@faable/faable 1.15.3 → 1.16.0

package/dist/commands/deploy/buildpacks/node/index.js

@@ -35,7 +35,15 @@ const node_buildpack = {
         };
     },
     async build(ctx, plan) {
-        const env = R.fromPairs(ctx.env_vars.map((e) => [e.name, e.value]));
+        const env = {
+            ...R.fromPairs(ctx.env_vars.map((e) => [e.name, e.value])),
+            // Platform-injected build-time identity, mirroring the runtime env the
+            // controller sets on the pod. FAABLE_DEPLOY_ID (build id ≡ runtime id)
+            // is the deterministic Next.js buildId source — user secrets can't
+            // override either. See arch/deploy/version-skew-coexistence.md.
+            FAABLE_APP_ID: ctx.app.id,
+            FAABLE_DEPLOY_ID: ctx.deployment.id,
+        };
         log.info(`Building with env variables ${Object.keys(env).join(",")}`);
         // The workflow no longer runs `npm ci` — install here when needed, before
         // the build and before `COPY . .` packages node_modules into the image.

package/dist/commands/deploy/index.js

@@ -104,12 +104,16 @@ const deploy = {
                 .catch((error) => log.warn(`Could not mark deployment BUILDING: ${error.message}`));
             const stop_log_sync = start_log_sync(api, deployment.id);
             try {
-                await buildpack.build({ workdir, config, app, env_vars }, plan);
-                // Upload to Faable registry
-                const { upload_tagname } = await upload_tag({ app, api });
+                await buildpack.build({ workdir, config, app, env_vars, deployment }, plan);
+                // Upload to Faable registry, tagged by version and pinned to digest
+                const { image_ref } = await upload_tag({
+                    app,
+                    api,
+                    deployment_id: deployment.id
+                });
                 // Complete the deployment with the built image — this is the handoff:
                 // the controller claims it and materializes the workload.
-                await api.completeDeployment(deployment.id, upload_tagname);
+                await api.completeDeployment(deployment.id, image_ref);
             }
             finally {
                 stop_log_sync();

package/dist/commands/deploy/upload_tag.js

@@ -1,22 +1,73 @@
 import { log } from '../../log.js';
 import { cmd } from '../../lib/cmd.js';
 
+/**
+ * `<hostname>/<image>:<deployment_id>` — one tag per build, never
+ * overwritten. Without a tag docker resolves `:latest`, which every deploy
+ * rewrites: any rescheduled pod (node drain, eviction) would silently pull
+ * whatever build was pushed last, breaking the deployment ↔ code identity.
+ */
+const build_upload_tagname = (hostname, image, deployment_id) => `${hostname}/${image}:${deployment_id}`;
+/**
+ * Strips the tag from an image ref, keeping registry ports intact
+ * (`host:5000/img:tag` → `host:5000/img`). A colon only denotes a tag when
+ * it appears after the last path segment separator.
+ */
+const strip_image_tag = (ref) => {
+    const last_slash = ref.lastIndexOf("/");
+    const last_colon = ref.lastIndexOf(":");
+    return last_colon > last_slash ? ref.slice(0, last_colon) : ref;
+};
+/**
+ * Pins a pushed tag to its content digest: `repo:tag@sha256:…`. Kubernetes
+ * pulls by digest (immutable even if the tag were re-pushed); the tag stays
+ * as the human-readable label. `RepoDigests` entries come as `repo@sha256:…`
+ * (no tag) and may reference other registries — only the entry for this
+ * repo counts. Returns null when none matches (caller falls back to the tag).
+ */
+const pin_tag_to_digest = (tagname, repo_digests) => {
+    const repo = strip_image_tag(tagname);
+    const match = repo_digests.find((d) => d.startsWith(`${repo}@sha256:`));
+    if (!match)
+        return null;
+    return `${tagname}@${match.slice(repo.length + 1)}`;
+};
 const upload_tag = async (args) => {
-    const { api, app } = args;
+    const { api, app, deployment_id } = args;
     log.info(`🔁 Uploading...`);
     const registry = await api.getRegistry(app.id);
     // Registry login
     const { user, password, hostname, image } = registry;
     await cmd(`echo "${password}" | docker login --username "${user}" --password-stdin ${hostname}`);
-    // Tag image for production
-    const upload_tagname = `${hostname}/${image}`;
+    // Tag the local build (tagged `app.id` by the buildpack) for this version
+    const upload_tagname = build_upload_tagname(hostname, image, deployment_id);
     await cmd(`docker tag ${app.id} ${upload_tagname}`);
     // Upload the image to faable registry
     await cmd(`docker push ${upload_tagname}`);
+    // Pin to the digest the registry just assigned. Best-effort: the tagged
+    // ref alone is already unique per build, the digest just makes it
+    // tamper-proof.
+    let image_ref = upload_tagname;
+    try {
+        const inspect = await cmd(`docker inspect --format '{{json .RepoDigests}}' ${upload_tagname}`);
+        const repo_digests = JSON.parse(String(inspect.stdout).trim());
+        const pinned = pin_tag_to_digest(upload_tagname, repo_digests);
+        if (pinned) {
+            image_ref = pinned;
+        }
+        else {
+            log.warn(`Could not resolve the pushed digest; deploying by tag only.`);
+        }
+    }
+    catch (error) {
+        log.warn(`Could not inspect the pushed image (${error.message}); deploying by tag only.`);
+    }
     log.info(`✅ Upload completed.`);
     return {
         upload_tagname,
+        /** Immutable ref recorded on the deployment: `repo:tag@sha256:…` */
+        image_ref,
     };
 };
 
-export { upload_tag };
+export { build_upload_tagname, pin_tag_to_digest, strip_image_tag, upload_tag };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "1.15.3",
+  "version": "1.16.0",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",