Previously release.yml fully rebuilt and re-ran lint/typecheck/test/build
from source on every tag push, duplicating what ci.yml had already just
verified on main. Now ci.yml builds and pushes the image (tagged by commit
SHA) once, right after its checks pass, but only for pushes to main.
release.yml no longer builds anything: it pulls that exact image, retags
it as the release version + latest, and deploys it.
This guarantees the deployed image is byte-for-byte what CI verified, and
turns "tag a commit that was never pushed to main or hasn't finished CI"
into a loud, immediate failure (no image to promote) instead of a rebuild
that silently skips the checks.
- Restrict meetingPassword field so it isn't leaked via the public REST/GraphQL API
- Fix booking slot computation to use Europe/Berlin time instead of the server's UTC clock
- Reset email verification when a customer changes their email address
- Fix ICS calendar injection via unescaped carriage returns in event descriptions
- Bind WebRTC meeting kicks to a persistent client id so they survive a rejoin
- Move the meeting signaling token out of the WebSocket query string into the first message
- Prevent duplicate signaling connections from leaking when the same participant reconnects
- Use the rightmost X-Forwarded-For entry for rate limiting (single trusted reverse proxy)
- Use constant-time comparison for the cron endpoint's bearer token
- Remove SVG from allowed Media upload types (stored-XSS risk, unused anyway)
- Add baseline security headers and a CSP to next.config.ts
- Fix CI/CD script injection via unsanitized git ref names in release.yml
Gitea Actions runs `run:` steps with `sh` by default, which doesn't
support bash's `set -o pipefail` ("Illegal option -o pipefail",
exit 2). node:22-bookworm-slim (Debian) includes bash, so declaring
shell: bash for this step fixes it without changing the base image.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
docker:27-cli is Alpine with no Node.js, but actions/checkout@v4 is a
JS action that needs a Node runtime in the job container — it failed
at Checkout with exit 127. node:22-bookworm-slim already has Node
(same reason the test job's node:22-alpine works); Docker CLI and
openssh-client are added via apt instead.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The runner (gitea-anouma-runner) runs as a Docker container itself
(gitea/runner:3) with the host's docker.sock mounted in, but no
`docker` CLI binary. A job with no `container:` runs directly inside
that minimal runner image, so `docker login/build/push` failed with
"docker: command not found". Using docker:27-cli gives the job the
CLI; the runner mounts the same host socket into it automatically
(sibling containers), and openssh-client is installed for the deploy
step's ssh call.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This Next.js version generates LayoutProps/PageProps/RouteContext
into .next/types only via `next dev`, `next build`, or `next typegen`
(see node_modules/next/dist/docs .../06-cli/next.md). Typecheck ran
`tsc --noEmit` standalone before Build, so those globals didn't exist
yet, failing with "Cannot find name 'LayoutProps'".
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Setting it job-wide made `npm ci` treat NODE_ENV=production as an
implicit --omit=dev, silently skipping eslint/typescript/test
devDependencies and failing Lint with "eslint: not found".
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Production no longer builds from source or self-updates via cron/git pull:
setup.sh now only provisions the server once (Docker, /opt/anouma, a
restricted `anouma-deploy` SSH user whose key can only ever run
deploy.sh, generated secrets). All future deployments run through
.gitea/workflows/ci.yml (lint/typecheck/test/build on every push) and
release.yml (on a vX.Y.Z tag: build the image, push it to the Gitea
registry, then SSH-trigger deploy.sh on the server), which pulls,
migrates, restarts, healthchecks, backs up the database first, and
automatically rolls back the code on a failed healthcheck.
docker-compose.yml's app service now runs a registry image
(${ANOUMA_IMAGE}) instead of building locally.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
maro
