From f21f553d4908f0097b752aa8293e7ef02f6330fe Mon Sep 17 00:00:00 2001 From: Emi Griffith Date: Wed, 22 Jul 2026 22:37:43 -0700 Subject: [PATCH 1/3] build.yml: run the hermetic suite inside the built image (promote dev's port to main, matching the split repos' dev->main promotion) --- .forgejo/workflows/build.yml | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml index 10da8c3..7b8e950 100644 --- a/.forgejo/workflows/build.yml +++ b/.forgejo/workflows/build.yml @@ -1,6 +1,6 @@ name: Build check (reusable) -# Build-only `docker build` sanity check for ONE app domain, reused via +# `docker build` + in-image test check for ONE app domain, reused via # `uses:` by pr-build.yml and the deploy-dev workflows -- the monorepo port of # each app repo's build.yml. Still deliberately NOT a live boot+healthz check: # that was tried in the split repos and repeatedly hit this runner's own @@ -34,3 +34,25 @@ jobs: - name: Build run: docker build -t thermograph-${{ inputs.domain }}:ci ${{ inputs.domain }}/ + + # Run the hermetic test tier INSIDE the image we just built (each image + # ships tests/ + every runtime dep via COPY . /app/): the exact + # interpreter/deps that ship, none of the runner-environment quirks that + # sank the old host-side boot check. Backend runs its full (hermetic) + # suite; frontend runs only its unit tier -- its integration tier + # (frontend/tests/integration/, needs a live backend container) stays a + # local `make`/scripts concern, see frontend/scripts/backend-for-tests.sh. + # requirements-dev only layers pytest on top, so the install is tiny. + # -u 0: the images' default user can't write to site-packages. + # --entrypoint sh: backend's entrypoint is alembic-migrate + uvicorn -- + # without the override the test command is swallowed as entrypoint args + # and the container just boots the server forever (harmless no-op for + # frontend, which has no entrypoint). unset THERMOGRAPH_BASE: the images + # bake the prod root-mount (/), which moves every route off the + # /thermograph prefix the tests are written against. + - name: Run tests in the built image + run: | + target=tests + if [ "${{ inputs.domain }}" = "frontend" ]; then target=tests/unit; fi + docker run --rm -u 0 --entrypoint sh thermograph-${{ inputs.domain }}:ci \ + -c "unset THERMOGRAPH_BASE; pip install -q --no-cache-dir pytest==8.4.1 && python -m pytest $target -q" From e5a4b25f7111662be0d15512a9e3e8cc955f2a22 Mon Sep 17 00:00:00 2001 From: Emi Griffith Date: Thu, 23 Jul 2026 03:18:03 -0700 Subject: [PATCH 2/3] backend: monorepo cutover marker (path-filter probe) --- backend/README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/backend/README.md b/backend/README.md index ce8ab21..73c58de 100644 --- a/backend/README.md +++ b/backend/README.md @@ -102,3 +102,5 @@ THERMOGRAPH_DISCORD_APP_ID=... THERMOGRAPH_DISCORD_BOT_TOKEN=... \ ``` Global command changes can take up to an hour to propagate. + + From 0ed7e894016dfca088cbeffcf2230bbd308f43e5 Mon Sep 17 00:00:00 2001 From: Emi Griffith Date: Thu, 23 Jul 2026 03:34:25 -0700 Subject: [PATCH 3/3] stack: fix bind-mount paths for the monorepo host layout The cutover moved the host checkout's deploy tree to /opt/thermograph/infra/deploy/, but the stack file's absolute bind sources (db init, env-entrypoint.sh, autoscale.sh) still pointed at the old /opt/thermograph/deploy/ -- a service update kept the stale mounts and new tasks failed with 'bind source path does not exist'. --- infra/deploy/stack/thermograph-stack.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/infra/deploy/stack/thermograph-stack.yml b/infra/deploy/stack/thermograph-stack.yml index c8bdd51..b34f77b 100644 --- a/infra/deploy/stack/thermograph-stack.yml +++ b/infra/deploy/stack/thermograph-stack.yml @@ -44,7 +44,7 @@ services: DB_MEMORY: ${DB_MEMORY:-16g} volumes: - pgdata:/var/lib/postgresql - - /opt/thermograph/deploy/db/init:/docker-entrypoint-initdb.d:ro + - /opt/thermograph/infra/deploy/db/init:/docker-entrypoint-initdb.d:ro networks: - internal healthcheck: @@ -85,7 +85,7 @@ services: volumes: - appdata:/state - applogs:/app/logs - - /opt/thermograph/deploy/stack/env-entrypoint.sh:/host/env-entrypoint.sh:ro + - /opt/thermograph/infra/deploy/stack/env-entrypoint.sh:/host/env-entrypoint.sh:ro - /etc/thermograph/stack.env:/host/thermograph.env:ro networks: - internal @@ -124,7 +124,7 @@ services: volumes: - appdata:/state - applogs:/app/logs - - /opt/thermograph/deploy/stack/env-entrypoint.sh:/host/env-entrypoint.sh:ro + - /opt/thermograph/infra/deploy/stack/env-entrypoint.sh:/host/env-entrypoint.sh:ro - /etc/thermograph/stack.env:/host/thermograph.env:ro networks: - internal @@ -147,7 +147,7 @@ services: THERMOGRAPH_SERVICE_ROLE: frontend THERMOGRAPH_API_BASE_INTERNAL: http://web:8137 volumes: - - /opt/thermograph/deploy/stack/env-entrypoint.sh:/host/env-entrypoint.sh:ro + - /opt/thermograph/infra/deploy/stack/env-entrypoint.sh:/host/env-entrypoint.sh:ro - /etc/thermograph/stack.env:/host/thermograph.env:ro networks: - internal @@ -186,7 +186,7 @@ services: COOLDOWN_SECONDS: ${COOLDOWN_SECONDS:-180} volumes: - /var/run/docker.sock:/var/run/docker.sock - - /opt/thermograph/deploy/stack/autoscale.sh:/host/autoscale.sh:ro + - /opt/thermograph/infra/deploy/stack/autoscale.sh:/host/autoscale.sh:ro networks: - internal deploy: