nicolas-georger/deepseek-kubernetes-sandbox
1
0
Fork 0
mirror of https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git synced 2026-11-03 01:13:24 +00:00
Code Projects Releases Activity

chore: improve package installation and add Python depend… (#42)

Browse Source 
* chore(dockerfile): improve package installation and add Python dependencies

* chore(dockerfile): update package installation commands for consistency

* chore: update release version to dsh-v0.2.1-rc.5-r6 across documentation and configuration files
This commit is contained in:
Nicolás Georger
2026-10-31 06:25:39 -03:00
committed by GitHub
parent 1a929e3e24
commit 8e9bd478b4
15 changed files with 68 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.env.sample
View File

@@ -26,7 +26,7 @@ DSH_VERSION=dsh-v0.2.1-rc.5
# Full upstream commit SHA that DSH_VERSION resolves to; the main image build # Full upstream commit SHA that DSH_VERSION resolves to; the main image build
# fails if the clone's HEAD differs (guards against a moved tag). # fails if the clone's HEAD differs (guards against a moved tag).
DSH_COMMIT=b830ec950faba0a46dda564be3e2d854afed94f1 DSH_COMMIT=b830ec950faba0a46dda564be3e2d854afed94f1
RELEASE_REVISION= RELEASE_REVISION=r6
PNPM_VERSION=11.28.5 PNPM_VERSION=11.28.5
# Container port, and the host port published by "make run". # Container port, and the host port published by "make run".
DSH_PORT=3080 DSH_PORT=3080

2
AGENTS.md
View File

@@ -82,7 +82,7 @@ needs kind plus the agent-sandbox CRDs (see the example README).
## Versioning and releases ## Versioning and releases
- Release identity = DSH_VERSION plus an optional -rN repository revision. - Release identity = DSH_VERSION plus an optional -rN repository revision.
The current identity is dsh-v0.2.1-rc.5 (first release at this DSH ref, so no The current identity is dsh-v0.2.1-rc.5-r6 (first release at this DSH ref, so no
suffix); a repository-only change at the same ref publishes -r2. suffix); a repository-only change at the same ref publishes -r2.
- Channels: release tags are immutable; latest follows the newest release; - Channels: release tags are immutable; latest follows the newest release;
main is the development channel for both image packages. main is the development channel for both image packages.

34
CHANGELOG.md
View File

@@ -3,6 +3,40 @@
All notable changes to this repository are documented here. All notable changes to this repository are documented here.
Generated by git-cliff from Conventional Commits; do not edit this file by hand. Generated by git-cliff from Conventional Commits; do not edit this file by hand.
## [Unreleased]
### Added
- **example:** Persist the agent workspace on the PVC via subPath (#34) (367294b)
- **example:** Start DSH's folder picker on the persisted workspace (#36) (82ee0d0)
### CI
- **workflows:** Streamline CI and remove redundant builds (#31) (dcb5b43)
### Documentation
- Align readmes, docs and agent guidance with current behavior (#37) (24f23e0)
### Fixed
- **gateway:** Answer client-aborted requests with 499, not a traceback (#32) (cbcc56f)
- Ship bubblewrap for DSH's command sandbox, keep agents usable without it (#35) (a09d4ac)
- **ci:** Harden workflow token scope and download integrity (#39) (2f959e6)
- **gateway:** Replace token cookies with revocable sessions and harden abuse controls (#40) (1a929e3)
### Maintenance
- **changelog:** Refresh for dsh-v0.2.1-rc.5 (#30) (b57916d)
- Bump docker/login-action (#28) (8c34f43)
- **deps:** Bump agent-sandbox to v1.0.9 (#38) (4c073ee)
- **dockerfile:** Improve package installation and add Python dependencies (bd7c6f3)
- **dockerfile:** Update package installation commands for consistency (0a3fe25)
### Other
- Add continue-on-error to CHANGELOG PR step (97c5632)
## [dsh-v0.2.1-rc.5] - 2026-10-30 ## [dsh-v0.2.1-rc.5] - 2026-10-30
### Added ### Added

