Dan Alec d45a04381d fix(ci): make the container image pipelines version-safe and fork-safe ...

nvsim-server -> ghcr.io was failing for three separate reasons, each one
masked by the previous. The Dockerfile carried two literals that had drifted
from their source of truth, and both workflows hard-coded the `ruvnet`
registry namespace that only the upstream can write to.

nvsim-server/Dockerfile

  1. Stub workspace version. The Dockerfile builds a throwaway workspace
     containing only nvsim and nvsim-server. That stub hard-coded
     version = "0.3.0" (PR #440); the real workspace is now 0.3.1 (PR
     #1439) and nvsim-server requires nvsim = { path = "../nvsim",
     version = "0.3.1" }. The build died with "failed to select a version
     for the requirement nvsim". The stub now extracts the version from
     the real Cargo.toml and fails loudly if it cannot read one.

  2. Builder toolchain. FROM was pinned to rust:1.81 while
     rust-toolchain.toml declares channel = "1.89", so async-compression
     0.4.42 and compression-codecs 0.4.38 (both MSRV 1.83, reached through
     tower-http's compression-gzip feature) aborted the release build with
     "rustc 1.81.0 is not supported". The builder is now 1.89.

     Rather than re-pinning another literal that will drift again, the
     declared channel travels into the build context and is compared
     against the effective rustc before compiling. Bumping one without the
     other now fails the build loudly instead of resurfacing as an MSRV
     error three steps later. It is copied under a separate name on
     purpose: letting rustup resolve it would silently download a
     toolchain and hide the drift.

nvsim-server-docker.yml

  The image name was hard-coded to ghcr.io/ruvnet/nvsim-server, so the push
  failed with `denied: The requested installation does not exist` outside
  the upstream namespace. It now derives from github.repository_owner,
  which resolves to ruvnet for the upstream and to the fork owner for
  every fork, so the workflow keeps working unchanged here.

  The smoke test also pulled :sha-<short> but ran :latest. `latest` is
  emitted with `enable={{is_default_branch}}`, so a tag build never had
  it, and the `|| latest` fallback masked a failed push by testing a stale
  image. It now pulls and runs the sha tag, which type=sha emits on every
  event.

sensing-server-docker.yml

  Same namespace problem: the image was fixed to ruvnet/wifi-densepose on
  both Docker Hub and ghcr.io, which a fork cannot push to. Publishing
  under github.repository_owner fixes that.

  docker login was also unconditional, so a repository without
  DOCKERHUB_USERNAME/DOCKERHUB_TOKEN died at "Must provide --username with
  --password-stdin" before building anything. ghcr.io needs no secret, so
  it stays the always-on target and Docker Hub is added only when both
  credentials are present.

Verified: cargo check -p nvsim-server --release under rustc 1.89.0
compiles nvsim v0.3.1, nvsim-server v0.3.1 and async-compression 0.4.42;
the resulting image builds, pushes and its /api/health reports
{"nvsim_version":"0.3.1"}. CI on this branch runs the full pipeline
green.

2026-10-16 16:06:56 -03:00

..

scripts/nightly-sota

fix(nightly-sota): ignore stdin EPIPE from children that never read input

2026-10-01 19:07:40 +00:00

workflows

fix(ci): make the container image pipelines version-safe and fork-safe

2026-10-16 16:06:56 -03:00

dependabot.yml

security: pin GitHub Actions to SHAs and bump vulnerable npm deps (#442)

2026-04-28 08:46:51 -04:00