mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-11-02 03:56:35 +00:00
083be12ddc
* 🛰️ ci: Publish Every Image Through One Native-ARM Workflow #15441 removed QEMU from the dev-branch image build and #15444 fixed the prefix-glob bug it shipped with. Both changes lived in one of five workflows that build images the same way; the other four still emulate arm64 with no layer cache and take 20-40 minutes. Rather than paste the pattern four more times, the build/merge logic moves to a reusable `docker-publish.yml` that every image workflow calls. #15444 is the argument for this: one wrong artifact-name expression would otherwise have needed correcting in five files, and the same prefix hazard exists in all of them (`librechat`/`librechat-api`, `librechat-dev`/`librechat-dev-api`, `lc-dev-staging`/`lc-dev-staging-api`). The shared implementation is the dev-branch one that already ran green, generalised only where callers differ. Callers pass what actually varies: - `images` — the target/file/image_name triples - `tag_suffixes` — newline-separated tags applied in both registries - `checkout_ref` / `build_branch` — main-image-workflow builds `main`, not the dispatch ref `main-image-workflow` and `tag-images` resolve their tags from git history, so each grew a small `resolve-tag(s)` job whose output feeds the publish. That also removes a duplicated `git fetch --tags` that previously ran once per matrix leg. Two details worth noting: - The digest-count assertion now derives its expected value from the `arches` input rather than a hard-coded 2, so the architecture list has a single source of truth shared by the build matrix and the merge guard. - Nothing is interpolated into a `run:` block any more; `build_branch` and the build digest arrive through `env`, so a ref name cannot reach a shell. Net 135 lines lighter, and QEMU no longer appears anywhere in .github/workflows. Workflow names are unchanged, so retry-docker-builds.yml still matches all five. * 🔗 fix: Pin Release Builds to One Commit and Survive Full Re-runs Review findings on the reusable publish workflow. **P1 — every build leg could resolve `main` separately.** `main-image-workflow` passed the symbolic ref `main` as `checkout_ref`, so the four build jobs each resolved it at whatever moment they were scheduled. If `main` advanced in between, the amd64 and arm64 halves of a release — or the API and application images — could be built from different commits and published under the same release and `latest` tags. `resolve-tag` now exports the commit it resolved the tag from, and the publish pins to that SHA. The single-job workflow this replaced checked out once, so this was a regression introduced by the split. `docker-publish` likewise now falls back to `github.sha` rather than passing an empty `ref` to `actions/checkout`, so callers that omit `checkout_ref` also get an immutable commit instead of relying on checkout's empty-ref handling. **P2 — digest artifacts on a full re-run.** `upload-artifact@v4` will not upload over an existing artifact name, and a full re-run keeps the run id, so a retry would fail before the merge could run. The suggested fix was to qualify the artifact name with `run_attempt`, but `retry-docker-builds` picks its endpoint by conclusion: `rerun` only when a job was cancelled, and `rerun-failed-jobs` otherwise. Under the latter the merge re-runs alone and must still find digests uploaded by the *previous* attempt's build legs, which a run_attempt-qualified name would hide — precisely the shape of the #15444 failure, where the builds passed and only the merge failed. `overwrite: true` resolves the conflict while keeping names stable across attempts. **Unreachable error branch.** `LATEST_TAG=$(git tag ... | grep ... | head -1)` under `set -euo pipefail` exits on grep's non-match, so the "No stable v<semver> tag found" message could never print. Added `|| true`, matching what `tag-images` already does. Pre-existing, carried over verbatim in the split. |
||
|---|---|---|
| .. | ||
| ISSUE_TEMPLATE | ||
| scripts | ||
| workflows | ||
| CODE_OF_CONDUCT.md | ||
| configuration-release.json | ||
| configuration-unreleased.json | ||
| CONTRIBUTING.md | ||
| FUNDING.yml | ||
| playwright.yml | ||
| pull_request_template.md | ||
| SECURITY.md | ||