Service status page

.github/actions/build-docker-image/action.yaml

@@ -1,5 +1,8 @@
-name: Build docker Image
-description: Build and tag specific Docker images
+name: Build docker image
+description: Build, tag and optionally push a Docker image to GHCR
+
+# The caller is responsible for checking out the repository first and for
+# deciding which tags apply - this action does not inspect the triggering event.
 
 inputs:
   platforms:
@@ -12,36 +15,24 @@ inputs:
     required: false
   image_tags:
     default: ""
-    description: "The tags to apply to the image"
+    description: "Semver version to tag the image with (e.g. 1.2.3). Skipped when empty."
+    required: false
+  extra_tag:
+    default: ""
+    description: "An extra raw tag to apply to the image (e.g. edge, canary, pr-42)"
     required: false
   push:
     default: "false"
-    description: "Push the image to the registries"
+    description: "Push the image to the registry"
     required: false
   token:
     description: "Github token"
     required: true
-  tag_suffix:
-    default: ""
-    description: "Suffix to append to the image tags"
-    required: false
-  extra_tag:
-    default: ""
-    description: "An extra raw tag to apply to the image (e.g. edge, canary)"
-    required: false
 
 runs:
   using: composite
 
   steps:
-    - name: Checkout
-      uses: actions/checkout@v6
-      with:
-        persist-credentials: false
-
-    - name: Set up QEMU
-      uses: docker/setup-qemu-action@v4
-
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v4
 
@@ -61,38 +52,17 @@ runs:
         images: ghcr.io/${{ github.repository }}
         tags: |
           type=sha
-          type=raw,value=canary,enable=${{ github.event_name == 'workflow_dispatch' }}
-          type=raw,event=workflow_dispatch,value=${{ github.event.inputs.dispatch-tag }}
-          type=semver,pattern={{version}},value=${{ inputs.image_tags }},branch=develop
+          type=semver,pattern={{version}},value=${{ inputs.image_tags }}
           type=raw,value=${{ inputs.extra_tag }},enable=${{ inputs.extra_tag != '' }}
 
-    - name: Clean variables
-      id: clean
-      shell: bash
-      run: |
-        # Replace illegal characters in tag suffix
-        echo suffix=$(echo "${{ inputs.tag_suffix }}" | sed -e 's/[^a-zA-Z0-9._-]/_/g') >> $GITHUB_OUTPUT
-
-    - name: Add suffix to image tags
-      id: tag_suffix
-      shell: bash
-      run: |
-        delimiter="$(openssl rand -hex 8)"
-        echo "tags<<${delimiter}" >> $GITHUB_OUTPUT
-        # if tag_suffix is set, append it to each tag
-        if [[ -n "${{ inputs.tag_suffix }}" ]]; then
-          echo "${{ steps.meta.outputs.tags }}" | sed -e "s/$/-${{ steps.clean.outputs.suffix }}/" >> $GITHUB_OUTPUT
-        else
-          echo "${{ steps.meta.outputs.tags }}" >> $GITHUB_OUTPUT
-        fi
-        echo "${delimiter}" >> $GITHUB_OUTPUT
-
-    - name: Build image for push
+    - name: Build image
       uses: docker/build-push-action@v7.2.0
       with:
+        context: .
         file: ${{ inputs.docker_file }}
-        tags: ${{ steps.tag_suffix.outputs.tags }}
+        tags: ${{ steps.meta.outputs.tags }}
         labels: ${{ steps.meta.outputs.labels }}
         platforms: ${{ inputs.platforms }}
         push: ${{ inputs.push == 'true' }}
-
+        cache-from: type=gha
+        cache-to: type=gha,mode=max

.github/actions/setup-and-cache/action.yaml

@@ -1,44 +1,21 @@
 name: Setup and cache
-description: Setup for node, pnpm and cache for browser testing binaries
+description: Setup node and pnpm with a cached pnpm store
 
 inputs:
   node-version:
     required: false
     description: Node version for setup-node
-    default: 22.x
+    default: 24.x
 
 runs:
   using: composite
 
   steps:
     - name: Install pnpm
-      uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+      uses: pnpm/action-setup@v6
 
     - name: Set node version to ${{ inputs.node-version }}
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v6
       with:
         node-version: ${{ inputs.node-version }}
-
-    - name: Resolve package versions
-      id: resolve-package-versions
-      shell: bash
-      run: >
-        echo "$(
-          node -e "
-            const fs = require('fs');
-            const lockfile = fs.readFileSync('./pnpm-lock.yaml', 'utf8');
-            const pattern = (name) => new RegExp(name + ':\\\s+specifier: [\\\s\\\w\\\.^]+version: (\\\d+\\\.\\\d+\\\.\\\d+)');
-            const nuxtVersion = lockfile.match(pattern('nuxt'))[1];
-            console.log('NUXT_VERSION=' + nuxtVersion);
-          "
-        )" >> $GITHUB_OUTPUT
-
-    - name: Print versions
-      shell: bash
-      run: echo "${{ toJson(steps.resolve-package-versions.outputs) }}"
-
-#    - name: Check resolved package versions
-#      shell: bash
-#      if: contains(fromJSON('[null, "", "null"]'), steps.resolve-package-version)
-#      run: echo "Failed to resolve package versions. See log above." && exit 1
-
+        cache: pnpm

