normalize image naming: fhirworx/<svc>:<sha> everywhere, registry prefix only in push commands

2026-02-28 23:36:48 -05:00
parent 9776915b50
commit 4664c7fe14
7 changed files with 113 additions and 52 deletions
--- a/.dockerignore
+++ b/.dockerignore
@@ -0,0 +1,24 @@
+# Docs Dockerfile uses repo root context — exclude heavy/sensitive dirs
+zotero/
+notebooks/
+.git/
+.env
+*.duckdb
+*.duckdb.wal
+__pycache__/
+dist/
+*.egg-info/
+logs/
+tuva/
+dev/
+tests/
+grafana/
+prometheus/
+loki/
+trino/
+traefik/
+nginx/
+gitea/
+css/
+.woodpecker/
+.claude/
--- a/.woodpecker/deploy.yml
+++ b/.woodpecker/deploy.yml
@@ -3,6 +3,14 @@
 # builds, scans, and pushes container images, then updates the
 # host working copy and restarts all changed services.
 # Only runs on pushes to main (i.e. after PR merge).
+#
+# Image naming:
+#   fhirworx/<service>:<short-sha>      (local tag, used by compose)
+#   localhost:3000/fhirworx/<service>:*  (registry push only)
+#
+# The deploy step writes COMMIT_SHA=<short-sha> into .env so
+# compose.yml resolves fhirworx/<svc>:${COMMIT_SHA:-latest} to
+# the exact image just built.

 when:
  - event: push
@@ -13,7 +21,6 @@ steps:
  - name: build-package
    image: ghcr.io/astral-sh/uv:python3.13-bookworm-slim
    commands:
-      # Stamp a unique version using Woodpecker pipeline number
      - BASE=$(grep '^version' pyproject.toml | head -1 | sed 's/.*"\(.*\)"/\1/')
      - uv version "$BASE.dev${CI_PIPELINE_NUMBER}" --no-sync
      - uv build --out-dir dist/
@@ -37,8 +44,9 @@ steps:
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    commands:
-      - docker build -t localhost:3000/homelab/notebooks:${CI_COMMIT_SHA:0:8} ./notebooks
-      - docker tag localhost:3000/homelab/notebooks:${CI_COMMIT_SHA:0:8} localhost:3000/homelab/notebooks:latest
+      - TAG=${CI_COMMIT_SHA:0:8}
+      - docker build -t fhirworx/notebooks:$TAG ./notebooks
+      - docker tag fhirworx/notebooks:$TAG fhirworx/notebooks:latest
    when:
      - path: "notebooks/**"

@@ -47,8 +55,9 @@ steps:
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    commands:
-      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format table localhost:3000/homelab/notebooks:${CI_COMMIT_SHA:0:8}
-      - trivy image --severity HIGH,CRITICAL --format json -o notebooks-scan.json localhost:3000/homelab/notebooks:${CI_COMMIT_SHA:0:8}
+      - TAG=${CI_COMMIT_SHA:0:8}
+      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format table fhirworx/notebooks:$TAG
+      - trivy image --severity HIGH,CRITICAL --format json -o notebooks-scan.json fhirworx/notebooks:$TAG
    depends_on:
      - build-notebooks
    when:
@@ -64,9 +73,12 @@ steps:
      REGISTRY_PASS:
        from_secret: registry_pass
    commands:
+      - TAG=${CI_COMMIT_SHA:0:8}
      - echo "$REGISTRY_PASS" | docker login localhost:3000 -u "$REGISTRY_USER" --password-stdin
-      - docker push localhost:3000/homelab/notebooks:${CI_COMMIT_SHA:0:8}
-      - docker push localhost:3000/homelab/notebooks:latest
+      - docker tag fhirworx/notebooks:$TAG localhost:3000/fhirworx/notebooks:$TAG
+      - docker push localhost:3000/fhirworx/notebooks:$TAG
+      - docker tag fhirworx/notebooks:latest localhost:3000/fhirworx/notebooks:latest
+      - docker push localhost:3000/fhirworx/notebooks:latest
    depends_on:
      - scan-notebooks
    when:
@@ -78,8 +90,9 @@ steps:
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    commands:
-      - docker build -t localhost:3000/homelab/zotero:${CI_COMMIT_SHA:0:8} ./zotero
-      - docker tag localhost:3000/homelab/zotero:${CI_COMMIT_SHA:0:8} localhost:3000/homelab/zotero:latest
+      - TAG=${CI_COMMIT_SHA:0:8}
+      - docker build -t fhirworx/zotero:$TAG ./zotero
+      - docker tag fhirworx/zotero:$TAG fhirworx/zotero:latest
    when:
      - path: "zotero/**"

