Conversation
A GitHub Actions workflow that does the following: - checks for passing CI - checks for new version (idempotent) - pushes new GitHub tag - builds base and head containers with precise Alyx version - tags and pushes both containers to DockerHub
The release workflow builds the docker image from deploy/docker, but the apache config and settings there lacked the mitigations already live in the iblsre-built image. Bring them to parity so a CI release does not regress: - WSGIDaemonProcess request-timeout=300 maximum-requests=1000 (reap runaway workers) - pipe apache error/access logs through rotatelogs (128M x5) - django.log RotatingFileHandler (4M x5) instead of unbounded FileHandler Pagination cap and a2enmod ssl were already present here.
Two gaps that would break a CI-built image deployed via the production compose: - Add scripts/alyx_issue_ssl.sh (+ COPY into the image). The deploy compose command runs /usr/local/bin/alyx_issue_ssl.sh at container start; it was only present in the iblsre-built image. - Serve uploaded media from /uploaded (Alias + dir + mkdir) to match MEDIA_URL, MEDIA_ROOT and the compose volume mount; it was inconsistently set to /media.
The task cleanup test fails occasionally due to assigning a session to a random task (ordering done by pk) and saving outside of datetime mock, some times causing the task to update with a true datetime. This is fixed by saving the object within the mock context manager
Two deployment use cases under deploy/: - app/: production stack (apache + postgres) with the single docker-compose.yaml entry point, ported from iblsre for parity, plus the docker build context. - editable/: postgres-only container for local editable installs. Add deploy/app/docker-compose.yaml + template.env as the single source of truth for the production compose (server-agnostic via env). Update CI workflows and docs to the new deploy/app/docker and deploy/editable paths; point getting-started at the app compose.
release.yml now only cuts the git tag + GitHub release on a version bump, then dispatches build-image.yml for that tag. Image building moves to build-image.yml, triggered on tag push (manual rebuilds) or workflow_dispatch (the release chain). A tag pushed by GITHUB_TOKEN does not trigger a push-tags workflow, so release.yml dispatches the build explicitly (workflow_dispatch is exempt) — no PAT required.
The base production compose is the generic, server-agnostic source of truth. The iblalyx-specific `pip install -r /home/iblalyx/requirements.txt` is layered downstream via an iblsre override or an IBL-specific image built on this one.
Remove the iblalyx and ibl_reports mounts (and the IBLALYX_ROOT env hint) so the base production compose is fully generic. Like the requirements install, the iblalyx volumes are re-added downstream via the iblsre override or an IBL-specific image.
Port the deploy-web smoke test into alyx (deploy/app/test/test-deploy-web.yaml): brings the production stack up in a temp dir with test env, asserts HTTP 200, apache running, log rotation and DB connectivity, then tears down. No iblalyx needed now that the base image/compose are self-contained. build-image.yml now builds base + main locally, runs the smoke test, and pushes to Docker Hub only if it passes. Plain docker build (native amd64) lets the main image FROM the local base without pushing first, so a failing image never ships.
Found via a local build+run of the C3 smoke test; several latent issues: - Adopt iblsre's apache config set (000-default.conf + alyx-common.conf + apache2.conf + options-ssl-apache.conf), replacing the divergent 000-default-conf-alyx/apache-conf-alyx. The old config redirected all :80 to https with no localhost serve path, so localhost (ssl disabled) never served. - Base image on Ubuntu 25.04 (system Python 3.13) so libapache2-mod-wsgi-py3 matches the venv, fixing a mod_wsgi 3.10 vs venv 3.13 skew that made the WSGI app fail to import 'django'. Drop the deadsnakes PPA; use uv for the venv and dependency installs (base + head images). - Fix the startup command: complete alyx_issue_ssl.sh (ssl setup) before apache starts (&& not &), and drop the stray '664' arg that made chown exit non-zero and block apache from starting. - Drop the logrotate step from the smoke test: this image rotates logs via apache's piped rotatelogs, so logrotate is not the mechanism in use.
alyx is the source of truth for the image build (deploy/app/docker) and the base compose (deploy/app/docker-compose.yaml); iblsre owns deploy orchestration only. Describe the release.yml -> build-image.yml flow (bump __version__ -> tag -> build -> smoke test -> push) with the manual buildx build kept as a fallback.
Bumps [django](https://github.com/django/django) from 5.2.14 to 5.2.15. - [Commits](django/django@5.2.14...5.2.15) --- updated-dependencies: - dependency-name: django dependency-version: 5.2.15 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [pillow](https://github.com/python-pillow/Pillow) from 12.2.0 to 12.3.0. - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.2.0...12.3.0) --- updated-dependencies: - dependency-name: pillow dependency-version: 12.3.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Return 400 code for various failed register-file validations * Handle int file size in register-file endpoint (issue #1011) * Populate subject field in register_file - When registering a dataset to a subject content type, the returned data contains non-null subject field - Returns json object when deleting protected dataset, consistent with other endpoint errors
* Data Notice model for information about datasets * Fix tests * Fix admin readonly field visibility and trailing whitespace in tests * Change default data notice order; Add tag filter to admin * DataNotice.IMPORTANCE IntEnum -> IntegerChoices * Data notice project filter --------- Co-authored-by: Olivier Winter <olivier.winter@hotmail.fr>
The unknown data set type and data format objects are created with a new pk when migrations are run. This causes an error when the test dump is loaded as it contains the same two objects with different pks. I've removed them from the dump and modified the command so they are not saved in the future
Restrict the push:tags trigger to version tags (N.N.N) and dev* tags, so stray tags no longer trigger a build (tag events can't be branch-scoped, so this is done by tag name). A dev* tag builds + smoke-tests the image but skips Docker Hub login/push, so the full pipeline can be exercised on release_workflow before it reaches master without overwriting the production latest tag. Real version tags still build + push.
Release workflow
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes dev to master for the 3.6.0 release. Merging this triggers the CI/CD release: on green master CI,
release.ymlcuts the3.6.0tag + GitHub release and dispatchesbuild-image.yml, which builds + smoke-tests and pushesalyx_apache[_base]:3.6.0+latestto Docker Hub.dev-*dry-run ofbuild-image.ymlhas gone green on dev's tip (build + smoke test, no push).Changelog (3.6.0)
Added
DataNoticemodel to attach information/notices to datasets (Data Noice model for information about datasets #1007)Changed
deploy/app/) as the single source of truth;iblalyxno longer baked in (bind-mounted at deploy); deploy orchestration lives iniblsre(Remove iblalyx from containers #1017)deploy/intoapp/andeditable/Fixed