9
Dockerfile
View File

@@ -68,7 +68,7 @@ RUN cd /opt/dsh \
FROM $NODE_RUNTIME_IMAGE AS runtime FROM $NODE_RUNTIME_IMAGE AS runtime
ARG DSH_VERSION=dsh-v0.2.1-rc.5 ARG DSH_VERSION=dsh-v0.2.1-rc.5
ARG RELEASE_REVISION= ARG RELEASE_REVISION=r6
ARG PNPM_VERSION=11.28.5 ARG PNPM_VERSION=11.28.5
ARG VCS_REF=unknown ARG VCS_REF=unknown
@@ -106,8 +106,11 @@ RUN apt-get update \
tini \ tini \
gh \ gh \
bubblewrap \ bubblewrap \
python3 \
python3-pip \
python3-venv \
&& rm -rf /var/lib/apt/lists/* \ && rm -rf /var/lib/apt/lists/* \
&& curl -LsSf https://astral.sh/uv/install.sh | sh \ && apt-get autoclean -y \
&& install -d -o node -g node -m 0755 /workspace "$DSH_HOME" \ && install -d -o node -g node -m 0755 /workspace "$DSH_HOME" \
&& corepack enable \ && corepack enable \
&& corepack prepare "pnpm@$PNPM_VERSION" --activate \ && corepack prepare "pnpm@$PNPM_VERSION" --activate \
@@ -160,6 +163,6 @@ WORKDIR /workspace
USER node USER node
EXPOSE 3080 EXPOSE 3080
VOLUME ["/home/node/.dsh"] VOLUME ["/home/node/.dsh", "/workspace"]
STOPSIGNAL SIGTERM STOPSIGNAL SIGTERM
ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/dsh-entrypoint"] ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/dsh-entrypoint"]

12
README.md
View File

@@ -20,7 +20,7 @@ docker run -d --name dsh-web \
-p 3080:3080 \ -p 3080:3080 \
-v dsh-home:/home/node/.dsh \ -v dsh-home:/home/node/.dsh \
-e DEEPSEEK_API_KEY \ -e DEEPSEEK_API_KEY \
ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5 ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5-r6
``` ```
DSH Web is **not usable at a bare `/`**. Without its launch-token cookie it DSH Web is **not usable at a bare `/`**. Without its launch-token cookie it
@@ -45,7 +45,7 @@ docker run -d --name dsh-web -p 18081:3080 \
-e DSH_PUBLIC_URL=http://localhost:18081 \ -e DSH_PUBLIC_URL=http://localhost:18081 \
-v dsh-home:/home/node/.dsh \ -v dsh-home:/home/node/.dsh \
-e DEEPSEEK_API_KEY \ -e DEEPSEEK_API_KEY \
ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5 ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5-r6
# then open http://localhost:18081/?token=... # then open http://localhost:18081/?token=...
``` ```
@@ -94,20 +94,20 @@ ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway
| Tag | Contents | Meaning | | Tag | Contents | Meaning |
| --- | --- | --- | | --- | --- | --- |
| `dsh-v0.2.1-rc.5` | DSH Web, port `3080` | **Current release identity.** Immutable: once published it never moves. | | `dsh-v0.2.1-rc.5-r6` | DSH Web, port `3080` | **Current release identity.** Immutable: once published it never moves. |
| `latest` | DSH Web | Most recent release; same digest as the current identity. | | `latest` | DSH Web | Most recent release; same digest as the current identity. |
| `main` | DSH Web | Development channel rebuilt when image-definition files change on `main`. Not a release; not for production. | | `main` | DSH Web | Development channel rebuilt when image-definition files change on `main`. Not a release; not for production. |
The example gateway is published under its nested path with the same release The example gateway is published under its nested path with the same release
identity, e.g. identity, e.g.
`ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.5`. `ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.5-r6`.
Release identities, channels and rollback rules are explained in Release identities, channels and rollback rules are explained in
[docs/versioning.md](docs/versioning.md). Production deployments should pin a [docs/versioning.md](docs/versioning.md). Production deployments should pin a
digest: digest:
```bash ```bash
docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5 docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5-r6
# image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox@sha256:<digest> # image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox@sha256:<digest>
``` ```
@@ -188,7 +188,7 @@ required checks and releases: [docs/gitflow.md](docs/gitflow.md).
The release identity is the upstream DSH ref plus an optional repository The release identity is the upstream DSH ref plus an optional repository
revision: `DSH_VERSION` and `RELEASE_REVISION` in [versions.env](versions.env). revision: `DSH_VERSION` and `RELEASE_REVISION` in [versions.env](versions.env).
The current identity is **`dsh-v0.2.1-rc.5`** — the first release at this The current identity is **`dsh-v0.2.1-rc.5-r6`** — the first release at this
upstream DSH ref, so it carries no repository revision. Tags are immutable; a upstream DSH ref, so it carries no repository revision. Tags are immutable; a
broken release is fixed by publishing `-r(N+1)`, never by re-tagging. broken release is fixed by publishing `-r(N+1)`, never by re-tagging.

