recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
5d422207f0c9a940d459be9c83beef189ffdad6a
cc-ci-orchestrator/cc-ci-plan/upstream/lasuite-docs.md
T

5.9 KiB
Raw Blame History

Upstream sources — lasuite-docs

service image source repo releases / changelog
app lasuite/impress-frontend https://github.com/suitenumerique/docs https://github.com/suitenumerique/docs/releases
backend lasuite/impress-backend https://github.com/suitenumerique/docs https://github.com/suitenumerique/docs/releases
celery lasuite/impress-backend https://github.com/suitenumerique/docs https://github.com/suitenumerique/docs/releases
y-provider lasuite/impress-y-provider https://github.com/suitenumerique/docs https://github.com/suitenumerique/docs/releases
yhub lasuite/impress-yhub https://github.com/suitenumerique/docs https://github.com/suitenumerique/docs/releases
yhub-valkey valkey/valkey https://github.com/valkey-io/valkey https://github.com/valkey-io/valkey/releases
jwt-keys lasuite/impress-yhub (Node crypto sidecar) https://github.com/suitenumerique/docs https://github.com/suitenumerique/docs/blob/main/UPGRADE.md
docspec ghcr.io/docspec/api https://github.com/docspec/docspec https://github.com/docspec/docspec/releases
db pgautoupgrade/pgautoupgrade https://github.com/pgautoupgrade/docker-pgautoupgrade https://github.com/pgautoupgrade/docker-pgautoupgrade/releases
redis redis https://github.com/redis/redis https://hub.docker.com/_/redis/tags
minio quay.io/minio/minio https://github.com/minio/minio https://github.com/minio/minio/releases
web nginx https://github.com/nginx/nginx https://nginx.org/en/CHANGES

Standing notes

  • v6.0.x replaces the collaboration server: hocuspocus/y-provider collaboration is gone; a new yhub service (port 3002) serves /collaboration/*, with its own yhub PostgreSQL database and a Valkey store. y-provider is conversion-only. New RSA keys (JWT_PRIVATE_KEY_FILE backend, YHUB_JWT_PRIVATE_KEY_FILE yhub), COLLABORATION_SERVER_SECRET removed. Docs must be migrated into yhub (SOFT_MIGRATION=true + backend migrate_documents). See UPGRADE.md [6.0.0].
  • v6.0.2 moves yhub to @y/hub 0.10.1, adding the yhub_ydoc_versions_v1 table/indexes: re-run the yhub schema script (init-db) — the recipe does it on every yhub start.
  • The recipe generates the two RSA keys at runtime into a jwt_keys volume (jwt-keys sidecar) because abra cannot generate PEM secrets (generate=false) and Swarm secrets must pre-exist.
  • docspec: since Docs v5.7.0 the Rust ghcr.io/docspec/api (port 3000) replaces the archived Elixir ghcr.io/docspecio/api (port 4000); Docs v6.0.2 expects DOCSPEC_API_URL=http://docspec:3000/conversion.
  • impress-frontend, impress-backend (used for both backend + celery services), impress-y-provider, impress-yhub (and the jwt-keys sidecar image) all share the same version tag from the suitenumerique/docs monorepo. Upgrade all of them in lockstep.
  • AUTO_MIGRATIONS=true means DB migrations run automatically on backend startup. No manual step needed.
  • Minio tag uses a date-based RELEASE.YYYY-MM-DDTHH-MM-SSZ format — abra cannot parse it for upgrades; check manually on https://github.com/minio/minio/releases.
  • 2026-08-14: Minio stopped publishing Docker images after RELEASE.2025-09-07T16-13-09Z. GitHub has a newer release (RELEASE.2025-10-15T17-29-55Z, published 2025-10-16, with CVE fix GHSA-jjjj-jwhf-8rgr), but the Docker image was never pushed to Docker Hub (returns 404; release notes say "clone the source and build the latest container"). quay.io checked — only 2022-era tags. As of this date, RELEASE.2025-09-07T16-13-09Z IS the newest available Docker image.
  • v5.2.0 adds two optional new env vars: DOCUMENT_ALL_ENDPOINT_ENABLED and OIDC_OP_USER_ENDPOINT_FORMAT. Both are backward-compatible (no action required for existing deployments).
  • Recipe version label convention: 0.X.Y+vA.B.C where A.B.C is the impress version.
  • v5.4.0 removed Bearer/JWT auth on the API (upstream PR suitenumerique/docs#2480 dropped mozilla_django_oidc.contrib.drf.OIDCAuthentication from DRF DEFAULT_AUTHENTICATION_CLASSES). The API now accepts only the app's session cookie from the real OIDC authorization-code flow. Any test/assertion that sends Authorization: Bearer <jwt> to /api/v1.0/* will get 401 — this is the NEW CORRECT behavior, not a regression. The cc-ci lasuite-docs tests were updated for this in cc-ci PR #12 (merged 2026-08-03): test_oidc_login.py + test_create_doc.py now use session cookies and assert Bearer is rejected. Don't revert to Bearer assertions.
  • redis sidecar (cache/broker for celery+backend): prefer the patch line (8.8.1 over 8.10.0) unless a feature is needed — 8.8.1 is a security patch (RedisBloom/TDigest RESTORE RCE); 8.10.0 is a minor with many new features.
  • 2026-09-18: docspec image switched with impress v5.7.0 (upstream PR suitenumerique/docs#2553): ghcr.io/docspecio/api:3.0.x (Elixir, repo ARCHIVED) → ghcr.io/docspec/api:1.21.4 (Rust rewrite, github.com/docspec/docspec). New image listens on 3000 (was 4000): recipe sets DOCSPEC_API_URL=http://docspec:3000/conversion and healthcheck http://127.0.0.1:3000/health (path /conversion and the raw-body request contract unchanged).
  • ⚠️ When checking GHCR tags by script: the /tags/list endpoint CAPS AT 100 tags — a missing tag there means nothing. Verify the manifest endpoint instead (e.g. ghcr.io/docspec/api:1.21.4 is absent from tags/list but pulls fine).
  • 2026-09-13ish: upstream #25 moved the minio pin to quay.io/minio/minio (same RELEASE.2025-09-07T16-13-09Z tag — manifest-verified pullable on quay; quay's own tags/list is paginated and misleading, use manifest checks there too).
  • v5.7.0 moved the favorites API endpoint to /documents/favorites/ — breaking only for external API consumers, not the recipe/cc-ci tests (which use /authenticate/, /users/me/, /documents/).
Reference in New Issue View Git Blame Copy Permalink