Release workflow#1018
Merged
Merged
Conversation
A GitHub Actions workflow that does the following: - checks for passing CI - checks for new version (idempotent) - pushes new GitHub tag - builds base and head containers with precise Alyx version - tags and pushes both containers to DockerHub
This was referenced Jul 21, 2026
The release workflow builds the docker image from deploy/docker, but the apache config and settings there lacked the mitigations already live in the iblsre-built image. Bring them to parity so a CI release does not regress: - WSGIDaemonProcess request-timeout=300 maximum-requests=1000 (reap runaway workers) - pipe apache error/access logs through rotatelogs (128M x5) - django.log RotatingFileHandler (4M x5) instead of unbounded FileHandler Pagination cap and a2enmod ssl were already present here.
Two gaps that would break a CI-built image deployed via the production compose: - Add scripts/alyx_issue_ssl.sh (+ COPY into the image). The deploy compose command runs /usr/local/bin/alyx_issue_ssl.sh at container start; it was only present in the iblsre-built image. - Serve uploaded media from /uploaded (Alias + dir + mkdir) to match MEDIA_URL, MEDIA_ROOT and the compose volume mount; it was inconsistently set to /media.
oliche
reviewed
Jul 22, 2026
oliche
reviewed
Jul 22, 2026
The task cleanup test fails occasionally due to assigning a session to a random task (ordering done by pk) and saving outside of datetime mock, some times causing the task to update with a true datetime. This is fixed by saving the object within the mock context manager
Two deployment use cases under deploy/: - app/: production stack (apache + postgres) with the single docker-compose.yaml entry point, ported from iblsre for parity, plus the docker build context. - editable/: postgres-only container for local editable installs. Add deploy/app/docker-compose.yaml + template.env as the single source of truth for the production compose (server-agnostic via env). Update CI workflows and docs to the new deploy/app/docker and deploy/editable paths; point getting-started at the app compose.
release.yml now only cuts the git tag + GitHub release on a version bump, then dispatches build-image.yml for that tag. Image building moves to build-image.yml, triggered on tag push (manual rebuilds) or workflow_dispatch (the release chain). A tag pushed by GITHUB_TOKEN does not trigger a push-tags workflow, so release.yml dispatches the build explicitly (workflow_dispatch is exempt) — no PAT required.
The base production compose is the generic, server-agnostic source of truth. The iblalyx-specific `pip install -r /home/iblalyx/requirements.txt` is layered downstream via an iblsre override or an IBL-specific image built on this one.
Remove the iblalyx and ibl_reports mounts (and the IBLALYX_ROOT env hint) so the base production compose is fully generic. Like the requirements install, the iblalyx volumes are re-added downstream via the iblsre override or an IBL-specific image.
Port the deploy-web smoke test into alyx (deploy/app/test/test-deploy-web.yaml): brings the production stack up in a temp dir with test env, asserts HTTP 200, apache running, log rotation and DB connectivity, then tears down. No iblalyx needed now that the base image/compose are self-contained. build-image.yml now builds base + main locally, runs the smoke test, and pushes to Docker Hub only if it passes. Plain docker build (native amd64) lets the main image FROM the local base without pushing first, so a failing image never ships.
Found via a local build+run of the C3 smoke test; several latent issues: - Adopt iblsre's apache config set (000-default.conf + alyx-common.conf + apache2.conf + options-ssl-apache.conf), replacing the divergent 000-default-conf-alyx/apache-conf-alyx. The old config redirected all :80 to https with no localhost serve path, so localhost (ssl disabled) never served. - Base image on Ubuntu 25.04 (system Python 3.13) so libapache2-mod-wsgi-py3 matches the venv, fixing a mod_wsgi 3.10 vs venv 3.13 skew that made the WSGI app fail to import 'django'. Drop the deadsnakes PPA; use uv for the venv and dependency installs (base + head images). - Fix the startup command: complete alyx_issue_ssl.sh (ssl setup) before apache starts (&& not &), and drop the stray '664' arg that made chown exit non-zero and block apache from starting. - Drop the logrotate step from the smoke test: this image rotates logs via apache's piped rotatelogs, so logrotate is not the mechanism in use.
alyx is the source of truth for the image build (deploy/app/docker) and the base compose (deploy/app/docker-compose.yaml); iblsre owns deploy orchestration only. Describe the release.yml -> build-image.yml flow (bump __version__ -> tag -> build -> smoke test -> push) with the manual buildx build kept as a fallback.
Restrict the push:tags trigger to version tags (N.N.N) and dev* tags, so stray tags no longer trigger a build (tag events can't be branch-scoped, so this is done by tag name). A dev* tag builds + smoke-tests the image but skips Docker Hub login/push, so the full pipeline can be exercised on release_workflow before it reaches master without overwriting the production latest tag. Real version tags still build + push.
oliche
approved these changes
Jul 23, 2026
oliche
approved these changes
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
resolves #1017