2
docs/README.md
View File

@@ -14,7 +14,7 @@ gets a DSH Web container running before anything else.
| [main-image.md](main-image.md) | The primary artifact: build args, runtime environment, entrypoint, probes, volumes/ports/signals, non-root contract, image names, tags and digests. | | [main-image.md](main-image.md) | The primary artifact: build args, runtime environment, entrypoint, probes, volumes/ports/signals, non-root contract, image names, tags and digests. |
| [examples.md](examples.md) | The example contract: required layout, manifest rules, exposure variants, components and image naming, scripts, docs, and how to add a new example. | | [examples.md](examples.md) | The example contract: required layout, manifest rules, exposure variants, components and image naming, scripts, docs, and how to add a new example. |
| [gitflow.md](gitflow.md) | Branches, protected `main`, squash merges, Conventional PR titles, required CI checks, release branches, hotfixes and the one-time GitHub settings checklist. | | [gitflow.md](gitflow.md) | Branches, protected `main`, squash merges, Conventional PR titles, required CI checks, release branches, hotfixes and the one-time GitHub settings checklist. |
| [versioning.md](versioning.md) | Release identity (`DSH ref` + optional `-rN`), the current identity `dsh-v0.2.1-rc.5`, why identities are immutable, channels, compatibility matrix, bumping pins, the release checklist, rollback, git-cliff and digest pinning. | | [versioning.md](versioning.md) | Release identity (`DSH ref` + optional `-rN`), the current identity `dsh-v0.2.1-rc.5-r6`, why identities are immutable, channels, compatibility matrix, bumping pins, the release checklist, rollback, git-cliff and digest pinning. |
| [workflow-security.md](workflow-security.md) | GitHub Actions security posture: least-privilege tokens, pinned actions, untrusted-input handling, download integrity checks, artifact hygiene, the latest audit record and residual repository-setting recommendations. | | [workflow-security.md](workflow-security.md) | GitHub Actions security posture: least-privilege tokens, pinned actions, untrusted-input handling, download integrity checks, artifact hygiene, the latest audit record and residual repository-setting recommendations. |
## Project skills ## Project skills

