From bed8e5675a716759e9603be20b7df7c5794ac18c Mon Sep 17 00:00:00 2001 From: "SREDevOps.org Agent" Date: Fri, 30 Oct 2026 04:54:37 -0300 Subject: [PATCH] chore(release): dsh-v0.2.1-rc.5 (#29) Bump DSH_VERSION to dsh-v0.2.1-rc.5 and clear RELEASE_REVISION, making the release identity dsh-v0.2.1-rc.5. Update every derived manifest, image tag, and doc, and remove prose that described the previous identity's legacy-tag history. Co-authored-by: SREDevOpsAgents --- .env.sample | 4 +- .github/ISSUE_TEMPLATE/bug_report.yml | 2 +- AGENTS.md | 8 ++-- Dockerfile | 6 +-- README.md | 21 +++++----- docs/README.md | 2 +- docs/main-image.md | 16 ++++---- docs/versioning.md | 41 ++++++++++--------- examples/dsh-agents-as-a-service/README.md | 2 +- .../docs/optional-hardening.md | 2 +- .../dsh-agents-as-a-service/gateway/README.md | 2 +- .../manifests/10-sandboxtemplate.yaml | 2 +- .../manifests/50-gateway.yaml | 2 +- .../manifests/sandbox-template.yaml | 2 +- scripts/set-version.sh | 2 +- versions.env | 10 ++--- 16 files changed, 64 insertions(+), 60 deletions(-) diff --git a/.env.sample b/.env.sample index ef609ae..5b29cf1 100644 --- a/.env.sample +++ b/.env.sample @@ -20,8 +20,8 @@ TOGETHER_API_KEY= CEREBRAS_API_KEY= AI_GATEWAY_API_KEY= HF_TOKEN= -DSH_VERSION=dsh-v0.2.1-rc.3 -RELEASE_REVISION=r4 +DSH_VERSION=dsh-v0.2.1-rc.5 +RELEASE_REVISION= PNPM_VERSION=11.28.5 # Container port, and the host port published by "make run". DSH_PORT=3080 diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index 0d4cb56..383a90d 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -28,7 +28,7 @@ body: id: image-tag attributes: label: Image or release - description: The pinned tag or digest, for example dsh-v0.2.1-rc.3-r4. + description: The pinned tag or digest, for example dsh-v0.2.1-rc.5. - type: input id: cluster attributes: diff --git a/AGENTS.md b/AGENTS.md index e94af39..c7fe9b4 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -83,10 +83,10 @@ needs kind plus the agent-sandbox CRDs (see the example README). - Release identity = DSH_VERSION, optionally with a repository revision suffix for re-releases at the same DSH ref (current identity: - dsh-v0.2.1-rc.3-r4). -- The current identity is dsh-v0.2.1-rc.3-r4 (stored in versions.env). The - dsh-v0.2.1-rc.3 image tag already exists and tags are immutable, which is why - the first release under this scheme carries -r2. + dsh-v0.2.1-rc.5). +- The current identity is dsh-v0.2.1-rc.5 (stored in versions.env). It is the + first release at this DSH ref, so it carries no revision suffix; a + repository-only change at the same ref publishes -r2. - Channels: release tags are immutable; latest follows the newest release; main is the development channel for both image packages. - A broken release is fixed by publishing -r(N+1), never by re-tagging. diff --git a/Dockerfile b/Dockerfile index 11cca35..a8ab7a9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -20,7 +20,7 @@ ARG NODE_RUNTIME_IMAGE=docker.io/node:24-trixie-slim FROM $NODE_BUILD_IMAGE AS build ARG DSH_REPO=https://github.com/deepseek-ai/deepseek-harness.git -ARG DSH_VERSION=dsh-v0.2.1-rc.3 +ARG DSH_VERSION=dsh-v0.2.1-rc.5 ARG PNPM_VERSION=11.28.5 ENV CI=true \ @@ -57,8 +57,8 @@ RUN cd /opt/dsh \ # --------------------------------------------------------------------------- FROM $NODE_RUNTIME_IMAGE AS runtime -ARG DSH_VERSION=dsh-v0.2.1-rc.3 -ARG RELEASE_REVISION=r4 +ARG DSH_VERSION=dsh-v0.2.1-rc.5 +ARG RELEASE_REVISION= ARG PNPM_VERSION=11.28.5 ARG VCS_REF=unknown diff --git a/README.md b/README.md index d51d33e..fbda0eb 100644 --- a/README.md +++ b/README.md @@ -20,7 +20,7 @@ docker run -d --name dsh-web \ -p 3080:3080 \ -v dsh-home:/home/node/.dsh \ -e DEEPSEEK_API_KEY \ - ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r4 + ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5 ``` DSH Web is **not usable at a bare `/`**. Without its launch-token cookie it @@ -45,7 +45,7 @@ docker run -d --name dsh-web -p 18081:3080 \ -e DSH_PUBLIC_URL=http://localhost:18081 \ -v dsh-home:/home/node/.dsh \ -e DEEPSEEK_API_KEY \ - ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r4 + ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5 # then open http://localhost:18081/?token=... ``` @@ -94,21 +94,23 @@ ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway | Tag | Contents | Meaning | | --- | --- | --- | -| `dsh-v0.2.1-rc.3-r4` | DSH Web, port `3080` | **Current release identity.