fix: give the image build context the docs folder

coilyco-ops commented

2026-08-10 23:21:57 +00:00

Member

Fixes the red main left by the merge of #82.

What failed

Not a linter. Run 83 on the merge commit split two ways:

job test (build, policy-check, vet, test, pre-commit) - success
job publish-echo-image - failure

The Dockerfile runs sirens-echo-policy-check during the build stage, and .dockerignore excluded docs. #82 added a check of docs/access-policy.reference.yaml to that binary, so the image build died on:

access policy docs/access-policy.reference.yaml: read access policy: open docs/access-policy.reference.yaml: no such file or directory

No image was published for b906d83. The deploy repo pins image SHAs, so nothing running changed, but that commit has no artifact. The test job passed because it runs in a full checkout.

The fix

The build context now carries docs, and the build stage copies it, so policy-check validates the reference copy where it always meant to. The runtime image is unchanged: only the build stage takes docs, and the final stage still copies the binary plus the agent and skill roots.

Regression guard

TestPolicyCheckRunsInsideTheImageContext builds the binary and runs it in a fixture holding only the Dockerfile's copy set. Removing docs from that fixture makes it fail with the same error the failed CI run produced, verified both directions.

The fixture mirrors the Dockerfile's COPY list in one slice, so that list and the slice have to move together. That is the tradeoff for not parsing the Dockerfile.

What is not here, and why

An image-build job that builds on pull requests was in this branch and has been removed. It failed on its first run, and this Forgejo predates the Actions log endpoints (/actions/jobs/{id}/logs and /actions/runs/{id}/logs both 404), so the cause is not readable through the API. Diagnosing it blind would keep main red longer than the fix it was riding on.

The runner reasoning behind it still holds and is worth a separate change:

forgejo-runner.yml, backing runs-on: docker and already serving test, has a privileged dind sidecar and DOCKER_HOST, so a build needs a daemon rather than the publisher runner's REGISTRY_TOKEN.
forgejo-runner-build.yml offers docker-build but is scoped org/coilyco-flight-deck, and this repo is in coilyco-gaming, so it is unreachable here.

The likely cause of the failure is that the job declared a container:, so it never saw the runner's DOCKER_HOST. That is a guess, and it belongs in a change that can fail on its own.

Verification

pre-commit run --all-files exit 0, go vet, go test -count=1 -race ./..., and sirens-echo-policy-check all pass.

No Docker daemon was available while writing this, so the Dockerfile change is verified by the fixture rather than by a real build. The first real build is the publish-echo-image job on the merge of this PR, which is also the check that this un-reds main.

Fixes the red `main` left by the merge of #82. ## What failed Not a linter. Run 83 on the merge commit split two ways: * job `test` (build, policy-check, vet, test, pre-commit) - **success** * job `publish-echo-image` - **failure** The Dockerfile runs `sirens-echo-policy-check` during the build stage, and `.dockerignore` excluded `docs`. #82 added a check of `docs/access-policy.reference.yaml` to that binary, so the image build died on: ``` access policy docs/access-policy.reference.yaml: read access policy: open docs/access-policy.reference.yaml: no such file or directory ``` No image was published for `b906d83`. The deploy repo pins image SHAs, so nothing running changed, but that commit has no artifact. The `test` job passed because it runs in a full checkout. ## The fix The build context now carries `docs`, and the build stage copies it, so policy-check validates the reference copy where it always meant to. The runtime image is unchanged: only the build stage takes `docs`, and the final stage still copies the binary plus the agent and skill roots. ## Regression guard `TestPolicyCheckRunsInsideTheImageContext` builds the binary and runs it in a fixture holding only the Dockerfile's copy set. Removing `docs` from that fixture makes it fail with the same error the failed CI run produced, verified both directions. The fixture mirrors the Dockerfile's `COPY` list in one slice, so that list and the slice have to move together. That is the tradeoff for not parsing the Dockerfile. ## What is not here, and why An `image-build` job that builds on pull requests was in this branch and has been removed. It failed on its first run, and this Forgejo predates the Actions log endpoints (`/actions/jobs/{id}/logs` and `/actions/runs/{id}/logs` both 404), so the cause is not readable through the API. Diagnosing it blind would keep `main` red longer than the fix it was riding on. The runner reasoning behind it still holds and is worth a separate change: * `forgejo-runner.yml`, backing `runs-on: docker` and already serving `test`, has a privileged dind sidecar and `DOCKER_HOST`, so a build needs a daemon rather than the publisher runner's `REGISTRY_TOKEN`. * `forgejo-runner-build.yml` offers `docker-build` but is scoped `org/coilyco-flight-deck`, and this repo is in `coilyco-gaming`, so it is unreachable here. The likely cause of the failure is that the job declared a `container:`, so it never saw the runner's `DOCKER_HOST`. That is a guess, and it belongs in a change that can fail on its own. ## Verification `pre-commit run --all-files` exit 0, `go vet`, `go test -count=1 -race ./...`, and `sirens-echo-policy-check` all pass. No Docker daemon was available while writing this, so the Dockerfile change is verified by the fixture rather than by a real build. The first real build is the `publish-echo-image` job on the merge of this PR, which is also the check that this un-reds `main`.

