Zayden-Jung/probably-rendering-one-more-pixel-tonight
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use numeric container ownership during preview setup
Unified application CI and deployment / static-checks (push) Successful in 5s
Details
Remote development preview source sync / sync-source (push) Failing after 4m54s
Details
Unified application CI and deployment / static-checks (pull_request) Successful in 5s
Details
python CI and deployment / static-checks (pull_request) Successful in 3s
Details
Unified application CI and deployment / verify-and-release (push) Has been skipped
Details
Unified application CI and deployment / verify-and-release (pull_request) Has been skipped
Details
python CI and deployment / verify-and-deploy (pull_request) Has been skipped
Details

Browse Source
This commit is contained in:
Codex Bot
2026-11-04 14:25:41 +08:00
parent 19e179dd20
commit fe26f03cf4
2 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/preview/init.sh
+3 -2
View File
@@ -20,7 +20,8 @@ actual=$(docker run --rm --entrypoint node \
"$IMAGE" /tmp/preview-fingerprint.mjs /repo)
[[ "$actual" == "$expected" ]] || { echo 'Tooling image does not match preview dependencies/configuration/schema' >&2; exit 1; }
install -d -m 0700 "$ROOT"
install -d -m 0755 -o 1000 -g 1000 "$ROOT/source" "$ROOT/status"
install -d -m 0755 "$ROOT/source" "$ROOT/status"
chown 1000:1000 "$ROOT/source" "$ROOT/status"
# Create independent preview credentials only once, never copy production secrets.
if [ ! -s "$ROOT/env" ]; then
ROOT="$ROOT" IMAGE="$IMAGE" PORT="$PORT" python3 - <<'PY'
@@ -32,7 +33,7 @@ with p.open('x') as f:
for key in ['POSTGRES_PASSWORD','S3_ACCESS_KEY','S3_SECRET_KEY']:f.write(key+'='+secrets.token_hex(24)+'\n')
PY
fi
rsync -a --delete --chown=1000:1000 \
rsync -a --delete --numeric-ids --chown=1000:1000 \
--exclude='.git' --exclude='node_modules' --exclude='.next' --exclude='dist' \
--exclude='*.tsbuildinfo' --exclude='.env' --exclude='.env.*' --exclude='.gitea' \
"$SOURCE/" "$ROOT/source/"
scripts/preview/sync.sh
+5 -2
View File
@@ -7,6 +7,9 @@ BRANCH=${3:?branch required}
ROOT=/opt/prompt-preview
exec 8>/var/lock/prompt-preview-sync.lock
flock -w 30 8
latest=$(git -C "$SOURCE" ls-remote origin "refs/heads/$BRANCH" | cut -f1)
test -n "$latest"
if [ "$latest" != "$SHA" ]; then echo "Skipping superseded preview commit $SHA"; exit 0; fi
candidate=$(node "$SOURCE/scripts/preview/fingerprint.mjs" "$SOURCE")
if [ ! -s "$ROOT/fingerprint" ]; then
echo 'Preview is not initialized; run scripts/preview/init.sh once with a verified tooling image' >&2
@@ -19,7 +22,7 @@ fi
id=$(docker compose -p prompt-preview --env-file "$ROOT/env" -f "$ROOT/compose.yml" ps -q waterfall-wiki)
test -n "$id" && test "$(docker inspect --format '{{.State.Running}}' "$id")" = true
# No git credentials, dependency folders, compiler output or environment files are copied.
rsync -a --checksum --no-times --delete --chown=1000:1000 \
rsync -a --checksum --no-times --delete --numeric-ids --chown=1000:1000 \
--exclude='.git' --exclude='node_modules' --exclude='.next' --exclude='dist' \
--exclude='*.tsbuildinfo' --exclude='.env' --exclude='.env.*' --exclude='.gitea' \
--exclude='/apps/waterfall-wiki/public/brand/' --exclude='/apps/waterfall-wiki/public/favicon.ico' --exclude='/apps/waterfall-wiki/public/apple-touch-icon.png' "$SOURCE/" "$ROOT/source/"
@@ -28,7 +31,7 @@ assets="$ROOT/source/packages/brand/assets"
public="$ROOT/source/apps/waterfall-wiki/public"
mkdir -p "$public/brand"
copy_asset() {
cmp -s "$1" "$2" || install -o 1000 -g 1000 -m 0644 "$1" "$2"
cmp -s "$1" "$2" || install -m 0644 "$1" "$2"
}
for name in logo-light.svg logo-dark.svg icon-dark.svg; do copy_asset "$assets/svg/$name" "$public/brand/$name"; done
copy_asset "$assets/icons/favicon.ico" "$public/favicon.ico"