** Immutable: once published it never moves. | +| `dsh-v0.2.1-rc.5` | DSH Web, port `3080` | **Current release identity.** Immutable: once published it never moves. | | `latest` | DSH Web | Most recent release; same digest as the current identity. | | `main` | DSH Web | Development channel rebuilt from every push to `main`. Not a release; not for production. | -| `dsh-v0.2.1-rc.3` | DSH Web | **Legacy tag** published before the release-identity scheme. It is not updated. New deployments use `dsh-v0.2.1-rc.3-r4`. | + +Tags published before the release-identity scheme remain on GHCR but are not +updated; new deployments use the current identity. The example gateway is published under its nested path with the same release identity, e.g. -`ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.3-r4`. +`ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.5`. Release identities, channels and rollback rules are explained in [docs/versioning.md](docs/versioning.md). Production deployments should pin a digest: ```bash -docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r4 +docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5 # image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox@sha256: ``` @@ -189,10 +191,9 @@ required checks and releases: [docs/gitflow.md](docs/gitflow.md). The release identity is the upstream DSH ref plus an optional repository revision: `DSH_VERSION` and `RELEASE_REVISION` in [versions.env](versions.env). -The current identity is **`dsh-v0.2.1-rc.3-r4`** — the first release under the -mirrored-DSH scheme at the same upstream DSH ref as the legacy -`dsh-v0.2.1-rc.3` tag. Tags are immutable; a broken release is fixed by -publishing `-r(N+1)`, never by re-tagging. +The current identity is **`dsh-v0.2.1-rc.5`** — the first release at this +upstream DSH ref, so it carries no repository revision. Tags are immutable; a +broken release is fixed by publishing `-r(N+1)`, never by re-tagging. `CHANGELOG.md` is generated by [git-cliff](https://git-cliff.org) from Conventional Commits and is never edited by hand. See diff --git a/docs/README.md b/docs/README.md index 299999c..b90b7ac 100644 --- a/docs/README.md +++ b/docs/README.md @@ -15,7 +15,7 @@ gets a DSH Web container running before anything else. | [main-image.md](main-image.md) | The primary artifact: build args, runtime environment, entrypoint, probes, volumes/ports/signals, non-root contract, image names, tags and digests. | | [examples.md](examples.md) | The example contract: required layout, manifest rules, exposure variants, components and image naming, scripts, docs, and how to add a new example. | | [gitflow.md](gitflow.md) | Branches, protected `main`, squash merges, Conventional PR titles, required CI checks, release branches, hotfixes and the one-time GitHub settings checklist. | -| [versioning.md](versioning.md) | Release identity (`DSH ref` + optional `-rN`), why the current identity is `dsh-v0.2.1-rc.3-r4`, channels, compatibility matrix, bumping pins, the release checklist, rollback, git-cliff and digest pinning. | +| [versioning.md](versioning.md) | Release identity (`DSH ref` + optional `-rN`), the current identity `dsh-v0.2.1-rc.5`, why identities are immutable, channels, compatibility matrix, bumping pins, the release checklist, rollback, git-cliff and digest pinning. | ## Project skills diff --git a/docs/main-image.md b/docs/main-image.md index ec9b162..6789bcb 100644 --- a/docs/main-image.md +++ b/docs/main-image.md @@ -31,11 +31,11 @@ To reproduce the equivalent by hand: ```bash docker build \ - --build-arg DSH_VERSION=dsh-v0.2.1-rc.3 \ - --build-arg RELEASE_REVISION=r4 \ + --build-arg DSH_VERSION=dsh-v0.2.1-rc.5 \ + --build-arg RELEASE_REVISION= \ --build-arg PNPM_VERSION=11.28.5 \ --build-arg VCS_REF="$(git rev-parse --short HEAD)" \ - -t ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r4 . + -t ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5 . ``` ### Build args @@ -164,17 +164,19 @@ GitHub Container Registry: | Tag | Meaning | | --- | --- | -| `dsh-v0.2.1-rc.3-r4` | Current release identity. **Immutable**: once published it never moves. | +| `dsh-v0.2.1-rc.5` | Current release identity. **Immutable**: once published it never moves. | | `latest` | Most recent release; points at the same digest as the current identity. | | `main` | Development channel rebuilt from every push to `main`; not a release, not for production. | -| `dsh-v0.2.1-rc.3` | Legacy tag published before the release-identity scheme existed. Do not use it for new deployments; see the migration table in the [root README](../README.md). | + +Tags published before the release-identity scheme remain published but are not +updated; new deployments use the current identity. Release identities, channels and rollback rules are defined in [versioning](versioning.md). Tags are immutable, so production deployments should pin a digest: ```bash -docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r4 +docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5 # ... pin the digest in your deployment manifests: # image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox@sha256: ``` @@ -182,7 +184,7 @@ docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbo ## Verifying an image ```bash -docker inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r4 \ +docker inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5 \ --format '{{json .Config.Labels}}' # org.opencontainers.image.title / .version / .source ``` diff --git a/docs/versioning.md b/docs/versioning.md index 5d32c61..66dfce2 100644 --- a/docs/versioning.md +++ b/docs/versioning.md @@ -15,34 +15,35 @@ release identity = DSH_VERSION + optional "-" + RELEASE_REVISION | Piece | Meaning | | --- | --- | -| `DSH_VERSION` | The upstream DeepSeek Harness git ref being packaged, e.g. `dsh-v0.2.1-rc.3`. It mirrors upstream's own tag, which is what "mirrored-DSH scheme" means. | +| `DSH_VERSION` | The upstream DeepSeek Harness git ref being packaged, e.g. `dsh-v0.2.1-rc.5`. It mirrors upstream's own tag, which is what "mirrored-DSH scheme" means. | | `RELEASE_REVISION` | An optional repository revision at that DSH ref: empty for the first release, `rN` (`N >= 2`) for a repository-only re-release. | Examples: -- `DSH_VERSION=dsh-v0.2.1-rc.3`, `RELEASE_REVISION=` → identity `dsh-v0.2.1-rc.3` +- `DSH_VERSION=dsh-v0.2.1-rc.5`, `RELEASE_REVISION=` → identity `dsh-v0.2.1-rc.5` (first release at that upstream ref). -- `DSH_VERSION=dsh-v0.2.1-rc.3`, `RELEASE_REVISION=r4` → identity - `dsh-v0.2.1-rc.3-r4` (documentation, CI or gateway changes on top of the same - upstream DSH; no DSH upgrade). +- `DSH_VERSION=`, `RELEASE_REVISION=rN` → identity `-rN` (for example + documentation, CI or gateway changes on top of an already-released ref; no DSH + upgrade). Use `r2` for the first re-release: revision 1 is the plain tag. A DSH upgrade produces a new base identity (for example the next upstream ref with an empty revision); a repository-only change at the same DSH ref increments `rN`. -## Why the current identity is `dsh-v0.2.1-rc.3-r4` +## Why release identities are immutable -The image tag `dsh-v0.2.1-rc.3` was already published to GHCR for an earlier -repository state. **Container tags are immutable** in this project: re-pushing a -tag would silently change what an existing deployment runs. The mirrored-DSH -scheme therefore starts its first identity at `-r2`: the plain tag is -conceptually revision 1 and is taken, so the first publishable repository -revision at the same upstream ref is `r2`. +**Container tags are immutable** in this project: re-pushing a tag would