coilyco-ops added 1 commit

2026-08-10 23:21:58 +00:00

fix: keep policy-check inside the image build context

ci / test (pull_request) Successful in 36s

Details

ci / publish-echo-image (pull_request) Has been skipped

Details

2b84b74c52

The image build runs sirens-echo-policy-check, and .dockerignore excludes
docs. Adding an unconditional check of docs/access-policy.reference.yaml
to that binary made the build fail with "no such file or directory", so
the publish-echo-image job failed on the merge of #82 and no image was
published for that commit. The test job passed, because it runs in a full
checkout.

The reference copy is repository documentation, not something the shipped
binary needs, so its validation belongs in the Go test that already
loads it. The binary keeps the opt-in SIRENS_ECHO_ACCESS_POLICY check,
which is unset during an image build.

Adds a regression guard that builds the binary and runs it in a fixture
holding only the Dockerfile's copy set. Reintroducing the bug makes it
fail with the same error CI produced. The publish job only runs on push
to main, so nothing exercised the image build until after merge, and this
moves that gate into the PR run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

coilyco-ops requested review from coilysiren

2026-08-10 23:21:58 +00:00

coilyco-ops added 1 commit

2026-08-10 23:35:00 +00:00

fix: build the image with docs, and build it on pull requests

ci / test (pull_request) Successful in 35s

Details

ci / publish-echo-image (pull_request) Has been skipped

Details

ci / image-build (pull_request) Failing after 2s

Details

40d0191ea6

Replaces the previous approach of dropping the reference-copy check.

The build context now carries docs, and the build stage copies it, so
policy-check validates docs/access-policy.reference.yaml where it always
meant to. The runtime image is unchanged: only the build stage takes
docs, and the final stage still copies the binary plus agent and skill
roots.

Adds an image-build job so a pull request builds the same image without
publishing. Nothing exercised the Docker build context before a merge,
which is why the missing path in #82 reached main. It runs on the general
runner, which supplies a Docker daemon, rather than the publisher runner
that holds REGISTRY_TOKEN. A build needs a daemon, not a credential.

The regression guard keeps its fixture aligned with the Dockerfile's copy
set, now including docs. Removing docs from that fixture makes it fail
with the error the failed CI run produced.

No Docker daemon was available while writing this, so the Dockerfile
change is verified by the fixture rather than by a real build. This pull
request's own image-build job is the first real one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

coilyco-ops changed title from ~~fix: keep policy-check inside the image build context~~ to fix: build the image with docs, and build it on pull requests

2026-08-10 23:35:22 +00:00

coilyco-ops added 1 commit

2026-08-10 23:37:22 +00:00

ci: drop the unproven image-build job from the fix

ci / test (pull_request) Successful in 35s

Details

ci / publish-echo-image (pull_request) Has been skipped

Details

9702bbcc7a

The job failed on its first run and this Forgejo predates the Actions log
endpoints, so the cause is not readable through the API. Diagnosing it
blind would keep main red for longer than the fix it is riding on.

The likely cause is that the job ran with a container, so it never saw
the runner's DOCKER_HOST pointing at the dind sidecar. That is a guess,
and it belongs in a change that can fail on its own without blocking a
fix for main.

The docs-in-build-context fix and its regression guard are unaffected.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

coilyco-ops changed title from ~~fix: build the image with docs, and build it on pull requests~~ to fix: give the image build context the docs folder

2026-08-10 23:37:44 +00:00

coilyco-ops referenced this pull request

2026-08-10 23:38:06 +00:00

ci: build the image on pull requests, not only after a merge to main #91