@@ -88,8 +101,9 @@ steps:
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    commands:
-      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format table localhost:3000/homelab/zotero:${CI_COMMIT_SHA:0:8}
-      - trivy image --severity HIGH,CRITICAL --format json -o zotero-scan.json localhost:3000/homelab/zotero:${CI_COMMIT_SHA:0:8}
+      - TAG=${CI_COMMIT_SHA:0:8}
+      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format table fhirworx/zotero:$TAG
+      - trivy image --severity HIGH,CRITICAL --format json -o zotero-scan.json fhirworx/zotero:$TAG
    depends_on:
      - build-zotero
    when:
@@ -105,9 +119,12 @@ steps:
      REGISTRY_PASS:
        from_secret: registry_pass
    commands:
+      - TAG=${CI_COMMIT_SHA:0:8}
      - echo "$REGISTRY_PASS" | docker login localhost:3000 -u "$REGISTRY_USER" --password-stdin
-      - docker push localhost:3000/homelab/zotero:${CI_COMMIT_SHA:0:8}
-      - docker push localhost:3000/homelab/zotero:latest
+      - docker tag fhirworx/zotero:$TAG localhost:3000/fhirworx/zotero:$TAG
+      - docker push localhost:3000/fhirworx/zotero:$TAG
+      - docker tag fhirworx/zotero:latest localhost:3000/fhirworx/zotero:latest
+      - docker push localhost:3000/fhirworx/zotero:latest
    depends_on:
      - scan-zotero
    when:
@@ -119,8 +136,9 @@ steps:
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    commands:
-      - docker build -t localhost:3000/homelab/docs:${CI_COMMIT_SHA:0:8} -f docs/Dockerfile .
-      - docker tag localhost:3000/homelab/docs:${CI_COMMIT_SHA:0:8} localhost:3000/homelab/docs:latest
+      - TAG=${CI_COMMIT_SHA:0:8}
+      - docker build -t fhirworx/docs:$TAG -f docs/Dockerfile .
+      - docker tag fhirworx/docs:$TAG fhirworx/docs:latest

  - name: push-docs
    image: docker:cli
@@ -132,9 +150,12 @@ steps:
      REGISTRY_PASS:
        from_secret: registry_pass
    commands:
+      - TAG=${CI_COMMIT_SHA:0:8}
      - echo "$REGISTRY_PASS" | docker login localhost:3000 -u "$REGISTRY_USER" --password-stdin
-      - docker push localhost:3000/homelab/docs:${CI_COMMIT_SHA:0:8}
-      - docker push localhost:3000/homelab/docs:latest
+      - docker tag fhirworx/docs:$TAG localhost:3000/fhirworx/docs:$TAG
+      - docker push localhost:3000/fhirworx/docs:$TAG
+      - docker tag fhirworx/docs:latest localhost:3000/fhirworx/docs:latest
+      - docker push localhost:3000/fhirworx/docs:latest
    depends_on:
      - build-docs

@@ -174,25 +195,19 @@ steps:
      - path: "zotero/**"