.github/workflows/ci.yaml

@@ -12,41 +12,12 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  changed:
-    runs-on: ubuntu-latest
-    name: 'Check differences'
-    outputs:
-      should_skip: ${{ steps.changed-files.outputs.only_changed == 'true' }}
-
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-
-      - name: Get changed files
-        id: changed-files
-        uses: tj-actions/changed-files@a284dc1814e3fd07f2e34267fc8f81227ed29fb8 # v45.0.9
-        with:
-          files: |
-            docs/**
-            .github/**
-            !.github/workflows/ci.yml
-            **.md
-
   run-tests:
-    needs: changed
     name: 'Build & Test'
-    # if: needs.changed.outputs.should_skip != 'true'
-    runs-on: ${{ matrix.os }}
+    runs-on: ubuntu-latest
 
     timeout-minutes: 30
 
-    strategy:
-      matrix:
-        os: [ ubuntu-latest ]
-        node_version: [ 24 ]
-      fail-fast: false
-
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -61,31 +32,39 @@ jobs:
 
       - uses: ./.github/actions/setup-and-cache
         with:
-          node-version: ${{ matrix.node_version }}
+          node-version: 24
 
-      - uses: browser-actions/setup-chrome@c785b87e244131f27c9f19c1a33e2ead956ab7ce # v1.7.3
+      - uses: browser-actions/setup-chrome@v2
 
-      - name: Install pnpm
-        run: pnpm i
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
 
       - name: Build
         run: pnpm run build
 
       - name: Test
         run: pnpm run test:ci
 
-  test-image-compilation:
-    name: "Test production image compilation"
+  preview-image:
+    name: 'Build preview image'
+    if: ${{ github.event_name == 'pull_request' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Checkout  # required for finding action
         uses: actions/checkout@v6
         with:
           persist-credentials: false
 
-      - uses: ./.github/actions/build-docker-image
+      # Pull requests from forks get a read-only token, so they can only verify
+      # that the image still compiles - they cannot publish a preview image.
+      - name: Build preview image
+        uses: ./.github/actions/build-docker-image
         with:
           platforms: linux/amd64
           docker_file: prod.Dockerfile
-          push: 'false'
+          push: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
           token: ${{ secrets.GITHUB_TOKEN }}
+          extra_tag: pr-${{ github.event.number }}

.github/workflows/release.yaml

@@ -13,6 +13,7 @@ concurrency:
 jobs:
   release-please:
     name: Release
+    if: ${{ github.event_name == 'push' }}
     runs-on: ubuntu-latest
     outputs:
       released: ${{ steps.release.outputs.release_created }}
@@ -33,10 +34,13 @@ jobs:
           echo "Was a release created: ${{ steps.release.outputs.release_created }}"
           echo "New version: ${{ steps.release.outputs.version }}"
 
-  build-prod-image:
-    name: Build and push production Docker image
-    if: ${{ needs.release-please.outputs.released == 'true' }}
+  build-image:
+    # A single build per commit: develop HEAD is always tagged `edge` and picks up
+    # the semver tag as well when release-please cut a release for that same commit.
+    # Manual runs skip release-please entirely and publish a `canary` tag instead.
+    name: Build and push Docker image
     needs: release-please  # Wait until pkg bumped
+    if: ${{ !cancelled() && needs.release-please.result != 'failure' }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -49,34 +53,15 @@ jobs:
 
       - name: check-version
         run: |
-          echo "Version from release please: ${{ needs.release-please.outputs.version }}"
+          echo "Release created: ${{ needs.release-please.outputs.released || 'false' }}"
+          echo "Version from release please: ${{ needs.release-please.outputs.version || '(none)' }}"
 
-      - name: Build production image
+      - name: Build image
         uses: ./.github/actions/build-docker-image
         with:
           platforms: linux/amd64
           docker_file: prod.Dockerfile
           image_tags: ${{ needs.release-please.outputs.version }}
           push: 'true'
           token: ${{ secrets.GITHUB_TOKEN }}
-
-  build-canary-image:
-    name: Build and push canary image
-    if: ${{ github.event_name == 'workflow_dispatch' }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout  # required for finding action
-        uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-
-      - name: Build canary image
-        uses: ./.github/actions/build-docker-image
-        with:
-          platforms: linux/amd64
-          docker_file: prod.Dockerfile
-          push: 'true'
-          token: ${{ secrets.GITHUB_TOKEN }}
+          extra_tag: ${{ github.event_name == 'workflow_dispatch' && 'canary' || 'edge' }}

Dockerfile

@@ -9,18 +9,17 @@ RUN corepack enable
 
 WORKDIR /app
 
-# pnpm-workspace.yaml carries patchedDependencies and allowBuilds (pnpm v11+);
-# without it, patches are silently skipped and build scripts are not run.
+# for patchedDependencies
 COPY pnpm-lock.yaml package.json pnpm-workspace.yaml ./
 COPY patches /app/patches
 
-# Remove once corepack bug fixed https://github.com/nodejs/corepack/issues/612#issuecomment-2629613697
-ENV COREPACK_INTEGRITY_KEYS=0
-
 RUN pnpm install --frozen-lockfile
 
 COPY . .
 
+# always from scratch
+RUN rm -rf .nuxt
+
 ENV NUXT_HOST=0.0.0.0
 ENV NUXT_PORT=3000