@faable/faable 1.15.2 → 1.15.4

package/dist/commands/deploy/index.js

@@ -8,7 +8,7 @@ import { check_environment } from './check_environment.js';
 import { git_context } from './git_context.js';
 import { resolve_app_id } from './resolve_app_id.js';
 import { secrets } from './secrets/index.js';
-import { start_log_sync, mark_build_failure, upload_logs } from './upload_logs.js';
+import { mark_build_failure, start_log_sync, upload_logs } from './upload_logs.js';
 import { upload_tag } from './upload_tag.js';
 
 const deploy = {
@@ -41,20 +41,43 @@ const deploy = {
         const workdir = args.workdir || process.cwd();
         const ctx = await requireApi();
         const { api } = ctx;
-        // Resolve the buildpack plan (detection or forced override). All the
-        // build thinking happens here; build() below just executes the plan.
         const config = Configuration.instance().deployConfig();
-        const plan = await detect_buildpack({ workdir, config }, args.buildpack || config.buildpack);
         const app_id = await resolve_app_id(args.app_id, ctx.appId, api, workdir);
         const app = await api.getApp(app_id);
         // Capture the commit/ref/actor so the deployment records which commit
         // it came from and who pushed it (env in CI, git fallback locally).
         const git = await git_context({ workdir });
+        // Resolve the buildpack plan (detection or forced override). All the build
+        // thinking happens here; build() below just executes the plan. Detection can
+        // fail (e.g. an app whose start command can't be inferred) — and it runs
+        // before the create-first deployment exists, so without this a detection
+        // failure would leave NO deployment row: no deploy-failed email, nothing in
+        // the dashboard, just a red X in the CI logs the user may never see. Record
+        // it as a failed deployment instead.
+        let plan;
+        try {
+            plan = await detect_buildpack({ workdir, config }, args.buildpack || config.buildpack);
+        }
+        catch (error) {
+            // Log the reason into the build buffer first (so it rides along in the
+            // attached logs), then record a typeless BUILD_ERROR row — typeless so it
+            // can't rewrite the app's runtime_strategy. Best-effort: a create that
+            // itself fails (e.g. the free-plan quota gate) must not mask the original
+            // detection error.
+            log.error(error.message);
+            const failed = await api
+                .createDeployment({ app_id: app.id, ...git })
+                .catch(() => null);
+            if (failed) {
+                await mark_build_failure(api, { deployment_id: failed.id, app });
+            }
+            throw error;
+        }
         // Create-first: register the deployment BEFORE building. Gate rejections
         // (free-plan quota 429, disabled app 409) surface here, at second 0 —
         // before any build minutes are spent. The row is born QUEUED; the CLI
         // owns it until the built image lands (or the build fails). `type` rides
-        // on the create as before — the buildpack plan is already resolved.
+        // on the create — the buildpack plan is already resolved.
         const deployment = await api.createDeployment({
             app_id: app.id,
             type: plan.type,
@@ -82,11 +105,15 @@ const deploy = {
             const stop_log_sync = start_log_sync(api, deployment.id);
             try {
                 await buildpack.build({ workdir, config, app, env_vars }, plan);
-                // Upload to Faable registry
-                const { upload_tagname } = await upload_tag({ app, api });
+                // Upload to Faable registry, tagged by version and pinned to digest
+                const { image_ref } = await upload_tag({
+                    app,
+                    api,
+                    deployment_id: deployment.id
+                });
                 // Complete the deployment with the built image — this is the handoff:
                 // the controller claims it and materializes the workload.
-                await api.completeDeployment(deployment.id, upload_tagname);
+                await api.completeDeployment(deployment.id, image_ref);
             }
             finally {
                 stop_log_sync();

package/dist/commands/deploy/upload_tag.js

@@ -1,22 +1,73 @@
 import { log } from '../../log.js';
 import { cmd } from '../../lib/cmd.js';
 
+/**
+ * `<hostname>/<image>:<deployment_id>` — one tag per build, never
+ * overwritten. Without a tag docker resolves `:latest`, which every deploy
+ * rewrites: any rescheduled pod (node drain, eviction) would silently pull
+ * whatever build was pushed last, breaking the deployment ↔ code identity.
+ */
+const build_upload_tagname = (hostname, image, deployment_id) => `${hostname}/${image}:${deployment_id}`;
+/**
+ * Strips the tag from an image ref, keeping registry ports intact
+ * (`host:5000/img:tag` → `host:5000/img`). A colon only denotes a tag when
+ * it appears after the last path segment separator.
+ */
+const strip_image_tag = (ref) => {
+    const last_slash = ref.lastIndexOf("/");
+    const last_colon = ref.lastIndexOf(":");
+    return last_colon > last_slash ? ref.slice(0, last_colon) : ref;
+};
+/**
+ * Pins a pushed tag to its content digest: `repo:tag@sha256:…`. Kubernetes
+ * pulls by digest (immutable even if the tag were re-pushed); the tag stays
+ * as the human-readable label. `RepoDigests` entries come as `repo@sha256:…`
+ * (no tag) and may reference other registries — only the entry for this
+ * repo counts. Returns null when none matches (caller falls back to the tag).
+ */
+const pin_tag_to_digest = (tagname, repo_digests) => {
+    const repo = strip_image_tag(tagname);
+    const match = repo_digests.find((d) => d.startsWith(`${repo}@sha256:`));
+    if (!match)
+        return null;
+    return `${tagname}@${match.slice(repo.length + 1)}`;
+};
 const upload_tag = async (args) => {
-    const { api, app } = args;
+    const { api, app, deployment_id } = args;
     log.info(`🔁 Uploading...`);
     const registry = await api.getRegistry(app.id);
     // Registry login
     const { user, password, hostname, image } = registry;
     await cmd(`echo "${password}" | docker login --username "${user}" --password-stdin ${hostname}`);
-    // Tag image for production
-    const upload_tagname = `${hostname}/${image}`;
+    // Tag the local build (tagged `app.id` by the buildpack) for this version
+    const upload_tagname = build_upload_tagname(hostname, image, deployment_id);
     await cmd(`docker tag ${app.id} ${upload_tagname}`);
     // Upload the image to faable registry
     await cmd(`docker push ${upload_tagname}`);
+    // Pin to the digest the registry just assigned. Best-effort: the tagged
+    // ref alone is already unique per build, the digest just makes it
+    // tamper-proof.
+    let image_ref = upload_tagname;
+    try {
+        const inspect = await cmd(`docker inspect --format '{{json .RepoDigests}}' ${upload_tagname}`);
+        const repo_digests = JSON.parse(String(inspect.stdout).trim());
+        const pinned = pin_tag_to_digest(upload_tagname, repo_digests);
+        if (pinned) {
+            image_ref = pinned;
+        }
+        else {
+            log.warn(`Could not resolve the pushed digest; deploying by tag only.`);
+        }
+    }
+    catch (error) {
+        log.warn(`Could not inspect the pushed image (${error.message}); deploying by tag only.`);
+    }
     log.info(`✅ Upload completed.`);
     return {
         upload_tagname,
+        /** Immutable ref recorded on the deployment: `repo:tag@sha256:…` */
+        image_ref,
     };
 };
 
-export { upload_tag };
+export { build_upload_tagname, pin_tag_to_digest, strip_image_tag, upload_tag };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "1.15.2",
+  "version": "1.15.4",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",