  # ── Deploy: pull latest code + restart services ────────────────
-  # Runs AFTER all image builds/pushes complete.  Updates the host
-  # repo to the commit that triggered this pipeline, pulls any new
-  # registry images, and restarts changed services.
  - name: deploy
    image: docker:cli
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
      - /home/kert/stack:/home/kert/stack
    commands:
-      # Install git so we can update the host working copy
      - apk add --no-cache git
      - cd /home/kert/stack
-      # Fetch the exact commit via HTTP (public repo, intrastack)
-      # and hard-reset the deploy dir to match it.  Untracked files
-      # (duckdb, zotero data, etc.) are untouched.
      - git fetch http://gitea:3000/homelab/stack.git main
      - git reset --hard FETCH_HEAD
-      # Pull new images from registry, restart changed services
-      - docker compose pull --ignore-buildable
+      # Pin compose to the exact images just built
+      - TAG=${CI_COMMIT_SHA:0:8}
+      - sed -i "s/^COMMIT_SHA=.*/COMMIT_SHA=$TAG/" .env 2>/dev/null || echo "COMMIT_SHA=$TAG" >> .env
      - docker compose up -d --remove-orphans
    depends_on:
      - publish-package
--- a/.woodpecker/infra-ci.yml
+++ b/.woodpecker/infra-ci.yml
@@ -28,8 +28,8 @@ steps:
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    commands:
-      - docker build -t ci-test/notebooks:${CI_COMMIT_SHA:0:8} ./notebooks
-      - docker rmi ci-test/notebooks:${CI_COMMIT_SHA:0:8}
+      - docker build -t ci-test/fhirworx/notebooks:${CI_COMMIT_SHA:0:8} ./notebooks
+      - docker rmi ci-test/fhirworx/notebooks:${CI_COMMIT_SHA:0:8}
    depends_on:
      - hadolint-notebooks
    when:
@@ -48,8 +48,8 @@ steps:
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    commands:
-      - docker build -t ci-test/zotero:${CI_COMMIT_SHA:0:8} ./zotero
-      - docker rmi ci-test/zotero:${CI_COMMIT_SHA:0:8}
+      - docker build -t ci-test/fhirworx/zotero:${CI_COMMIT_SHA:0:8} ./zotero
+      - docker rmi ci-test/fhirworx/zotero:${CI_COMMIT_SHA:0:8}
    depends_on:
      - hadolint-zotero
    when:
@@ -68,8 +68,8 @@ steps:
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    commands:
-      - docker build -t ci-test/docs:${CI_COMMIT_SHA:0:8} -f docs/Dockerfile .
-      - docker rmi ci-test/docs:${CI_COMMIT_SHA:0:8}
+      - docker build -t ci-test/fhirworx/docs:${CI_COMMIT_SHA:0:8} -f docs/Dockerfile .
+      - docker rmi ci-test/fhirworx/docs:${CI_COMMIT_SHA:0:8}
    depends_on:
      - hadolint-docs
    when:
--- a/.woodpecker/rebuild-all.yml
+++ b/.woodpecker/rebuild-all.yml
@@ -7,30 +7,41 @@ steps:
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    commands:
-      - docker build -t localhost:3000/homelab/notebooks:${CI_COMMIT_SHA:0:8} ./notebooks
-      - docker tag localhost:3000/homelab/notebooks:${CI_COMMIT_SHA:0:8} localhost:3000/homelab/notebooks:latest
+      - TAG=${CI_COMMIT_SHA:0:8}
+      - docker build -t fhirworx/notebooks:$TAG ./notebooks
+      - docker tag fhirworx/notebooks:$TAG fhirworx/notebooks:latest

  - name: build-zotero
    image: docker:cli
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    commands:
-      - docker build -t localhost:3000/homelab/zotero:${CI_COMMIT_SHA:0:8} ./zotero
-      - docker tag localhost:3000/homelab/zotero:${CI_COMMIT_SHA:0:8} localhost:3000/homelab/zotero:latest
+      - TAG=${CI_COMMIT_SHA:0:8}
+      - docker build -t fhirworx/zotero:$TAG ./zotero
+      - docker tag fhirworx/zotero:$TAG fhirworx/zotero:latest
+
+  - name: build-docs
+    image: docker:cli
+    volumes:
+      - /run/user/1000/docker.sock:/var/run/docker.sock
+    commands:
+      - TAG=${CI_COMMIT_SHA:0:8}
+      - docker build -t fhirworx/docs:$TAG -f docs/Dockerfile .
+      - docker tag fhirworx/docs:$TAG fhirworx/docs:latest

  - name: scan-notebooks
    image: aquasec/trivy:latest
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    commands:
-      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format table localhost:3000/homelab/notebooks:${CI_COMMIT_SHA:0:8}
+      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format table fhirworx/notebooks:${CI_COMMIT_SHA:0:8}

  - name: scan-zotero
    image: aquasec/trivy:latest
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    commands:
-      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format table localhost:3000/homelab/zotero:${CI_COMMIT_SHA:0:8}
+      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format table fhirworx/zotero:${CI_COMMIT_SHA:0:8}