10
docs/main-image.md
View File

@@ -39,12 +39,12 @@ To reproduce the equivalent by hand:
```bash ```bash
docker build \ docker build \
--build-arg DSH_VERSION=dsh-v0.2.1-rc.5 \ --build-arg DSH_VERSION=dsh-v0.2.1-rc.5-r6 \
--build-arg DSH_COMMIT=b830ec950faba0a46dda564be3e2d854afed94f1 \ --build-arg DSH_COMMIT=b830ec950faba0a46dda564be3e2d854afed94f1 \
--build-arg RELEASE_REVISION= \ --build-arg RELEASE_REVISION= \
--build-arg PNPM_VERSION=11.28.5 \ --build-arg PNPM_VERSION=11.28.5 \
--build-arg VCS_REF="$(git rev-parse --short HEAD)" \ --build-arg VCS_REF="$(git rev-parse --short HEAD)" \
-t ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5 . -t ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5-r6 .
``` ```
### Build args ### Build args
@@ -209,7 +209,7 @@ GitHub Container Registry:
| Tag | Meaning | | Tag | Meaning |
| --- | --- | | --- | --- |
| `dsh-v0.2.1-rc.5` | Current release identity. **Immutable**: once published it never moves. | | `dsh-v0.2.1-rc.5-r6` | Current release identity. **Immutable**: once published it never moves. |
| `latest` | Most recent release; points at the same digest as the current identity. | | `latest` | Most recent release; points at the same digest as the current identity. |
| `main` | Development channel rebuilt when image-definition files change on `main`; not a release, not for production. | | `main` | Development channel rebuilt when image-definition files change on `main`; not a release, not for production. |
@@ -218,7 +218,7 @@ Release identities, channels and rollback rules are defined in
pin a digest: pin a digest:
```bash ```bash
docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5 docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5-r6
# ... pin the digest in your deployment manifests: # ... pin the digest in your deployment manifests:
# image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox@sha256:<digest> # image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox@sha256:<digest>
``` ```
@@ -226,7 +226,7 @@ docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbo
## Verifying an image ## Verifying an image
```bash ```bash
docker inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5 \ docker inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5-r6 \
--format '{{json .Config.Labels}}' --format '{{json .Config.Labels}}'
# org.opencontainers.image.title / .version / .source # org.opencontainers.image.title / .version / .source
# io.sredevopsorg.dsh.version / io.sredevopsorg.release.revision # io.sredevopsorg.dsh.version / io.sredevopsorg.release.revision

12
docs/versioning.md
View File

@@ -15,12 +15,12 @@ release identity = DSH_VERSION + optional "-" + RELEASE_REVISION
| Piece | Meaning | | Piece | Meaning |
| --- | --- | | --- | --- |
| `DSH_VERSION` | The upstream DeepSeek Harness git ref being packaged, e.g. `dsh-v0.2.1-rc.5`. It mirrors upstream's own tag. | | `DSH_VERSION` | The upstream DeepSeek Harness git ref being packaged, e.g. `dsh-v0.2.1-rc.5-r6`. It mirrors upstream's own tag. |
| `RELEASE_REVISION` | An optional repository revision at that DSH ref: empty for the first release, `rN` (`N >= 2`) for a repository-only re-release. | | `RELEASE_REVISION` | An optional repository revision at that DSH ref: empty for the first release, `rN` (`N >= 2`) for a repository-only re-release. |
Examples: Examples:
- `DSH_VERSION=dsh-v0.2.1-rc.5`, `RELEASE_REVISION=` → identity `dsh-v0.2.1-rc.5` - `DSH_VERSION=dsh-v0.2.1-rc.5-r6`, `RELEASE_REVISION=` → identity `dsh-v0.2.1-rc.5-r6`
(first release at that upstream ref). (first release at that upstream ref).
- `DSH_VERSION=<ref>`, `RELEASE_REVISION=rN` → identity `<ref>-rN` (for example - `DSH_VERSION=<ref>`, `RELEASE_REVISION=rN` → identity `<ref>-rN` (for example
documentation, CI or gateway changes on top of an already-released ref; no DSH documentation, CI or gateway changes on top of an already-released ref; no DSH
