ci: pin dsh to resolved latest version and tag image with it - #1
Open
FFengIll wants to merge 5 commits into
Open
ci: pin dsh to resolved latest version and tag image with it#1FFengIll wants to merge 5 commits into
FFengIll wants to merge 5 commits into
Conversation
Previously the Dockerfile ran `npm install -g @deepseek-ai/dsh` with no version pin, so CI builds silently floated to whatever npm published that day with no way to tell which dsh version ended up in the image. - Dockerfile: add DSH_VERSION build-arg (defaults to "latest" for local ad-hoc builds), install that pinned version. - workflow: resolve @deepseek-ai/dsh's dist-tags.latest from the npm registry before building, fail fast if resolution fails, pass it as DSH_VERSION build-arg, and tag the pushed image dsh-<version> alongside latest/sha-*.
sha-<gitsha> didn't tell you anything about which dsh version was inside; the resolved dsh version is what's actually meaningful to tag the image with. Push latest + <dsh_version> only.
Both tags were gated on is_default_branch, so a workflow_dispatch run on a feature branch produced zero enabled tags and build-push-action failed with "tag is needed when pushing to registry". Keep latest gated to the default branch, but always tag with the resolved dsh version regardless of branch.
Image was amd64-only so `docker pull` failed on Apple Silicon Macs with "no matching manifest for linux/arm64/v8". Add QEMU and build both linux/amd64 and linux/arm64 into the same manifest list.
… optional plugin source mount Instead of a second image for plugin development, extend the existing one: it already has npm/node, just needed pnpm (which `dsh plugin` forwards to) plus git/vim/build-essential for cloning and building native deps. - Dockerfile: apt-get git/vim/build-essential/ca-certificates, enable corepack + pnpm, point pnpm at the same NPM_REGISTRY as npm. - run.sh: optional PLUGIN_DIR env var, mounted read-write at /data/dsh/plugin-src when set; unset by default so plain usage is unaffected. - README: document the plugin-dev workflow (mount + run.sh shell).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Previously the Dockerfile ran
npm install -g @deepseek-ai/dshwith no version pin, so CI builds silently floated to whatever npm published that day with no way to tell which dsh version ended up in the image.