Polish repository for open-source and Docker Hub - #26
Closed
mainman94 wants to merge 42 commits into
Closed
Conversation
Configure Renovate
…n-7.x Update docker/build-push-action action to v7
Update Node.js to v24
…n-4.x Update docker/setup-qemu-action action to v4
…ion-4.x Update docker/setup-buildx-action action to v4
Update docker/login-action action to v4
…-commit-action-7.x Update stefanzweifel/git-auto-commit-action action to v7
…escription-5.x Update peter-evans/dockerhub-description action to v5
- strapi-debian/Dockerfile: resolve leftover merge-conflict markers from a stash pop that left the file uncommitted-broken. - Both Dockerfiles: move ENV STRAPI_VERSION after the first FROM (ENV before any FROM makes buildx fail with "no build stage in current context"), and re-declare STRAPI_VERSION as ARG in each stage that needs it. - Both Dockerfiles: pin NODE_VERSION default to 24 — better-sqlite3@12.8.0 doesn't support Node 26 yet. - Both docker-entrypoint.sh: run Strapi via the local project binary (./node_modules/.bin/strapi) instead of the globally-installed CLI. The global install's own node_modules tree doesn't contain the project's DB driver (pg, mysql, ...), so any non-sqlite database crash-loops the container with "Cannot find module 'pg'". - publish-docker-images.yml: pull the Docker Hub token from OpenBao via GitHub Actions OIDC (hashicorp/vault-action) instead of static repo secrets, bump actions/checkout to v4, fix the deprecated ::set-output syntax, and align alpine tags to alpine-<version> to match what's already published under dockerha08/strapi. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012yUP41cmFcfAKRc1qxCod4
Fix broken Docker builds, bootstrap loop, and DB driver resolution
…-4.x Update hashicorp/vault-action action to v4
- auto-check-new-releases.yml: fetch PAT via GitHub Actions OIDC (homelab/data/prod/github, key PAT) using the same gha-docker-strapi role as the publish workflow, instead of a static secrets.PAT repo secret. Also bumps checkout to v4 and fixes the deprecated ::set-output syntax. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012yUP41cmFcfAKRc1qxCod4
Pull release-check PAT from OpenBao instead of a repo secret
Both Dockerfiles' builder stage ran `npm install -g yarn @strapi/strapi`, but node:24-alpine (and the debian slim variant) already ships a yarn binary/shim at /usr/local/bin/yarn via corepack. npm's global install refuses to overwrite it (EEXIST), which broke multi-arch builds — reproduced on linux/arm64. --force lets npm replace the shim with a real yarn install, which docker-entrypoint.sh depends on for `yarn install --prod`. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012yUP41cmFcfAKRc1qxCod4
Fix npm install -g yarn conflict with node:24-alpine's bundled shim
Track node:24-alpine and node:24-trixie-slim digests in release-versions/, refreshed by the same daily check as the strapi version. Since publish-docker-images.yml already triggers on any release-versions/* push, a node base image update now cascades into a new build/push exactly like a strapi release does. Closes #4 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012yUP41cmFcfAKRc1qxCod4
vault.hauptmann.dev sits behind Cloudflare Bot Fight Mode, which challenges GitHub Actions runners and breaks the OIDC vault-action fetch in both workflows. Falls back to plain repo secrets (PAT, DOCKER_TOKEN) instead of carving a WAF exception. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012yUP41cmFcfAKRc1qxCod4
Rebuild images when node base image updates, not just strapi version
dockerha08/strapi already has debian-slim-<version>/debian-slim-latest tags (pushed manually), not <version>/latest. Match the workflow to that. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012yUP41cmFcfAKRc1qxCod4
Build pipeline was slow: alpine and debian ran sequentially in one job (each doing a build-for-smoke-test then a full multi-arch build-and-push, so effectively 4 builds back to back), with no cache reuse between any of them. - Matrix over [debian, alpine] so both variants build/push in parallel jobs instead of one after another. - cache-from/cache-to (GHA backend, one scope per variant) so the smoke-test build and the push build share layers, and repeated workflow runs reuse the apk/npm-heavy layers instead of rebuilding from scratch. - Docker Hub description + GitHub release moved to a separate `finalize` job that runs once after both matrix legs, instead of duplicating them per variant. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012yUP41cmFcfAKRc1qxCod4
