Fix docker publish (#697)

* fix migrations + do docker builds in parallel

* do arm64 build on arm runner

* regenerate new migrations

* migration validation

* temporarily modify journal

* fetch previous commit

* bruh

* another test

* fix

* use v4 actions

* fix image manifest

Author: Brendonovich

.github/workflows/docker-build-web.yml

@@ -11,8 +11,16 @@ on:
 
 jobs:
   build:
-    name: Build Docker Image
-    runs-on: ubuntu-latest
+    name: Build Docker Image (${{ matrix.platform }})
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      matrix:
+        include:
+          - platform: amd64
+            runner: ubuntu-24.04
+          - platform: arm64
+            runner: ubuntu-24.04-arm
+      fail-fast: false
     permissions:
       contents: read
       packages: write
@@ -39,25 +47,59 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Prepare Docker Metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/capsoftware/cap-web
-          tags: |
-            type=raw,value=${{ inputs.tag || 'latest' }}
-
-      - name: Build Docker Image
+      - name: Build and Push Platform Image
+        id: build
         uses: docker/build-push-action@v5
         with:
           context: .
           file: apps/web/Dockerfile
-          platforms: linux/amd64,linux/arm64
-          tags: ${{ steps.meta.outputs.tags }}
+          platforms: linux/${{ matrix.platform }}
           push: true
-          load: false
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          outputs: type=image,name=ghcr.io/capsoftware/cap-web,push-by-digest=true
+          cache-from: type=gha,scope=buildx-${{ matrix.platform }}
+          cache-to: type=gha,mode=max,scope=buildx-${{ matrix.platform }}
+
+      - name: Export Digest
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "/tmp/digests/${digest#sha256:}"
+
+      - name: Upload Digest
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-${{ matrix.platform }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  merge:
+    name: Create Multi-Architecture Manifest
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Download Digests
+        uses: actions/download-artifact@v4
+        with:
+          path: /tmp/digests
+          pattern: digests-*
+          merge-multiple: true
 
-      - name: Show Docker Images
-        run: docker images
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create Image Manifest
+        run: |
+          docker buildx imagetools create -t ghcr.io/capsoftware/cap-web:${{ inputs.tag || 'latest' }} \
+            $(find /tmp/digests -type f -not -path "*/\.*" -exec basename {} \; | xargs -I {} echo "ghcr.io/capsoftware/cap-web@sha256:{}")

