From c1f60d9507f275297d1d98e2c2b4607032e0c703 Mon Sep 17 00:00:00 2001 From: luisalrp Date: Mon, 7 Sep 2026 15:18:19 +0200 Subject: [PATCH 1/3] ci(docker): publish editor image to ghcr --- .github/workflows/docker.yml | 36 ++++++++++++++++++++++++++++++++++++ SETUP.md | 10 ++++++++-- docker-compose.yml | 2 +- 3 files changed, 45 insertions(+), 3 deletions(-) create mode 100644 .github/workflows/docker.yml diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml new file mode 100644 index 0000000000..90259ab84b --- /dev/null +++ b/.github/workflows/docker.yml @@ -0,0 +1,36 @@ +name: Docker + +on: + push: + tags: + - '@pascal-app/editor@*' + +permissions: + contents: read + packages: write + +jobs: + publish: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Extract release version + id: version + run: echo "version=${GITHUB_REF_NAME##*@}" >> "$GITHUB_OUTPUT" + + - name: Log in to GHCR + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Build and publish image + uses: docker/build-push-action@v6 + with: + context: . + push: true + tags: | + ghcr.io/pascalorg/editor:latest + ghcr.io/pascalorg/editor:${{ steps.version.outputs.version }} diff --git a/SETUP.md b/SETUP.md index 80c33bc024..a2343c22ba 100644 --- a/SETUP.md +++ b/SETUP.md @@ -34,8 +34,14 @@ Local development and the official hosted editor work without any environment va docker compose up -d ``` -The editor will be running at **http://localhost:3000**. Saved scenes live in -the `pascal-data` volume, so they survive `docker compose down`. +The editor will be running at **http://localhost:3000**. Compose pulls the official +image from GHCR; set `IMAGE_TAG` to use a release instead of `latest`: + +```bash +IMAGE_TAG=1.0.0 docker compose up -d +``` + +Saved scenes live in the `pascal-data` volume, so they survive `docker compose down`. Docker defaults `MINT_PASCAL_HOST_ORIGIN` to `http://localhost:3000`. Override it when hosting Pascal at another origin: diff --git a/docker-compose.yml b/docker-compose.yml index 55a169220a..9ae0eef885 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,6 +1,6 @@ services: editor: - build: . + image: ghcr.io/pascalorg/editor:${IMAGE_TAG:-latest} ports: # Keep the container port at 3000. `/scenes` fetches its own API through a # base URL that only `NEXT_PUBLIC_APP_URL` can override, and Next inlines From b10b01de045c1e1b2fa7c7cc19eea1d3cfcaa59f Mon Sep 17 00:00:00 2001 From: luisalrp Date: Mon, 7 Sep 2026 15:33:22 +0200 Subject: [PATCH 2/3] fix(ci): publish Docker image with releases --- .github/workflows/docker.yml | 36 ----------------------------------- .github/workflows/release.yml | 32 +++++++++++++++++++++++++++++++ Dockerfile | 1 + SETUP.md | 5 +++++ 4 files changed, 38 insertions(+), 36 deletions(-) delete mode 100644 .github/workflows/docker.yml diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml deleted file mode 100644 index 90259ab84b..0000000000 --- a/.github/workflows/docker.yml +++ /dev/null @@ -1,36 +0,0 @@ -name: Docker - -on: - push: - tags: - - '@pascal-app/editor@*' - -permissions: - contents: read - packages: write - -jobs: - publish: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - - name: Extract release version - id: version - run: echo "version=${GITHUB_REF_NAME##*@}" >> "$GITHUB_OUTPUT" - - - name: Log in to GHCR - uses: docker/login-action@v3 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Build and publish image - uses: docker/build-push-action@v6 - with: - context: . - push: true - tags: | - ghcr.io/pascalorg/editor:latest - ghcr.io/pascalorg/editor:${{ steps.version.outputs.version }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 560eaeda86..4e8fb00ab0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -69,6 +69,7 @@ jobs: environment: npm permissions: contents: write + packages: write steps: - uses: actions/checkout@v4 with: @@ -292,6 +293,37 @@ jobs: echo "📦 Published @pascal-app/editor@$EDITOR_VERSION" fi + - name: Prepare Docker image tags + if: inputs.package == 'editor' || inputs.package == 'all' + id: docker-tags + env: + BUMP: ${{ inputs.bump }} + run: | + { + echo 'tags<> "$GITHUB_OUTPUT" + + - name: Log in to GHCR + if: (inputs.package == 'editor' || inputs.package == 'all') && inputs.dry-run == false + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Build & publish Docker image + if: inputs.package == 'editor' || inputs.package == 'all' + uses: docker/build-push-action@v6 + with: + context: . + push: ${{ inputs.dry-run == false }} + tags: ${{ steps.docker-tags.outputs.tags }} + - name: Build & publish nodes if: inputs.package == 'nodes' || inputs.package == 'all' working-directory: packages/nodes diff --git a/Dockerfile b/Dockerfile index 11741c8318..9583f072a4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,7 @@ # Matches `packageManager` in package.json and the version CI installs — a skew # here is what makes `--frozen-lockfile` fail inside the image but not locally. FROM oven/bun:1.3.14-alpine +LABEL org.opencontainers.image.source="https://github.com/pascalorg/editor" WORKDIR /app # `next build` runs under `node`, and this image's `node` is a shim that re-execs diff --git a/SETUP.md b/SETUP.md index a2343c22ba..070eee0c3b 100644 --- a/SETUP.md +++ b/SETUP.md @@ -41,6 +41,11 @@ image from GHCR; set `IMAGE_TAG` to use a release instead of `latest`: IMAGE_TAG=1.0.0 docker compose up -d ``` +The `editor` package must be public in the `pascalorg` organization's GHCR packages +for unauthenticated deployments. After the first release, open the package settings +under the organization's Packages page, set its visibility to **Public**, and connect +it to `pascalorg/editor`. Maintainers only need to configure this once. + Saved scenes live in the `pascal-data` volume, so they survive `docker compose down`. Docker defaults `MINT_PASCAL_HOST_ORIGIN` to `http://localhost:3000`. Override From fdd0475720fc681853b3c59c6b36a0d758b56565 Mon Sep 17 00:00:00 2001 From: luisalrp Date: Mon, 7 Sep 2026 15:47:49 +0200 Subject: [PATCH 3/3] fix(ci): publish stable Docker tags and ARM images --- .github/workflows/release.yml | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4e8fb00ab0..595340770f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -302,9 +302,11 @@ jobs: { echo 'tags<> "$GITHUB_OUTPUT" @@ -316,11 +318,20 @@ jobs: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} + - name: Set up QEMU + if: inputs.package == 'editor' || inputs.package == 'all' + uses: docker/setup-qemu-action@v3 + + - name: Set up Docker Buildx + if: inputs.package == 'editor' || inputs.package == 'all' + uses: docker/setup-buildx-action@v3 + - name: Build & publish Docker image if: inputs.package == 'editor' || inputs.package == 'all' uses: docker/build-push-action@v6 with: context: . + platforms: linux/amd64,linux/arm64 push: ${{ inputs.dry-run == false }} tags: ${{ steps.docker-tags.outputs.tags }}