@@ -36,7 +36,7 @@ with an empty revision); a repository-only change at the same DSH ref increments
change what an existing deployment runs. A fix therefore publishes a new identity; change what an existing deployment runs. A fix therefore publishes a new identity;
see the rules above. see the rules above.
The current identity is `dsh-v0.2.1-rc.5`, the first release at this upstream The current identity is `dsh-v0.2.1-rc.5-r6`, the first release at this upstream
ref, so it carries no revision suffix. The identity is stored in ref, so it carries no revision suffix. The identity is stored in
[versions.env](../versions.env) and consumed everywhere: the Dockerfile labels [versions.env](../versions.env) and consumed everywhere: the Dockerfile labels
(version and revision), the example manifests, the Makefile and the release (version and revision), the example manifests, the Makefile and the release
@@ -46,7 +46,7 @@ workflow.
| Channel | Image tag | Meaning | | Channel | Image tag | Meaning |
| --- | --- | --- | | --- | --- | --- |
| Release | `dsh-v0.2.1-rc.5` | The current immutable release identity. What production should pin (preferably by digest). | | Release | `dsh-v0.2.1-rc.5-r6` | The current immutable release identity. What production should pin (preferably by digest). |
| `latest` | `latest` | Alias for the most recent release; moves only when a new release is published. | | `latest` | `latest` | Alias for the most recent release; moves only when a new release is published. |
| `main` | `main` | Development channel, rebuilt when image or gateway sources change on `main`. Never treat it as a release; it exists so `main` can be tested. | | `main` | `main` | Development channel, rebuilt when image or gateway sources change on `main`. Never treat it as a release; it exists so `main` can be tested. |
@@ -60,7 +60,7 @@ Values from [versions.env](../versions.env) at the current identity:
| Component | Pin | Source | | Component | Pin | Source |
| --- | --- | --- | | --- | --- | --- |
| Upstream DSH source | `DSH_REPO` | [versions.env](../versions.env) | | Upstream DSH source | `DSH_REPO` | [versions.env](../versions.env) |
| DSH ref | `dsh-v0.2.1-rc.5` | `DSH_VERSION` | | DSH ref | `dsh-v0.2.1-rc.5-r6` | `DSH_VERSION` |
| DSH commit | `b830ec950faba0a46dda564be3e2d854afed94f1` | `DSH_COMMIT`; the main image build fails unless the clone's `HEAD` matches | | DSH commit | `b830ec950faba0a46dda564be3e2d854afed94f1` | `DSH_COMMIT`; the main image build fails unless the clone's `HEAD` matches |
| Repository revision | `(empty)` | `RELEASE_REVISION` | | Repository revision | `(empty)` | `RELEASE_REVISION` |
| pnpm | `11.28.5` | `PNPM_VERSION` | | pnpm | `11.28.5` | `PNPM_VERSION` |
@@ -176,7 +176,7 @@ Release identities are immutable in theory; deployments should still pin the
_resolved_ digest for reproducibility and supply-chain safety: _resolved_ digest for reproducibility and supply-chain safety:
```bash ```bash
docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5 docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5-r6
# then, in the deployment: # then, in the deployment:
# image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox@sha256:<digest> # image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox@sha256:<digest>
``` ```

2
examples/dsh-agents-as-a-service/README.md
View File

@@ -270,7 +270,7 @@ kubectl delete -f manifests/40-claim-rejected.yaml
```bash ```bash
# Published image (on kind, load it into the cluster; on a real cluster the # Published image (on kind, load it into the cluster; on a real cluster the
# kubelet pulls it from GHCR): # kubelet pulls it from GHCR):
GW=ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.5 GW=ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.5-r6
docker pull "$GW" docker pull "$GW"
kind load docker-image "$GW" --name <kind-cluster> kind load docker-image "$GW" --name <kind-cluster>