Build each image for amd64 only, load it locally, boot with sqlite and watch for a clean start vs. the failure signatures this repo has actually hit (EACCES, missing DB driver module, npm errors). Only push the real multi-arch build if that passes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012yUP41cmFcfAKRc1qxCod4
Two real bugs the new smoke test caught on first run: - create-strapi-app writes DATABASE_FILENAME= (empty) into .env for every DB client, including sqlite. Strapi's env() helper treats an explicitly empty var as set, so the sqlite default (.tmp/data.db) never applies and better-sqlite3 fails with a bare "unable to open database file". Strip the empty line. - Recent npm blocks install/postinstall scripts by default. This silently skips better-sqlite3's native binding fetch (and esbuild/@swc/core, used for TS compilation regardless of DB client) — not sqlite-specific, would likely also break fresh postgres bootstraps. Approve and rebuild once right after scaffolding. Also added --skip-cloud --non-interactive to create-strapi-app: without them it prompts an interactive Strapi Cloud login and crashes with no TTY (readline closed). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012yUP41cmFcfAKRc1qxCod4
Smoke-test images pre-push, fix sqlite bootstrap, speed up pipeline
Top-level README was still the unmodified naskio upstream copy (v4, node:18, naskio/strapi image, mongo as a supported DB client — dropped in v5). Per-image READMEs claimed Node 26 (default is 24) and a pinned appuser UID 1000 (not pinned; debian variant runs as root, not appuser, at all). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012yUP41cmFcfAKRc1qxCod4
No way to force a rebuild/push without touching release-versions/*. workflow_dispatch lets us fire it on demand (e.g. to pick up entrypoint or Dockerfile fixes that don't bump the strapi version). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012yUP41cmFcfAKRc1qxCod4
Update READMEs to match this fork's actual state
Allow manually triggering the publish workflow
Fix production admin panel build
Increase production smoke test timeout
Add OCI image labels to both variants, fed by new VCS_REF and BUILD_DATE build args that the publish workflow fills from the commit SHA and build time. Published images now also carry an SBOM and max-mode provenance attestation. Add the OSS files the repo was missing: CONTRIBUTING, SECURITY, CODE_OF_CONDUCT, issue and pull request templates, and a CI workflow that lints (hadolint, shellcheck), asserts the two entrypoints stay identical, and builds plus smoke-tests both variants on every pull request. Rewrite the root README, which doubles as the Docker Hub description: tag table, environment variable reference, badges, and absolute links, since relative ones do not resolve on Docker Hub. Fix the examples, which still referenced the upstream naskio/strapi image and Compose v1 syntax. The Postgres example now waits on a database healthcheck, keeps Postgres off the host network, and takes its password from the environment. Also drop apt lists from the Debian layer and record the fork's copyright alongside the original in LICENSE. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Author
|
Opened by mistake against upstream — this belongs in the fork. Sorry for the noise. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Turns the repo into a properly presented open-source project and makes the published images self-describing.
Images
VCS_REF/BUILD_DATEbuild args./var/lib/apt/lists/*— it was left in the layer.CI (new
ci.yml, runs on PRs and pushes to main).hadolint.yamldocumenting why package versions float) and shellcheck.docker-entrypoint.shfiles stay byte-identical — they are today, and nothing enforced it.Docs
Examples — both still pointed at the upstream
naskio/strapiimage with Compose v1 syntax and astrapi-v4service name. Updated todockerha08/strapi:alpine-latest; the Postgres example now waits on apg_isreadyhealthcheck, no longer publishes 5432 to the host, and reads its password from the environment.Verification
Both variants built locally at Strapi 5.52.3 and passed
./smoke-test.sh; labels verified withdocker inspect. hadolint and shellcheck pass against the committed config.🤖 Generated with Claude Code