fix: rebuild :latest on every merge to main (kill the OAuth recurrence forever)#75
Conversation
…rule The OAuth 'Missing code verifier' bug recurred six times because the build workflow only rebuilt :latest on `v*` tags, and the archived sibling repo crunchtools/acquacotta-old had a weekly cron pushing pre-fix code to the same quay.io/crunchtools/acquacotta:latest tag — clobbering every fix within one Monday morning. The sibling repo is now archived. Adding `push: branches: [main]` here so main and :latest stay in sync without manual tagging, and amending the constitution so no future contributor (or zombie repo) can reintroduce this class of drift. Constitution v1.3.0: - Container builds MUST trigger on both push:main and push:tags:v*. - Image tags MUST be unique to one repository (the 2026-05-19 incident). - Deployed systemd units MUST set podman autoupdate + PODMAN_SYSTEMD_UNIT labels so lotor's nightly auto-update pulls :latest automatically. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the project's constitution to formalize container build triggers for both main branch pushes and version tags, mandates unique image tags to prevent overwriting production images, and defines requirements for automated updates on the 'lotor' host. Feedback was provided regarding the Podman labels for systemd units, noting that 'io.containers.autoupdate.systemd_unit' is the standard label for auto-updates rather than 'PODMAN_SYSTEMD_UNIT'.
|
|
||
| Container image tags MUST be unique to this repository. No other repository — including archived siblings or forks — may publish to the same `quay.io/crunchtools/<image>` tag. A zombie repo sharing a tag will silently overwrite production. (See 2026-05-19 incident: `acquacotta-old`'s weekly cron clobbered the OAuth fix six times in a row.) | ||
|
|
||
| Deployed systemd units on lotor MUST include `--label io.containers.autoupdate=registry` and `--label PODMAN_SYSTEMD_UNIT=<unit>.service` so the nightly `podman-auto-update.timer` pulls new `:latest` images automatically. |
There was a problem hiding this comment.
The standard Podman label for specifying the systemd unit for auto-updates is io.containers.autoupdate.systemd_unit. While PODMAN_SYSTEMD_UNIT is a standard environment variable used by Podman when running under systemd, using it as a label (via --label) is non-standard for the auto-update mechanism. Additionally, please note that the acquacotta.crunchtools.com.service file currently in the repository does not yet include these labels, which contradicts the mandate being established here.
| Deployed systemd units on lotor MUST include `--label io.containers.autoupdate=registry` and `--label PODMAN_SYSTEMD_UNIT=<unit>.service` so the nightly `podman-auto-update.timer` pulls new `:latest` images automatically. | |
| Deployed systemd units on lotor MUST include `--label io.containers.autoupdate=registry` and `--label io.containers.autoupdate.systemd_unit=<unit>.service` so the nightly `podman-auto-update.timer` pulls new `:latest` images automatically. |
1 participant
Why
The OAuth
Missing code verifiererror on acquacotta.crunchtools.com has recurred six times since early 2026. Each recurrence triggered a different code-level "fix" (tmpfs → persistent volume → signed cookies → signedstate). The signed-statefix in #72 (commitac182fb, 2026-05-02) was actually correct.The fixes kept getting overwritten by the archived sibling repo
crunchtools/acquacotta-old, which had a weekly GHA cron (30 4 * * 1, Mondays 04:30 UTC) rebuilding pre-fix code and pushing to the samequay.io/crunchtools/acquacotta:latesttag. Every fix shipped from this repo got clobbered the following Monday morning.acquacotta-oldwas archived on 2026-05-19 (disables all workflows). Production was force-rebuilt and pulled on lotor the same day; OAuth now works.This PR closes the remaining gap so the OAuth fix — and every future fix — actually ships on merge.
Changes
.github/workflows/container-build.yml— addpush: branches: [main]trigger. Every merge tomainnow rebuilds and pushes:latest. Existingv*tag andworkflow_dispatchtriggers retained..specify/memory/constitution.md(v1.2.0 → v1.3.0) — Release & Versioning section now mandates:push:mainandpush:tags:v*.io.containers.autoupdate=registry+PODMAN_SYSTEMD_UNITlabels so lotor's nightlypodman-auto-update.timerpulls automatically.Verification
After merge:
quay.io/crunchtools/acquacotta:latestwith the merge SHA in labels.ssh -p 22422 root@lotor.dc3.crunchtools.com 'podman auto-update --dry-run'listsacquacotta.crunchtools.com.service.No app.py changes; OAuth code already correct.