2
examples/dsh-agents-as-a-service/gateway/README.md
View File

@@ -24,7 +24,7 @@ It does four things:
The DSH version pin lives in [`versions.env`](../../../versions.env) The DSH version pin lives in [`versions.env`](../../../versions.env)
(`DSH_VERSION` plus the optional repository `RELEASE_REVISION`); the example (`DSH_VERSION` plus the optional repository `RELEASE_REVISION`); the example
manifests and published images use the release identity built from it (currently manifests and published images use the release identity built from it (currently
`dsh-v0.2.1-rc.5`). DSH binds `:3080`, gates the UI and `/api` behind a `dsh-v0.2.1-rc.5-r6`). DSH binds `:3080`, gates the UI and `/api` behind a
`dsh-auth-*` cookie and requires a WebSocket at `/api/remote.mux`. `dsh-auth-*` cookie and requires a WebSocket at `/api/remote.mux`.
## Flow ## Flow

2
examples/dsh-agents-as-a-service/manifests/10-sandboxtemplate.yaml
View File

@@ -73,7 +73,7 @@ spec:
fsGroupChangePolicy: OnRootMismatch fsGroupChangePolicy: OnRootMismatch
containers: containers:
- name: dsh-web - name: dsh-web
image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5 image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5-r6
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
ports: ports:
- name: web - name: web

2
examples/dsh-agents-as-a-service/manifests/50-gateway.yaml
View File

@@ -101,7 +101,7 @@ spec:
type: RuntimeDefault type: RuntimeDefault
containers: containers:
- name: gateway - name: gateway
image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.5 image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.5-r6
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
securityContext: securityContext:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false

2
examples/minimal-single-tenant/manifests/10-sandboxtemplate.yaml
View File

@@ -56,7 +56,7 @@ spec:
fsGroupChangePolicy: OnRootMismatch fsGroupChangePolicy: OnRootMismatch
containers: containers:
- name: dsh-web - name: dsh-web
image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5 image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5-r6
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
ports: ports:
- name: web - name: web

2
scripts/set-version.sh
View File

@@ -3,7 +3,7 @@
# "make check". # "make check".
# #
# ./scripts/set-version.sh dsh-v0.2.2-rc.1 # new DSH ref, no revision # ./scripts/set-version.sh dsh-v0.2.2-rc.1 # new DSH ref, no revision
# ./scripts/set-version.sh dsh-v0.2.1-rc.5 r3 # same ref, new repo revision # ./scripts/set-version.sh dsh-v0.2.1-rc.5-r6 r3 # same ref, new repo revision
# #
# For a new DSH ref the script resolves the tag's commit with "git ls-remote" # For a new DSH ref the script resolves the tag's commit with "git ls-remote"
# (peeled ^{} commit first, tag ref as fallback) and rewrites DSH_COMMIT in # (peeled ^{} commit first, tag ref as fallback) and rewrites DSH_COMMIT in

4
versions.env
View File

@@ -18,9 +18,9 @@ PNPM_VERSION=11.28.5
# Release identity = DSH_VERSION plus an optional repository revision. # Release identity = DSH_VERSION plus an optional repository revision.
# An empty RELEASE_REVISION is the first release at this DSH ref; rN (N >= 2) # An empty RELEASE_REVISION is the first release at this DSH ref; rN (N >= 2)
# marks a repository-only re-release at the same DSH ref. This is the first # marks a repository-only re-release at the same DSH ref. This is the first
# release at dsh-v0.2.1-rc.5, so the identity is the plain tag; a later # release at dsh-v0.2.1-rc.5-r6, so the identity is the plain tag; a later
# repository-only change at the same ref becomes -r2. # repository-only change at the same ref becomes -r2.
RELEASE_REVISION= RELEASE_REVISION=r6
# Base images for the main DSH Web image (root Dockerfile), pinned by digest. # Base images for the main DSH Web image (root Dockerfile), pinned by digest.
NODE_BUILD_IMAGE=docker.io/node:24-trixie@sha256:8c761eca2bf7eec965f946cf47b8090143cb41f45f2f8699af0cc0298d2d2d19 NODE_BUILD_IMAGE=docker.io/node:24-trixie@sha256:8c761eca2bf7eec965f946cf47b8090143cb41f45f2f8699af0cc0298d2d2d19