diff --git a/.env.sample b/.env.sample index 504df86..1afcf45 100644 --- a/.env.sample +++ b/.env.sample @@ -5,8 +5,8 @@ # --- Main DSH Web image (root Dockerfile) --- DEEPSEEK_API_KEY= -DSH_VERSION=dsh-v0.2.1-rc.2 -RELEASE_REVISION=r2 +DSH_VERSION=dsh-v0.2.1-rc.3 +RELEASE_REVISION=r3 PNPM_VERSION=11.28.5 # Container port, and the host port published by "make run". DSH_PORT=3080 diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index 03b166c..8fd9173 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -28,7 +28,7 @@ body: id: image-tag attributes: label: Image or release - description: The pinned tag or digest, for example dsh-v0.2.1-rc.2-r2. + description: The pinned tag or digest, for example dsh-v0.2.1-rc.3-r3. - type: input id: cluster attributes: diff --git a/AGENTS.md b/AGENTS.md index c1539fd..71958fc 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -79,9 +79,9 @@ needs kind plus the agent-sandbox CRDs (see the example README). ## Versioning and releases - Release identity = DSH_VERSION, optionally with a repository revision suffix - for re-releases at the same DSH ref (first release: dsh-v0.2.1-rc.2-r2). -- The current identity is dsh-v0.2.1-rc.2-r2 (stored in versions.env). The - dsh-v0.2.1-rc.2 image tag already exists and tags are immutable, which is why + for re-releases at the same DSH ref (first release: dsh-v0.2.1-rc.3-r3). +- The current identity is dsh-v0.2.1-rc.3-r3 (stored in versions.env). The + dsh-v0.2.1-rc.3 image tag already exists and tags are immutable, which is why the first release under this scheme carries -r2. - Channels: release tags are immutable; latest follows the newest release; main is the development channel for both image packages. diff --git a/Dockerfile b/Dockerfile index c644fc1..e008bd2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -20,7 +20,7 @@ ARG NODE_RUNTIME_IMAGE=docker.io/node:24-trixie-slim FROM $NODE_BUILD_IMAGE AS build ARG DSH_REPO=https://github.com/deepseek-ai/deepseek-harness.git -ARG DSH_VERSION=dsh-v0.2.1-rc.2 +ARG DSH_VERSION=dsh-v0.2.1-rc.3 ARG PNPM_VERSION=11.28.5 ENV CI=true \ @@ -57,8 +57,8 @@ RUN cd /opt/dsh \ # --------------------------------------------------------------------------- FROM $NODE_RUNTIME_IMAGE AS runtime -ARG DSH_VERSION=dsh-v0.2.1-rc.2 -ARG RELEASE_REVISION=r2 +ARG DSH_VERSION=dsh-v0.2.1-rc.3 +ARG RELEASE_REVISION=r3 ARG PNPM_VERSION=11.28.5 ARG VCS_REF=unknown diff --git a/README.md b/README.md index 69a6a74..bb34e1a 100644 --- a/README.md +++ b/README.md @@ -20,7 +20,7 @@ docker run -d --name dsh-web \ -p 3080:3080 \ -v dsh-home:/home/node/.dsh \ -e DEEPSEEK_API_KEY \ - ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.2-r2 + ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r3 ``` DSH Web is **not usable at a bare `/`**. Without its launch-token cookie it @@ -45,7 +45,7 @@ docker run -d --name dsh-web -p 18081:3080 \ -e DSH_PUBLIC_URL=http://localhost:18081 \ -v dsh-home:/home/node/.dsh \ -e DEEPSEEK_API_KEY \ - ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.2-r2 + ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r3 # then open http://localhost:18081/?token=... ``` @@ -87,21 +87,21 @@ ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway | Tag | Contents | Meaning | | --- | --- | --- | -| `dsh-v0.2.1-rc.2-r2` | DSH Web, port `3080` | **Current release identity.** Immutable: once published it never moves. | +| `dsh-v0.2.1-rc.3-r3` | DSH Web, port `3080` | **Current release identity.** Immutable: once published it never moves. | | `latest` | DSH Web | Most recent release; same digest as the current identity. | | `main` | DSH Web | Development channel rebuilt from every push to `main`. Not a release; not for production. | -| `dsh-v0.2.1-rc.2` | DSH Web | **Legacy tag** published before the release-identity scheme. It is not updated. New deployments use `dsh-v0.2.1-rc.2-r2`. | +| `dsh-v0.2.1-rc.3` | DSH Web | **Legacy tag** published before the release-identity scheme. It is not updated. New deployments use `dsh-v0.2.1-rc.3-r3`. | The example gateway is published under its nested path with the same release identity, e.g. -`ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.2-r2`. +`ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.3-r3`. Release identities, channels and rollback rules are explained in [docs/versioning.md](docs/versioning.md). Production deployments should pin a digest: ```bash -docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.2-r2 +docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r3 # image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox@sha256: ``` @@ -170,9 +170,9 @@ required checks and releases: [docs/gitflow.md](docs/gitflow.md). The release identity is the upstream DSH ref plus an optional repository revision: `DSH_VERSION` and `RELEASE_REVISION` in [versions.env](versions.env). -The current identity is **`dsh-v0.2.1-rc.2-r2`** — the first release under the +The current identity is **`dsh-v0.2.1-rc.3-r3`** — the first release under the mirrored-DSH scheme at the same upstream DSH ref as the legacy -`dsh-v0.2.1-rc.2` tag. Tags are immutable; a broken release is fixed by +`dsh-v0.2.1-rc.3` tag. Tags are immutable; a broken release is fixed by publishing `-r(N+1)`, never by re-tagging. `CHANGELOG.md` is generated by [git-cliff](https://git-cliff.org) from diff --git a/docs/README.md b/docs/README.md index 11e08d1..75e94da 100644 --- a/docs/README.md +++ b/docs/README.md @@ -15,7 +15,7 @@ gets a DSH Web container running before anything else. | [main-image.md](main-image.md) | The primary artifact: build args, runtime environment, entrypoint, probes, volumes/ports/signals, non-root contract, image names, tags and digests. | | [examples.md](examples.md) | The example contract: required layout, manifest rules, exposure variants, components and image naming, scripts, docs, and how to add a new example. | | [gitflow.md](gitflow.md) | Branches, protected `main`, squash merges, Conventional PR titles, required CI checks, release branches, hotfixes and the one-time GitHub settings checklist. | -| [versioning.md](versioning.md) | Release identity (`DSH ref` + optional `-rN`), why the current identity is `dsh-v0.2.1-rc.2-r2`, channels, compatibility matrix, bumping pins, the release checklist, rollback, git-cliff and digest pinning. | +| [versioning.md](versioning.md) | Release identity (`DSH ref` + optional `-rN`), why the current identity is `dsh-v0.2.1-rc.3-r3`, channels, compatibility matrix, bumping pins, the release checklist, rollback, git-cliff and digest pinning. | ## Example documentation diff --git a/docs/main-image.md b/docs/main-image.md index f7ab861..03d267a 100644 --- a/docs/main-image.md +++ b/docs/main-image.md @@ -31,11 +31,11 @@ To reproduce the equivalent by hand: ```bash docker build \ - --build-arg DSH_VERSION=dsh-v0.2.1-rc.2 \ + --build-arg DSH_VERSION=dsh-v0.2.1-rc.3 \ --build-arg RELEASE_REVISION=r2 \ --build-arg PNPM_VERSION=11.28.5 \ --build-arg VCS_REF="$(git rev-parse --short HEAD)" \ - -t ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.2-r2 . + -t ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r3 . ``` ### Build args @@ -142,17 +142,17 @@ GitHub Container Registry: | Tag | Meaning | | --- | --- | -| `dsh-v0.2.1-rc.2-r2` | Current release identity. **Immutable**: once published it never moves. | +| `dsh-v0.2.1-rc.3-r3` | Current release identity. **Immutable**: once published it never moves. | | `latest` | Most recent release; points at the same digest as the current identity. | | `main` | Development channel rebuilt from every push to `main`; not a release, not for production. | -| `dsh-v0.2.1-rc.2` | Legacy tag published before the release-identity scheme existed. Do not use it for new deployments; see the migration table in the [root README](../README.md). | +| `dsh-v0.2.1-rc.3` | Legacy tag published before the release-identity scheme existed. Do not use it for new deployments; see the migration table in the [root README](../README.md). | Release identities, channels and rollback rules are defined in [versioning](versioning.md). Tags are immutable, so production deployments should pin a digest: ```bash -docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.2-r2 +docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r3 # ... pin the digest in your deployment manifests: # image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox@sha256: ``` @@ -160,7 +160,7 @@ docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbo ## Verifying an image ```bash -docker inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.2-r2 \ +docker inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r3 \ --format '{{json .Config.Labels}}' # org.opencontainers.image.title / .version / .source ``` diff --git a/docs/versioning.md b/docs/versioning.md index 2f68155..bec5dff 100644 --- a/docs/versioning.md +++ b/docs/versioning.md @@ -15,24 +15,24 @@ release identity = DSH_VERSION + optional "-" + RELEASE_REVISION | Piece | Meaning | | --- | --- | -| `DSH_VERSION` | The upstream DeepSeek Harness git ref being packaged, e.g. `dsh-v0.2.1-rc.2`. It mirrors upstream's own tag, which is what "mirrored-DSH scheme" means. | +| `DSH_VERSION` | The upstream DeepSeek Harness git ref being packaged, e.g. `dsh-v0.2.1-rc.3`. It mirrors upstream's own tag, which is what "mirrored-DSH scheme" means. | | `RELEASE_REVISION` | An optional repository revision at that DSH ref: empty for the first release, `rN` (`N >= 2`) for a repository-only re-release. | Examples: -- `DSH_VERSION=dsh-v0.2.1-rc.2`, `RELEASE_REVISION=` → identity `dsh-v0.2.1-rc.2` +- `DSH_VERSION=dsh-v0.2.1-rc.3`, `RELEASE_REVISION=` → identity `dsh-v0.2.1-rc.3` (first release at that upstream ref). -- `DSH_VERSION=dsh-v0.2.1-rc.2`, `RELEASE_REVISION=r2` → identity - `dsh-v0.2.1-rc.2-r2` (documentation, CI or gateway changes on top of the same +- `DSH_VERSION=dsh-v0.2.1-rc.3`, `RELEASE_REVISION=r2` → identity + `dsh-v0.2.1-rc.3-r3` (documentation, CI or gateway changes on top of the same upstream DSH; no DSH upgrade). A DSH upgrade produces a new base identity (for example the next upstream ref with an empty revision); a repository-only change at the same DSH ref increments `rN`. -## Why the current identity is `dsh-v0.2.1-rc.2-r2` +## Why the current identity is `dsh-v0.2.1-rc.3-r3` -The image tag `dsh-v0.2.1-rc.2` was already published to GHCR for an earlier +The image tag `dsh-v0.2.1-rc.3` was already published to GHCR for an earlier repository state. **Container tags are immutable** in this project: re-pushing a tag would silently change what an existing deployment runs. The mirrored-DSH scheme therefore starts its first identity at `-r2`: the plain tag is @@ -41,8 +41,8 @@ revision at the same upstream ref is `r2`. The identity is stored in [versions.env](../versions.env) and consumed everywhere: the Dockerfile label, the example manifests, the Makefile and the release -workflow. The legacy `dsh-v0.2.1-rc.2` tag remains published but is not updated; -new deployments use `dsh-v0.2.1-rc.2-r2`. +workflow. The legacy `dsh-v0.2.1-rc.3` tag remains published but is not updated; +new deployments use `dsh-v0.2.1-rc.3-r3`. The gateway image moved from the repository-level `:gateway` tag to a nested package (`/dsh-agents-as-a-service/gateway`). For exactly one @@ -54,7 +54,7 @@ release, so deployments should pin the nested package. | Channel | Image tag | Meaning | | --- | --- | --- | -| Release | `dsh-v0.2.1-rc.2-r2` | The current immutable release identity. What production should pin (preferably by digest). | +| Release | `dsh-v0.2.1-rc.3-r3` | The current immutable release identity. What production should pin (preferably by digest). | | `latest` | `latest` | Alias for the most recent release; moves only when a new release is published. | | `main` | `main` | Development channel, rebuilt from every push to `main`. Never treat it as a release; it exists so `main` can be tested. | @@ -68,7 +68,7 @@ Values from [versions.env](../versions.env) at the current identity: | Component | Pin | Source | | --- | --- | --- | | Upstream DSH source | `DSH_REPO` | [versions.env](../versions.env) | -| DSH ref | `dsh-v0.2.1-rc.2` | `DSH_VERSION` | +| DSH ref | `dsh-v0.2.1-rc.3` | `DSH_VERSION` | | Repository revision | `r2` | `RELEASE_REVISION` | | pnpm | `11.28.5` | `PNPM_VERSION` | | agent-sandbox (CRDs) | `v1.0.7` | `AGENT_SANDBOX_VERSION`, used by the examples and CI dry-run | @@ -153,7 +153,7 @@ Release identities are mutable only in theory; deployments should still pin the resolved digest for reproducibility and supply-chain safety: ```bash -docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.2-r2 +docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r3 # then, in the deployment: # image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox@sha256: ``` diff --git a/examples/dsh-agents-as-a-service/README.md b/examples/dsh-agents-as-a-service/README.md index fde7fe7..3d9b1dd 100644 --- a/examples/dsh-agents-as-a-service/README.md +++ b/examples/dsh-agents-as-a-service/README.md @@ -213,7 +213,7 @@ kubectl delete -f manifests/40-claim-rejected.yaml ```bash # Published image (on kind, load it into the cluster; on a real cluster the # kubelet pulls it from GHCR): -GW=ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.2-r2 +GW=ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.3-r3 docker pull "$GW" kind load docker-image "$GW" --name diff --git a/examples/dsh-agents-as-a-service/gateway/README.md b/examples/dsh-agents-as-a-service/gateway/README.md index 2ba1287..da51243 100644 --- a/examples/dsh-agents-as-a-service/gateway/README.md +++ b/examples/dsh-agents-as-a-service/gateway/README.md @@ -22,7 +22,7 @@ It does four things: The DSH version pin lives in [`versions.env`](../../../versions.env) (`DSH_VERSION` plus the optional repository `RELEASE_REVISION`); the example manifests and published images use the release identity built from it (currently -`dsh-v0.2.1-rc.2-r2`). DSH binds `:3080`, serves `/`, gates `/api` behind a +`dsh-v0.2.1-rc.3-r3`). DSH binds `:3080`, serves `/`, gates `/api` behind a `dsh-auth-*` cookie and requires a WebSocket at `/api/remote.mux`. ## Flow diff --git a/examples/dsh-agents-as-a-service/manifests/10-sandboxtemplate.yaml b/examples/dsh-agents-as-a-service/manifests/10-sandboxtemplate.yaml index 6cf52ff..3151415 100644 --- a/examples/dsh-agents-as-a-service/manifests/10-sandboxtemplate.yaml +++ b/examples/dsh-agents-as-a-service/manifests/10-sandboxtemplate.yaml @@ -49,7 +49,7 @@ spec: fsGroupChangePolicy: OnRootMismatch containers: - name: dsh-web - image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.2-r2 + image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r3 imagePullPolicy: IfNotPresent ports: - name: web diff --git a/examples/dsh-agents-as-a-service/manifests/50-gateway.yaml b/examples/dsh-agents-as-a-service/manifests/50-gateway.yaml index e56b4a4..b492eae 100644 --- a/examples/dsh-agents-as-a-service/manifests/50-gateway.yaml +++ b/examples/dsh-agents-as-a-service/manifests/50-gateway.yaml @@ -92,7 +92,7 @@ spec: type: RuntimeDefault containers: - name: gateway - image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.2-r2 + image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.3-r3 imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false diff --git a/examples/minimal-single-tenant/manifests/sandbox-template.yaml b/examples/minimal-single-tenant/manifests/sandbox-template.yaml index b055d6b..1b17827 100644 --- a/examples/minimal-single-tenant/manifests/sandbox-template.yaml +++ b/examples/minimal-single-tenant/manifests/sandbox-template.yaml @@ -35,7 +35,7 @@ spec: fsGroupChangePolicy: OnRootMismatch containers: - name: dsh-web - image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.2-r2 + image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r3 imagePullPolicy: IfNotPresent ports: - name: web diff --git a/scripts/set-version.sh b/scripts/set-version.sh index e45f9b5..b9ccc41 100755 --- a/scripts/set-version.sh +++ b/scripts/set-version.sh @@ -3,7 +3,7 @@ # "make check". # # ./scripts/set-version.sh dsh-v0.2.2-rc.1 # new DSH ref, no revision -# ./scripts/set-version.sh dsh-v0.2.1-rc.2 r3 # same ref, new repo revision +# ./scripts/set-version.sh dsh-v0.2.1-rc.3 r3 # same ref, new repo revision set -euo pipefail cd "$(dirname "$0")/.." diff --git a/versions.env b/versions.env index 637baf6..ef1ccfe 100644 --- a/versions.env +++ b/versions.env @@ -5,15 +5,15 @@ # Upstream DeepSeek Harness source, and the ref this repository packages. DSH_REPO=https://github.com/deepseek-ai/deepseek-harness.git -DSH_VERSION=dsh-v0.2.1-rc.2 +DSH_VERSION=dsh-v0.2.1-rc.3 PNPM_VERSION=11.28.5 # Release identity = DSH_VERSION plus an optional repository revision. # An empty RELEASE_REVISION is the first release at this DSH ref; rN (N >= 2) -# marks a repository-only re-release at the same DSH ref. The dsh-v0.2.1-rc.2 +# marks a repository-only re-release at the same DSH ref. The dsh-v0.2.1-rc.3 # image tag is already published on GHCR and tags are immutable, so the first -# release under the current scheme is dsh-v0.2.1-rc.2-r2. -RELEASE_REVISION=r2 +# release under the current scheme is dsh-v0.2.1-rc.3-r3. +RELEASE_REVISION=r3 # Control-plane versions used by the examples and their manifests. AGENT_SANDBOX_VERSION=v1.0.7