  - name: push-images
    image: docker:cli
@@ -42,16 +53,22 @@ steps:
      REGISTRY_PASS:
        from_secret: registry_pass
    commands:
+      - TAG=${CI_COMMIT_SHA:0:8}
      - echo "$REGISTRY_PASS" | docker login localhost:3000 -u "$REGISTRY_USER" --password-stdin
-      - docker push localhost:3000/homelab/notebooks:${CI_COMMIT_SHA:0:8}
-      - docker push localhost:3000/homelab/notebooks:latest
-      - docker push localhost:3000/homelab/zotero:${CI_COMMIT_SHA:0:8}
-      - docker push localhost:3000/homelab/zotero:latest
+      - for SVC in notebooks zotero docs; do
+      -   docker tag fhirworx/$SVC:$TAG localhost:3000/fhirworx/$SVC:$TAG
+      -   docker push localhost:3000/fhirworx/$SVC:$TAG
+      -   docker tag fhirworx/$SVC:latest localhost:3000/fhirworx/$SVC:latest
+      -   docker push localhost:3000/fhirworx/$SVC:latest
+      - done

  - name: deploy
    image: docker:cli
    volumes:
      - /run/user/1000/docker.sock:/var/run/docker.sock
+      - /home/kert/stack:/home/kert/stack
    commands:
-      - docker compose pull
-      - docker compose up -d
+      - cd /home/kert/stack
+      - TAG=${CI_COMMIT_SHA:0:8}
+      - sed -i "s/^COMMIT_SHA=.*/COMMIT_SHA=$TAG/" .env 2>/dev/null || echo "COMMIT_SHA=$TAG" >> .env
+      - docker compose up -d --remove-orphans
--- a/compose.yml
+++ b/compose.yml
@@ -44,7 +44,7 @@ services:
    restart: unless-stopped

  rustfs:
-    image: localhost:3000/homelab/rustfs:latest
+    image: fhirworx/rustfs:${COMMIT_SHA:-latest}
    container_name: rustfs
    user: "10001:10001"
    networks:
@@ -61,7 +61,7 @@ services:
    restart: unless-stopped

  postgres:
-    image: localhost:3000/homelab/postgresql:latest
+    image: fhirworx/postgresql:${COMMIT_SHA:-latest}
    container_name: postgres
    networks:
      - storage
@@ -176,7 +176,7 @@ services:
    restart: unless-stopped

  notebooks:
-    image: localhost:3000/homelab/notebooks:latest
+    image: fhirworx/notebooks:${COMMIT_SHA:-latest}
    container_name: notebooks
    networks:
      - gateway
@@ -201,7 +201,7 @@ services:
    restart: unless-stopped

  zotero:
-    image: localhost:3000/homelab/zotero:latest
+    image: fhirworx/zotero:${COMMIT_SHA:-latest}
    container_name: zotero
    networks:
      - gateway
@@ -341,7 +341,7 @@ services:
    restart: unless-stopped

  docs:
-    image: localhost:3000/homelab/docs:latest
+    image: fhirworx/docs:${COMMIT_SHA:-latest}
    container_name: docs
    networks:
      - gateway
--- a/docs/Dockerfile
+++ b/docs/Dockerfile
@@ -10,9 +10,9 @@ COPY docs/scripts/ docs/scripts/
 # Extract API docs via griffe (pure AST, no imports)
 RUN uv run --with griffe python docs/scripts/extract_docs.py

-# Export bibliography (needs bib deps from src/)
-COPY data/bib.sqlite data/bib.sqlite
+# Export bibliography (gracefully handles missing bib.sqlite)
 COPY pyproject.toml .
+COPY data/bib.sqlit[e] data/
 RUN uv run python docs/scripts/export_library.py


@@ -23,7 +23,8 @@ WORKDIR /docs

 # Install dependencies
 COPY docs/package.json docs/package-lock.json* ./
-RUN npm ci
+# hadolint ignore=DL3016
+RUN npm install

 # Copy Docusaurus config and source
 COPY docs/docusaurus.config.js docs/sidebars.js docs/babel.config.js docs/tsconfig.json ./
--- a/docs/docusaurus.config.js
+++ b/docs/docusaurus.config.js
@@ -10,6 +10,10 @@ const config = {
  onBrokenLinks: "warn",
  onBrokenMarkdownLinks: "warn",

+  markdown: {
+    format: "detect",
+  },
+
  i18n: {
    defaultLocale: "en",
    locales: ["en"],