing in the pipeline creates that tag and the registry has no such tag; 'docker pull ...:latest' fails. Removed, with a snippet for asking the registry what really exists. - 'The version is derived from the git tag on forail-deploy' -- each repo is tagged on its own, which is why published component versions legitimately differ and the chart is what pins a working set. - A Trivy image scan and a pip-audit stage were documented. Neither exists in any workflow. Recorded under 'Known gaps' instead, along with 'ruff check . || true' never failing the build. - Documented rc tags as the way to validate a build before cutting a release. Contributing guide: - The flow said branch from 'devel' and target 'devel' in the PR. There is no devel branch in any Forail repo and there has not been one; everything targets main. - Added the two-remote reality (github canonical, origin the GitLab mirror). - Added a development-environment section: VirtualBox only, up.sh instead of bare vagrant up, destroy before testing (a half-recreated cluster gives two CAs and never reaches quorum), and the 8013/8080 collision between the backend and deploy VMs. - Made rule 5 explicit: proven by the real thing running, not by a syntax check.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A day of work today ran into the docs being wrong about the release pipeline, so this corrects them against the four
ci.ymlfiles and against the registry itself.CI/CD page
mainbuilds and tag buildsif: startsWith(github.ref, 'refs/tags/v')— a merge tomainpublishes nothingforail-backend:latest,forail-frontend:latest,forail-assistant:latestlatesttag exists anywhere; the registry only has versionsforail-deploy2026.07.1sits next to frontend2026.07.0The false ones are corrected; the missing stages are recorded under Known gaps rather than quietly dropped. Added: what each repo's jobs really run, rc tags as the way to validate a build before a release, and a snippet for asking ghcr what is actually published.
Contributing guide
develand targetdevel. There is nodevelbranch in any Forail repo — everything targetsmain.githubcanonical,originthe GitLab mirror.scripts/up.shinstead of barevagrant up, and destroy before testing —vagrant upon an existing VM does not re-provision, so a half-recreated cluster ends up with two CAs and never reaches quorum.forail-backendandforail-deployVMs both forward host ports 8013 and 8080, so only one can run at a time.vagrant validate.