silently +change what an existing deployment runs. A DSH upgrade therefore produces a new +base identity with an empty revision; a repository-only change at an +already-released ref publishes `-rN`, where `r2` is the first re-release (the +plain tag is conceptually revision 1 and is taken). -The identity is stored in [versions.env](../versions.env) and consumed everywhere: -the Dockerfile label, the example manifests, the Makefile and the release -workflow. The legacy `dsh-v0.2.1-rc.3` tag remains published but is not updated; -new deployments use `dsh-v0.2.1-rc.3-r4`. +The current identity is `dsh-v0.2.1-rc.5`, the first release at this upstream +ref, so it carries no revision suffix. The identity is stored in +[versions.env](../versions.env) and consumed everywhere: the Dockerfile label, +the example manifests, the Makefile and the release workflow. Tags published +before the release-identity scheme remain published but are not updated; new +deployments use the current identity. The gateway image moved from the repository-level `:gateway` tag to a nested package (`/dsh-agents-as-a-service/gateway`). The release workflow @@ -54,7 +55,7 @@ should pin the nested package. | Channel | Image tag | Meaning | | --- | --- | --- | -| Release | `dsh-v0.2.1-rc.3-r4` | The current immutable release identity. What production should pin (preferably by digest). | +| Release | `dsh-v0.2.1-rc.5` | The current immutable release identity. What production should pin (preferably by digest). | | `latest` | `latest` | Alias for the most recent release; moves only when a new release is published. | | `main` | `main` | Development channel, rebuilt from every push to `main`. Never treat it as a release; it exists so `main` can be tested. | @@ -68,8 +69,8 @@ Values from [versions.env](../versions.env) at the current identity: | Component | Pin | Source | | --- | --- | --- | | Upstream DSH source | `DSH_REPO` | [versions.env](../versions.env) | -| DSH ref | `dsh-v0.2.1-rc.3` | `DSH_VERSION` | -| Repository revision | `r4` | `RELEASE_REVISION` | +| DSH ref | `dsh-v0.2.1-rc.5` | `DSH_VERSION` | +| Repository revision | `(empty)` | `RELEASE_REVISION` | | pnpm | `11.28.5` | `PNPM_VERSION` | | agent-sandbox (CRDs) | `v1.0.8` | `AGENT_SANDBOX_VERSION`, used by the examples and CI dry-run | | Kubernetes Gateway API | `v1.2.1` | `GATEWAY_API_VERSION`, used by the SSO exposure variant | @@ -153,7 +154,7 @@ Release identities are mutable only in theory; deployments should still pin the resolved digest for reproducibility and supply-chain safety: ```bash -docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r4 +docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5 # then, in the deployment: # image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox@sha256: ``` diff --git a/examples/dsh-agents-as-a-service/README.md b/examples/dsh-agents-as-a-service/README.md index c645fbc..2ac2d15 100644 --- a/examples/dsh-agents-as-a-service/README.md +++ b/examples/dsh-agents-as-a-service/README.md @@ -244,7 +244,7 @@ kubectl delete -f manifests/40-claim-rejected.yaml ```bash # Published image (on kind, load it into the cluster; on a real cluster the # kubelet pulls it from GHCR): -GW=ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.3-r4 +GW=ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.5 docker pull "$GW" kind load docker-image "$GW" --name diff --git a/examples/dsh-agents-as-a-service/docs/optional-hardening.md b/examples/dsh-agents-as-a-service/docs/optional-hardening.md index 8a25c46..8f41d2a 100644 --- a/examples/dsh-agents-as-a-service/docs/optional-hardening.md +++ b/examples/dsh-agents-as-a-service/docs/optional-hardening.md @@ -413,7 +413,7 @@ Secrets; when the same key exists twice, the later `envFrom` entry wins. ### Supported names (curated) -These are the names DSH v0.2.1-rc.3 resolves through its packaged provider +These are the names the pinned DSH release resolves through its packaged provider catalog; the catalog has more entries, these are the common