.github/workflows/validate-migration-journal.yml

@@ -0,0 +1,76 @@
+name: Validate Migrations
+
+on:
+  pull_request:
+    paths:
+      - "packages/database/migrations/**"
+
+jobs:
+  validate-journal:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout PR branch
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Validate journal is append-only
+        run: |
+          JOURNAL_PATH="packages/database/migrations/meta/_journal.json"
+
+          # Get the journal from previous commit
+          git fetch origin
+
+          # Check if journal exists in previous commit
+          if git show 34cd664a1215:$JOURNAL_PATH > /dev/null 2>&1; then
+            git show 34cd664a1215:$JOURNAL_PATH > base.json
+          else
+            echo '{"version":"5","dialect":"mysql","entries":[]}' > base.json
+          fi
+
+          # Get current journal
+          cp $JOURNAL_PATH current.json
+
+          # Check version and dialect haven't changed
+          BASE_VERSION=$(jq -r '.version' base.json)
+          CURRENT_VERSION=$(jq -r '.version' current.json)
+          if [ "$BASE_VERSION" != "$CURRENT_VERSION" ]; then
+            echo "::error file=$JOURNAL_PATH,line=2,title=Version Changed::Migration journal version cannot be changed (was: $BASE_VERSION, now: $CURRENT_VERSION)"
+            exit 1
+          fi
+
+          BASE_DIALECT=$(jq -r '.dialect' base.json)
+          CURRENT_DIALECT=$(jq -r '.dialect' current.json)
+          if [ "$BASE_DIALECT" != "$CURRENT_DIALECT" ]; then
+            echo "::error file=$JOURNAL_PATH,line=3,title=Dialect Changed::Migration journal dialect cannot be changed (was: $BASE_DIALECT, now: $CURRENT_DIALECT)"
+            exit 1
+          fi
+
+          # Check that entries weren't removed
+          BASE_COUNT=$(jq '.entries | length' base.json)
+          CURRENT_COUNT=$(jq '.entries | length' current.json)
+          if [ "$CURRENT_COUNT" -lt "$BASE_COUNT" ]; then
+            echo "::error file=$JOURNAL_PATH,title=Entries Removed::Migration entries cannot be removed (base has $BASE_COUNT entries, current has $CURRENT_COUNT)"
+            exit 1
+          fi
+
+          # Extract and compare the overlapping entries
+          jq --argjson n "$BASE_COUNT" '.entries[:$n]' current.json > current_overlap.json
+          jq '.entries' base.json > base_entries.json
+
+          if ! diff -q base_entries.json current_overlap.json > /dev/null; then
+            echo "::error file=$JOURNAL_PATH,title=Existing Entries Modified::Existing migration entries have been modified. Migrations are append-only."
+
+            # Find which entry was modified using jq
+            for i in $(seq 0 $((BASE_COUNT - 1))); do
+              BASE_ENTRY=$(jq ".entries[$i]" base.json)
+              CURRENT_ENTRY=$(jq ".entries[$i]" current.json)
+              if [ "$BASE_ENTRY" != "$CURRENT_ENTRY" ]; then
+                TAG=$(echo "$BASE_ENTRY" | jq -r '.tag')
+                echo "::error file=$JOURNAL_PATH,title=Entry Modified::Migration entry '$TAG' (index $i) was modified"
+              fi
+            done
+            exit 1
+          fi
+
+          echo "::notice file=$JOURNAL_PATH,title=Journal Valid::✅ Migration journal validation passed! ($((CURRENT_COUNT - BASE_COUNT)) new entries added)"

…migrations/0002_zippy_rocket_raccoon.sql …tabase/migrations/0002_dusty_maginty.sqlpackages/database/migrations/0002_zippy_rocket_raccoon.sql renamed to packages/database/migrations/0002_dusty_maginty.sql packages/database/migrations/0002_zippy_rocket_raccoon.sql renamed to packages/database/migrations/0002_dusty_maginty.sql

@@ -2,7 +2,7 @@ CREATE TABLE `space_members` (
 	`id` varchar(15) NOT NULL,
 	`spaceId` varchar(15) NOT NULL,
 	`userId` varchar(15) NOT NULL,
-	`role` varchar(255) NOT NULL,
+	`role` varchar(255) NOT NULL DEFAULT 'member',
 	`createdAt` timestamp NOT NULL DEFAULT (now()),
 	`updatedAt` timestamp NOT NULL DEFAULT (now()) ON UPDATE CURRENT_TIMESTAMP,
 	CONSTRAINT `space_members_id` PRIMARY KEY(`id`),
@@ -21,12 +21,15 @@ CREATE TABLE `space_videos` (
 --> statement-breakpoint
 CREATE TABLE `spaces` (
 	`id` varchar(15) NOT NULL,
+	`primary` boolean NOT NULL DEFAULT false,
 	`name` varchar(255) NOT NULL,
 	`organizationId` varchar(15) NOT NULL,
 	`createdById` varchar(15) NOT NULL,
+	`iconUrl` varchar(255),
 	`description` varchar(1000),
 	`createdAt` timestamp NOT NULL DEFAULT (now()),
 	`updatedAt` timestamp NOT NULL DEFAULT (now()) ON UPDATE CURRENT_TIMESTAMP,
+	`privacy` varchar(255) NOT NULL DEFAULT 'Private',
 	CONSTRAINT `spaces_id` PRIMARY KEY(`id`),
 	CONSTRAINT `spaces_id_unique` UNIQUE(`id`)
 );