timothy/ersatztv
1
0
Fork 0
Code Issues 58 Pull Requests 8 Actions Packages Projects Releases 9 Wiki Activity

ci: auto-bump prod chicorytv tag in server-management on v* release #191

Closed
timothy wants to merge 1 commits from ci/auto-bump-prod-compose into main
pull from: ci/auto-bump-prod-compose
merge into: :main
Conversation 1 Commits 1 Files Changed 1
+37
timothy commented 2026-07-08 19:08:45 +02:00
Owner
Copy Link
Copy Source

What

Adds a bump-prod-compose job to docker-build.yml that runs only on v* tags, after build. It:

  1. Clones timothy/server-management via a scoped write deploy key (Actions secret SERVERMGMT_DEPLOY_KEY, provisioned).
  2. Rewrites the pinned ersatztv image tag in docker/bumblebee/stacks/media-servers/compose.yaml to the released ${VERSION}.
  3. Commits + pushes → the existing per-stack Gitea→Komodo webhook redeploys prod, and because the ersatztv service block changed, the #553 pre-deploy hook takes an ErsatzTV PBS backup first.

Why

This is the answer to "auto-update chicorytv when a new build is tagged." It automates the documented "current practice" bump (docs/Docker/ErsatzTV.md) while keeping prod pinned + backed up — deliberately not a floating :prod / watchtower gate (which would skip the pre-deploy backup, per server-management#481 and the ErsatzTV.md "known boundary").

Notes

  • Idempotent: no-ops if the compose already pins the released version.
  • Scoped credential: the deploy key has write access to server-management only (not a broad PAT). Private key stored as the SERVERMGMT_DEPLOY_KEY Actions secret; public key is deploy key id 5 (RW) on server-management.
  • Takes effect on the next v* release after this merges to main (the workflow must be on main/the tag to run). No app changes.

🤖 Generated with Claude Code

## What Adds a `bump-prod-compose` job to `docker-build.yml` that runs **only on `v*` tags**, after `build`. It: 1. Clones `timothy/server-management` via a scoped **write deploy key** (Actions secret `SERVERMGMT_DEPLOY_KEY`, provisioned). 2. Rewrites the pinned `ersatztv` image tag in `docker/bumblebee/stacks/media-servers/compose.yaml` to the released `${VERSION}`. 3. Commits + pushes → the existing per-stack Gitea→Komodo webhook redeploys prod, and because the `ersatztv` service block changed, the **#553 pre-deploy hook takes an ErsatzTV PBS backup first**. ## Why This is the answer to "auto-update chicorytv when a new build is tagged." It **automates the documented "current practice" bump** (`docs/Docker/ErsatzTV.md`) while keeping prod **pinned + backed up** — deliberately **not** a floating `:prod` / watchtower gate (which would skip the pre-deploy backup, per server-management#481 and the ErsatzTV.md "known boundary"). ## Notes - Idempotent: no-ops if the compose already pins the released version. - Scoped credential: the deploy key has write access to **server-management only** (not a broad PAT). Private key stored as the `SERVERMGMT_DEPLOY_KEY` Actions secret; public key is deploy key id 5 (RW) on server-management. - Takes effect on the **next `v*` release after this merges to `main`** (the workflow must be on `main`/the tag to run). No app changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
timothy added 1 commit 2026-07-08 19:08:45 +02:00
ci: auto-bump prod chicorytv tag in server-management on v* release
Build ErsatzTV Image / Build & test (.NET) (pull_request) Successful in 4m33s
Details
Build ErsatzTV Image / EF migration integrity (SQLite + MySql) (pull_request) Successful in 4m48s
Details
Build ErsatzTV Image / Build & push image (amd64) (pull_request) Has been skipped
Details
Build ErsatzTV Image / Bump prod compose tag (server-management) (pull_request) Has been skipped
Details
3d6ac883da 
Adds a bump-prod-compose job that runs only on v* tags, after build. It
clones server-management via a scoped write deploy key (SERVERMGMT_DEPLOY_KEY
secret), rewrites the pinned ersatztv image tag in
docker/bumblebee/stacks/media-servers/compose.yaml to the released version,
and pushes. The existing per-stack Gitea->Komodo webhook then redeploys prod,
and because the ersatztv service block changed, the #553 pre-deploy hook takes
an ErsatzTV PBS backup first.

Automates the documented "current practice" prod bump (docs/Docker/ErsatzTV.md)
while keeping prod pinned + backed up — deliberately NOT a floating :prod /
watchtower gate (server-management#481).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
timothy added the ci-cdpriority: medium labels 2026-07-13 19:26:56 +02:00
timothy commented 2026-07-13 19:37:57 +02:00
Author
Owner
Copy Link
Copy Source

Closing as superseded by the live release path tracked in #335.

Prod now deliberately follows floating :prod. server-management#585 verified that Komodo Global Auto Update invokes the same DeployStack path as a manual deploy and hardened the pre-deploy hook to detect image-digest changes; server-management#589 then wired the exact-candidate prod-copy migration smoke into that fail-closed hook. The backup/smoke safety argument for an immediate version-pin bump therefore no longer applies.

This branch is also stale/conflicted, and its bump job would promote immediately after image build—before Arc 6's exact-candidate authenticated security gate. If immutable GitOps pinning is wanted later, it should be a fresh post-scan promotion design rather than this pre-scan workflow.

Closing as superseded by the live release path tracked in #335. Prod now deliberately follows floating `:prod`. server-management#585 verified that Komodo Global Auto Update invokes the same `DeployStack` path as a manual deploy and hardened the pre-deploy hook to detect image-digest changes; server-management#589 then wired the exact-candidate prod-copy migration smoke into that fail-closed hook. The backup/smoke safety argument for an immediate version-pin bump therefore no longer applies. This branch is also stale/conflicted, and its bump job would promote immediately after image build—before Arc 6's exact-candidate authenticated security gate. If immutable GitOps pinning is wanted later, it should be a fresh post-scan promotion design rather than this pre-scan workflow.
timothy closed this pull request 2026-07-13 19:37:57 +02:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
ad-hoc
One-off / ad-hoc work not tracked by a dedicated issue
 api
REST API / HTTP endpoints
 bug
Something isn't working
 ci-cd
Build, test, deploy pipeline
 content
Channel content / schedules / playlists
 dependencies
Dependency updates (Renovate)
 enhancement
New feature or improvement
 frontend
ChicoryTV React SPA frontend
 in-progress
Claimed by an active session — do not pick up
 jellyfin
Jellyfin tuner / IPTV integration
 parked
Excluded from automatic queue pickup; work only when explicitly selected
 priority: high
priority: low
priority: medium
review
Adversarial review finding
 security
Security / vulnerability fix
No labels ci-cd priority: medium
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
renovate timothy (Timothy)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: timothy/ersatztv#191