ones: | Provider | Environment variable | diff --git a/examples/dsh-agents-as-a-service/gateway/README.md b/examples/dsh-agents-as-a-service/gateway/README.md index 913d11a..e7e6e9c 100644 --- a/examples/dsh-agents-as-a-service/gateway/README.md +++ b/examples/dsh-agents-as-a-service/gateway/README.md @@ -22,7 +22,7 @@ It does four things: The DSH version pin lives in [`versions.env`](../../../versions.env) (`DSH_VERSION` plus the optional repository `RELEASE_REVISION`); the example manifests and published images use the release identity built from it (currently -`dsh-v0.2.1-rc.3-r4`). DSH binds `:3080`, serves `/`, gates `/api` behind a +`dsh-v0.2.1-rc.5`). DSH binds `:3080`, serves `/`, gates `/api` behind a `dsh-auth-*` cookie and requires a WebSocket at `/api/remote.mux`. ## Flow diff --git a/examples/dsh-agents-as-a-service/manifests/10-sandboxtemplate.yaml b/examples/dsh-agents-as-a-service/manifests/10-sandboxtemplate.yaml index 9583765..9583fe7 100644 --- a/examples/dsh-agents-as-a-service/manifests/10-sandboxtemplate.yaml +++ b/examples/dsh-agents-as-a-service/manifests/10-sandboxtemplate.yaml @@ -73,7 +73,7 @@ spec: fsGroupChangePolicy: OnRootMismatch containers: - name: dsh-web - image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r4 + image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5 imagePullPolicy: IfNotPresent ports: - name: web diff --git a/examples/dsh-agents-as-a-service/manifests/50-gateway.yaml b/examples/dsh-agents-as-a-service/manifests/50-gateway.yaml index d962d3b..39b2ff1 100644 --- a/examples/dsh-agents-as-a-service/manifests/50-gateway.yaml +++ b/examples/dsh-agents-as-a-service/manifests/50-gateway.yaml @@ -101,7 +101,7 @@ spec: type: RuntimeDefault containers: - name: gateway - image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.3-r4 + image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.5 imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false diff --git a/examples/minimal-single-tenant/manifests/sandbox-template.yaml b/examples/minimal-single-tenant/manifests/sandbox-template.yaml index 53ee509..3b53d7a 100644 --- a/examples/minimal-single-tenant/manifests/sandbox-template.yaml +++ b/examples/minimal-single-tenant/manifests/sandbox-template.yaml @@ -56,7 +56,7 @@ spec: fsGroupChangePolicy: OnRootMismatch containers: - name: dsh-web - image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r4 + image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5 imagePullPolicy: IfNotPresent ports: - name: web diff --git a/scripts/set-version.sh b/scripts/set-version.sh index b9ccc41..e8ff652 100755 --- a/scripts/set-version.sh +++ b/scripts/set-version.sh @@ -3,7 +3,7 @@ # "make check". # # ./scripts/set-version.sh dsh-v0.2.2-rc.1 # new DSH ref, no revision -# ./scripts/set-version.sh dsh-v0.2.1-rc.3 r3 # same ref, new repo revision +# ./scripts/set-version.sh dsh-v0.2.1-rc.5 r3 # same ref, new repo revision set -euo pipefail cd "$(dirname "$0")/.." diff --git a/versions.env b/versions.env index 6a50c1e..c7feea8 100644 --- a/versions.env +++ b/versions.env @@ -5,15 +5,15 @@ # Upstream DeepSeek Harness source, and the ref this repository packages. DSH_REPO=https://github.com/deepseek-ai/deepseek-harness.git -DSH_VERSION=dsh-v0.2.1-rc.3 +DSH_VERSION=dsh-v0.2.1-rc.5 PNPM_VERSION=11.28.5 # Release identity = DSH_VERSION plus an optional repository revision. # An empty RELEASE_REVISION is the first release at this DSH ref; rN (N >= 2) -# marks a repository-only re-release at the same DSH ref. The dsh-v0.2.1-rc.3 -# image tag is already published on GHCR and tags are immutable, so the current -# scheme started at -r2; the current identity is dsh-v0.2.1-rc.3-r4. -RELEASE_REVISION=r4 +# marks a repository-only re-release at the same DSH ref. This is the first +# release at dsh-v0.2.1-rc.5, so the identity is the plain tag; a later +# repository-only change at the same ref becomes -r2. +RELEASE_REVISION= # Control-plane versions used by the examples and their manifests. AGENT_SANDBOX_VERSION=v1.0.8