docs: reconcile every document with the shipped state; fix image hygiene - #2
Merged
Merged
Conversation
The documentation had drifted far enough that it described a different project. This corrects it and adds two guards so it cannot drift silently again. Documentation ------------- * 274 broken relative links. Files moved between `docs/` subdirectories and the links pointing at them were never updated, plus a set of references into a `planning/` directory that is not in this repository at all. 173 were repaired automatically where exactly one candidate matched; the rest were retargeted or unlinked by hand. * README claimed version 0.6.0 and carried a maturity table written before the 0.7.0 and 0.8.0 work. Rewritten against what is actually shipped. * The seven `docs/operations/` documents were not indexed anywhere, so nothing linked to the backup drill, the encryption runbook or the parity matrix. `docs/README.md` now has a "Running It in Production" section. * ORGANIZATION.md's tree omitted seven directories and listed two files (`test_release_*.py`, `docker-build.sh`) that do not exist. * `docs/known-issues/token_listing_sqlite_join.md` described a bug that was fixed; verified against the code and marked resolved. * New `docs/upgrading/0.7-to-0.8.md` covering the five changes that need a decision before deploying, including the MongoDB duplicate check that can fail index creation on existing data. * `pangolin_docs.md` / `pypangolin_docs.md` marked GENERATED. Corrected my own inaccurate claims ---------------------------------- * "18 CI jobs" appeared in STATUS.md three times and CHANGELOG.md once. It is 14 jobs on every push and pull request, plus 5 release jobs that run only on a `v*` tag. Image hygiene ------------- * `Dockerfile.tools` still pinned rust:1.88. A-36 raised the API image and missed this one, so the CLI image failed to compile the moment the workspace MSRV moved to 1.94 — which is exactly what happened publishing 0.8.0, after the API image had already been pushed. CI now fails if any Dockerfile pins a version other than the declared `rust-version`. * The CLI runtime stage installed `libssl-dev` — the development package, headers and static archives — the same defect A-36 fixed in the API image and missed here. Now `libssl3`, plus a non-root USER and image labels. * The CLI builder ran two separate `cargo build` invocations over one shared dependency graph, without `--locked`. Now one invocation, locked. * The UI runtime stage copied the entire `node_modules` across, publishing all 22 devDependencies — vite, playwright, vitest, svelte-check, the tailwind toolchain — in the shipped image. Pruned to the single production dependency, and it no longer runs as root. Guards ------ * `scripts/check_doc_links.sh`, wired into the `config-drift` job. Verified load-bearing: it fails on a deliberately broken link and passes when the link is restored. * A Dockerfile/MSRV consistency check in the `msrv` job. Release script -------------- The overwrite guard was all-or-nothing: if any of the three tags existed it refused to start. When the 0.8.0 CLI build failed after the API image had pushed, the only way to finish the release was ALLOW_OVERWRITE=1, which would also have re-pushed the good API image over itself. It now skips images already published at the target version, so a partial failure is resumable without arming the one flag that lets you clobber a published artefact. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
✅ Deploy Preview for lustrous-pithivier-968b22 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
The previous commit "corrected" 18 to 14. That was wrong: 14 is the number of job *definitions* in ci.yml, but `test` and `features` are matrices that expand to 2 and 4 runs respectively, so 18 jobs actually execute on every push and pull request. This pull request's own check list shows all 18. Restored, with the matrix expansion spelled out so the next person counting `jobs:` keys does not reach for the same wrong number. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Neither binary accepted `--version`; `--version` produced a clap parse error. For a tool distributed primarily as a container image that is a real gap - the image tag is the only other clue to what you are running, and `latest` tells you nothing at all. Found by running the built CLI image rather than by reading it, which is the only way any of this release's defects surfaced. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…ng found All three images are now on Docker Hub at 0.8.0 and latest, for linux/amd64 and linux/arm64. This is the first `-cli` and `-ui` image since 0.5.0. Each was verified by pulling the published tag and running it rather than by trusting the build's exit code: the CLI reports `pangolin-admin 0.8.0` and runs as uid 10001 with no OpenSSL headers present, the UI serves HTTP 200 as uid 1000 with a 2.3MB node_modules. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
AlexMercedCoder
added a commit
that referenced
this pull request
Aug 11, 2026
…scaped CI Adds ROADMAP_0.9.0.md, documents the v0.8.0 tag/image discrepancy as accepted, and corrects a misdiagnosis merged in #2. The correction: #2 claimed the four image defects escaped because the docker job does not exercise what it builds. It does — it starts the API image, probes its shutdown grace and fails if it runs as root. The real gap is that it is the only image CI touches; Dockerfile.tools and pangolin_ui/Dockerfile are never built in CI at all, which is why all four defects were in those two images. The roadmap's lead item is authz.rs:39, where any TenantAdmin gets Ok(true) for any scope and PermissionScope carries no tenant, so the check cannot be performed without a lookup the function never does. Reachability across 41 call sites is unverified. Every figure in the roadmap ships with the command that produces it and was re-run before commit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The documentation had drifted far enough that it described a different project. This corrects it and adds two guards so it cannot drift silently again. Along the way, watching the 0.8.0 Docker publish fail turned up three defects in the published images.
Documentation
docs/subdirectories and the links pointing at them were never updated, plus a set of references into aplanning/directory that is not in this repository at all. 173 were repaired automatically where exactly one candidate matched; the rest were retargeted or unlinked by hand.docs/operations/documents were not indexed anywhere — nothing linked to the backup drill, the encryption runbook, or the backend parity matrix.docs/README.mdnow has a "Running It in Production" section.ORGANIZATION.md's tree omitted seven directories and listed two files that do not exist.docs/known-issues/token_listing_sqlite_join.mddescribed a bug that was fixed; verified against the code and marked resolved.docs/upgrading/0.7-to-0.8.md, including the MongoDB duplicate check that can fail index creation on existing data.A correction I got wrong, then corrected back
I first "fixed" the documented "18 CI jobs" down to 14, having counted the
jobs:keys inci.yml. That was wrong —testandfeaturesare matrices expanding to 2 and 4 runs, so 18 jobs really do execute on every push and pull request. This PR's own check list is the evidence. Restored to 18, with the matrix expansion spelled out so the next person counting keys doesn't repeat it.Image hygiene — found by publishing, not by reading
Dockerfile.toolsstill pinned rust:1.88libssl-devnode_modulesBoth images also ran as root and carried no labels. Fixed.
Guards
scripts/check_doc_links.sh, wired intoconfig-drift. Verified load-bearing: fails on a deliberately broken link, passes when restored.msrv, so the two Dockerfiles cannot diverge fromrust-versionagain.Release script
The overwrite guard was all-or-nothing: if any of the three tags existed it refused to start. When the 0.8.0 CLI build failed after the API image had pushed, the only way to finish the release was
ALLOW_OVERWRITE=1— which would also have re-pushed the good API image over itself. It now skips images already published at the target version, so a partial failure is resumable without arming the one flag that lets you clobber a published artefact.Verification
Both images are being built and run locally before anything is pushed to Docker Hub — the
--omit=devprune in particular is the kind of change that builds clean and fails at runtime.🤖 Generated with Claude Code